HITO

Privacy Policy

October 15, 2026

1. Controller

The data controller is Hito Labs (Tax ID: pending incorporation; address: pending incorporation; registry: pending incorporation). You can contact us at [email protected].

2. What data we collect and why

We collect only what is needed to provide the service, and the legal basis for each use is:

  • Account (email, password stored as a hash (unreadable), name, bio): to provide the service (contract).
  • Sessions and events — which app is in the foreground and when, without window titles —: to run focus and blocking (contract).
  • The text of your milestones and plans: to store and sync them; it is encrypted in the database (contract).
  • The AI assistant and dictation: what you type to the assistant and the text of PDFs you give it, to generate a plan; your voice, to transcribe it (audio is not stored) (contract).
  • Profile photo, if you upload one: stored in our database and deleted with the account (contract).
  • Sign in with Google: we receive your email, your name and the unique identifier Google gives your account (sub); your Google password never reaches us (contract).
  • Google Calendar copy, only if you connect it yourself from Settings in the portal (consent): we send Google the name of your plan, the name of the objective, the date and time of each planned session with your time zone and an internal Hito identifier to recognise each event, so they show up with their reminder in a calendar called «Hito». We ask for two permissions: one only lets us see and change that calendar Hito creates; the other lets us see when you are busy in your main calendar over the next 60 days, without titles, attendees or event details, so we do not plan sessions on top. We store, encrypted, the token Google gives us to keep it up to date and those busy times. When you disconnect, and also when you delete your account, we delete the token and the busy times and ask Google to delete the «Hito» calendar and revoke the access. You can remove our access from your Google account at any time.
  • Sign in with Apple: we receive your email (or Apple's private relay address, if you choose it) and the unique identifier Apple gives your account (sub). We also store, encrypted, the token Apple gives us, only so we can revoke that access when you delete your account (contract).
  • Two-step verification, if you turn it on: we store, encrypted, the key shared between your authenticator app and our server and, as hashes (unreadable), your backup codes. When you turn it off we delete the key and void the codes; everything is deleted with the account (contract).
  • Crash reports («Error reports» in Settings): only if you turn them on, off by default (consent). On desktop, when something fails in the app it sends our own crash log (a service of ours, the log-sink Worker, on Cloudflare D1) the error message and its technical trace, the app version, the operating system, a random installation identifier and your account identifier if you are signed in, never your email. Before anything leaves the computer, emails, tokens, folder paths and IPs are masked; nothing about your plans or what you do on the computer is sent. On Android, Firebase Crashlytics does this. If you send us a report yourself with «Report a problem», it carries your description, your email only if you leave its box ticked, and logs only if you tick theirs; we keep those reports while we investigate the problem. What reaches our crash log is deleted after 30 days; for each failure we also get an email notice (Resend) with the same data, which we delete by hand.
  • Problem reports ("Report a problem" on desktop; "shake to report" in the test versions of the iPhone and Android apps): only when you choose to send one (consent). A report contains what you write, the last lines of the app's technical logs (we strip emails, IP addresses, credentials and file paths with your user name), the version, the system, the device model and the screen you were on, and a screenshot of the window if you leave it ticked; the screenshot can show whatever is on screen, so remove it if it shows something you do not want to share. It is stored in our crash log (log-sink), which deletes it after 30 days, and copied to a card in our issue tracker, Jira (Atlassian, US), with the screenshot attached; that card does not carry your email or your account or installation identifier. We keep the card while we fix the problem; if you want us to delete it sooner, write to us.
  • Report a problem from Help, in the iPhone and Android apps: only when you choose to send it (consent). It carries what you write and, if you record one, a voice note of up to 2 minutes (the app asks for the microphone only when you tap record). With «Attach technical data» ticked it also carries the Hito version, the system, the phone model and the name of the screen you were on. It always carries your account email, so we can reply, your account identifier if you are signed in, a random installation identifier, the language, the theme and the text size. The email and the identifiers stay in our crash log (log-sink, on Cloudflare), which deletes them after 30 days. The description, the technical data and the voice note are copied to a card in our issue tracker, Jira (Atlassian, US), without your email or your identifiers; even so, your voice can identify you. That card does not expire on its own: we delete it by hand, with the voice note, if you ask us to. If sending fails, the app opens your email with the text and the note attached, and it only leaves if you send it yourself.
  • Waitlist: your email and the date, if you sign up before launch (consent). You can unsubscribe with the link in our emails or by writing to us.
  • Security: we use your IP for the Turnstile captcha and to limit abusive requests, without storing it in full. What we do store, for each sign-in and other security events on your account (password change, two-step verification, deletion), is your IP's network (its first blocks: /24 for IPv4, /48 for IPv6), the country you connect from and a scrambled summary (hash) of your browser or app (user-agent), to spot unusual access to your account; it is deleted after 90 days (legitimate interest).
  • Your devices: each installation of the app creates a random installation identifier (not the manufacturer's or the advertising identifier), to sync your data across devices. If you turn on notifications, we also store that device's push notification token (Firebase on Android, Apple on iPhone), to send you notifications. Both are deleted with the account (contract).
  • Desktop updates: the app contacts api.hitozone.com (the downloads endpoint) to check for a new version; that request carries your IP, the app version and your platform (legitimate interest).
  • Usage statistics (our own analytics): from the usage data you already sync for the app to work (sessions, plans created, when you last opened the app and whether phone blocking is on), our server counts the day's totals every night: active accounts, plans created, sessions started, completed and strict. Only those daily totals are stored, without your account or name next to them. While we have few users, a count can correspond to a single person; that is why only the Hito team sees them, they are not shared with third parties, not used for advertising and deleted after 24 months. They help us decide what to improve in Hito (legitimate interest). The team can also see, on the spot, averages and counts of recent usage (average focus time per session, how much of it went to distractions, the average number of app switches per session, which kind of device Hito is used on and how many accounts come back each week); this is not stored: it is computed when viewed.
  • The question “How would you feel if you could no longer use Hito?”, only if you answer it (consent: it is optional and “Not now” saves nothing): we store your answer (very disappointed, somewhat disappointed or not disappointed) and the date, once per account. The Hito team only sees it added up with other accounts’ answers, by signup week and never with fewer than 3 answers together. It is deleted with your account, or earlier if you ask us.

