Privacy

Temporary resources

• What we store. The resource itself: uploaded files, shared text, received webhook requests including their headers and bodies. Alongside it, the time it was created, when it expires, the IP address that created it, and the X-Hello-Client value if one was sent.
• For how long. Until expires_at, at most 24 hours after creation, or earlier when the holder of the key deletes it. A sweep removes expired resources and their files within minutes.
• Who can read it. Anyone with a share link can read the share. Only the holder of the key can read uploaded files or received webhook requests. Anyone with an upload link can add files to it; anyone with a webhook URL can send requests to it. Treat links accordingly.
• Link analytics. Each request to a link is recorded so its creator can see what happened to it: the time, what the request did and whether it worked, the approximate location and network (from our hosting provider), the browser, device and language, the referring site and any utm_* tags, and the request headers without cookies, credentials or anything named like a key, token or secret. The link key is never recorded, and neither is content: no file names, text or bodies. The IP address is kept too, except for visitors in the EU, EEA, UK and Switzerland, for whom we also drop the postcode and coordinates. The creator sees counts, places, devices and referrers, never IP addresses, headers or anything else that singles a person out. These records are kept for 400 days, after the link itself is gone.
• What we do not do. We do not index, scan for advertising, or share the contents with anyone. Server logs record the resource id, kind, client and IP for rate limiting and abuse handling, not the contents.

Agent addresses

• Your account. The email you signed in with, your username, and your display name.
• Your addresses. Each agent's handle, its visibility, and the link key if it has one.
• Routing. Which of your computers an agent answers on, and a hash of that computer's relay token.
• A relay log. For each message: which agent, a hashed identifier for the sender, whether it succeeded, and how long it took.
• Your tokens and API keys. They go from your phone to your own computer. They are never sent to us.
• HTTP and MCP chat. Message text passes through the relay in memory to reach your computer and is not persisted.
• A2A tasks. Task requests, message history and cached text results are kept in private relay-side storage for up to seven days, scoped to the calling account and destination assistant.

Web visitors

We use our own self-hosted analytics service to understand how the website is used. It records page views and aggregate details such as the referring page, browser, operating system, device type and approximate location. It does not set analytics cookies, store your raw IP address or use cross-site identifiers. Global Privacy Control is always respected, and Do Not Track is respected by default. It is not loaded on the analytics and claim pages, whose addresses carry a link's key.

The upload and share pages talk to the API from your browser and keep nothing locally. Opening one counts as a visit to that link and is recorded as described under link analytics above, including the site that sent you there. The agent chat keeps a random conversation id in local storage so your thread survives a reload; it is not an account. Your IP address is used for rate limiting.

Third parties

We run hello.new on a few service providers: cloud hosting for the website and the API, file storage, a managed database for resources, link analytics, accounts and sign-in, an email service that sends sign-in codes, and a payment processor for Pro subscriptions. They handle data only to provide those services to us. Website analytics run on our own self-hosted service.

Your data

Delete a temporary resource with its key and it is gone at once. Delete an agent's address and it stops resolving immediately. Delete your account and your profile, addresses and routing rows go with it. Ask us at [email protected] and we'll do it by hand if that's easier.