3. Who we share your data with

We do not sell your data. We use artificial intelligence and other providers that process it on our behalf, only to operate the service:

  • Cloudflare — hosting, AI, Turnstile, files; where: global/US; transfer basis: DPF + standard contractual clauses (SCC).
  • Neon — database; where: London; transfer basis: UK adequacy decision.
  • Resend — service emails and the internal notice of crash reports; where: US; transfer basis: DPF/SCC.
  • Google — sign in with Google and, if you turn it on, the copy of your sessions in Google Calendar; where: US; transfer basis: DPF.
  • Firebase — push notifications and optional crash reports (Crashlytics) on Android (Google); where: US; transfer basis: DPF.
  • Apple — push notifications on iPhone; where: US; transfer basis: DPF.
  • Atlassian — handling the problem reports you send us (description, technical data and, if you attach them, screenshot and voice note) (Jira); where: US; transfer basis: DPF + standard contractual clauses (SCC).
  • Desktop crash reports also go through a service of our own, hosted on Cloudflare.

4. How long we keep it

  • Events (which app you used and when) are deleted after 90 days; your hours and progress never expire.
  • The security log (your IP's network, the country and the user-agent hash of each sign-in) is deleted after 90 days; if you delete your account sooner, it is no longer linked to you and is still deleted when the 90 days are up.
  • If you delete your account, you get a 30-day grace period in case you change your mind; after that, it is purged in cascade.
  • Waitlist: your email is kept until we invite you or you unsubscribe (with the link in our emails or by writing to us); it is also deleted if you delete your account.
  • Beta invitation: kept until you delete the account with that email.
  • The desktop's local file (hito.db) is on your machine. To delete it: tick «Also delete the data on this PC» when deleting your account, press «Reset» in Settings, or answer «Yes» when the uninstaller asks whether to delete your data.
  • On iPhone, to delete your account go to Settings → Account.

5. Your rights

  • Access and portability: "Download my data" on the web, or the desktop export.
  • Erasure: "Delete my account" on the web, desktop, Android or iPhone (Settings → Account).
  • Rectification, objection and restriction: write to us at [email protected].
  • Complaint: to the AEPD (aepd.es), Spain's data protection authority, if you think we mishandled your data.

6. Minimum age

Hito is for people 18 and older. We do not knowingly collect or process data from anyone younger.

7. Cookies and storage in your browser

We only use technical cookies and storage, needed for the site to work and exempt from consent under Spanish law (LSSI art. 22.2). We do not use advertising or analytics cookies.

  • hito_lang (cookie): your language; lasts 1 year.
  • hito_rt (api.hitozone.com cookie, not readable by the page's JavaScript): keeps you signed in; removed when you sign out and expires after 30 days.
  • hito_session (cookie): only marks that you are signed in, holds no data about you; removed when you sign out and expires after 30 days.
  • hito_waitlist (in your browser): the emails you signed up to the waitlist, to remind you.
  • nuxt-color-mode (in your browser): your theme, light or dark.
  • hito_admin_env and hito_admin_staging (in your browser): administrators only.

8. Artificial intelligence

  • We use Meta's Llama models for the assistant and OpenAI's Whisper for dictation, both through Cloudflare Workers AI.
  • The plan assistant is sent the milestone's title, summary, goals, your availability, the messages you type in the chat and, if you give it a PDF, excerpts of the text extracted from it (headings, lists and dates). Dictation sends the audio, which is transcribed and not stored.
  • The AI proposes a plan; you always make the final call by confirming it. There are no automated decisions with legal effects on you.
  • You can connect your own AI model (BYOLLM) instead of ours.

9. The iPhone app

  • Screen Time: the apps and categories you choose to block with Apple's picker are stored only on your iPhone; that selection does not leave the phone and never reaches us. What syncs from blocking is the list of websites you type yourself (for example, "instagram.com") and the blocking status described in the next point.
  • Blocking status across your devices: during a focus session, the iPhone tells your other devices whether it is blocking and, if not, why (for example, that Screen Time permission is missing or which apps in the plan you have not marked yet). To do that it sends our server the iPhone's installation identifier, the session identifier, that yes or no with the reason, how many apps, categories and websites it covers, and the names of the plan's apps still to be marked (for example, "Instagram"). It is kept only while the session lasts: it is deleted when the session ends or when you delete your account (contract).
  • Diagnostics: the iPhone app has no crash reporting or third-party analytics (no Crashlytics, no MetricKit). In the App Store version its technical logs stay on the phone; only what you send with «Report a problem» from Help leaves it (section 2). In the test versions (TestFlight) you can also shake the iPhone to send us a problem report; those logs, and the screenshot if you attach it, then leave the phone as explained in section 2. The only statistics drawn from your usage data are the aggregate figures in section 2.
  • Blocking trace, test versions only (TestFlight): in those versions, each time the iPhone turns blocking on or off it automatically sends us a technical record of the steps it took (the Screen Time permission, which apps and websites the plan asked for, including websites you typed yourself, how many were applied and the result), linked to your account and installation identifier. We use it to fix blocking bugs; it is stored in our crash log (log-sink) and deleted after 30 days. The App Store version does not send it.
  • No advertising or tracking: we do not use Apple's advertising identifier or combine your data with other companies' data.