Privacy

Controller

Hesperan, owner Eduard Röhrig, c/o POSTFLEX PFX-581-999, Emsdettener Straße 10, 48268 Greven, Germany — hello@hesperan.com. See the imprint. We have not appointed a data protection officer; we are not required to.

Website

When you open a page, your browser sends us your IP address, the address of the page, the date and time, the page you came from and your browser's User-Agent. Our web server logs these together with the response status and size, to deliver the pages and to find and fend off attacks and errors (Art. 6(1)(f) GDPR). The log is rotated daily and kept for 7 days, so an entry is deleted after 8 days at the latest.

Everything on hesperan.com, including fonts, images and videos, comes from our own server; no page loads anything from other companies, and no visit is measured with analytics or advertising tools.

Cookies and your browser

We store nothing in your browser while you only read the website. When you sign in, we set one cookie, __Secure-better-auth.session_token, which keeps you signed in for 7 days after your last visit and is deleted when you sign out. It is strictly necessary for the sign-in you ask for, so it needs no consent (§ 25(2) no. 2 TDDDG; Art. 6(1)(b) GDPR). We use no local storage, tracking or advertising cookies.

Account and sign-in

For your Hesperan account, which Hesperan Bots signs in with, we store your email address, your name if GitHub gives it to us, when you created the account and how you sign in (Art. 6(1)(b) GDPR). Your email address is required: without it we cannot sign you in.

Sign-in links are sent by email through our email provider (see Processors). A link works once and for 15 minutes; we store only a hash of it, and delete it when it has expired. For each sign-in we store a session with the IP address and browser User-Agent it was started from, so that sessions can be told apart and misuse can be traced (Art. 6(1)(f) GDPR). Sessions end 7 days after their last use or when you sign out; we delete ended sessions.

If GitHub sign-in is offered and you use it, GitHub, Inc. (USA) tells us your GitHub user ID, profile name, email address and profile picture address, and gives us an access token that we store with your account but do not use. GitHub processes your sign-in under its own privacy policy; GitHub, Inc. is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

You can download everything we store about your account and delete the account on your account page. Deleting it removes your account data, sessions, signed-in Macs, PCs and servers and their tokens, and your problem reports at once; copies in our backups disappear with them (see Retention).

Hesperan Bots

Hesperan Bots is an app for your Mac or Windows PC, and a server program for your own Linux computer. Your bots, chats, memory, files and settings are stored on your computer, or on your server if your bots run there, and are not sent to us, unless you include them in a problem report. Keys and passwords you enter in the app are kept encrypted on your computer: in your Mac's keychain, on a PC with Windows' data protection for your Windows account, and on a server with a key in its own data folder. The app has no analytics or telemetry, and it sends a problem report only when you choose to (see Problem reports and crashes). Below, "your computer" also means your own server where your bots run there.

Your account and your computers

The app needs your Hesperan account. Besides your email address and name (see Account and sign-in), we store for every Mac, PC or server you sign in on: the name the app reports for it, which is the computer's name and often contains your own name (for example "Alex's MacBook Pro" or "ALEX-PC"; a server reports its host name, or the name you gave it), when it signed in and when it was last used, and its sign-in tokens, only in hashed form. You see these computers and can sign each of them out on your Hesperan Bots page. Signed-out and expired computers are deleted 30 days after they ended, all others with your account. Legal basis: Art. 6(1)(b) GDPR (providing the free account and the app's updates you asked for).

What the app sends to hesperan.com

The app, and a server you signed in, contact hesperan.com to sign in; to check your sign-in, 3 seconds after they start and then every 6 hours; to check for updates (the Mac app, the Windows app and the server each in their own update feed): the apps 30 seconds after they start and then every 4 hours, a server 2 minutes after it starts, then every 6 hours and when you choose Update server or run its update script; and to download them; to download the system of a bot's computer when you start one (and newer versions of it later); and, only when you choose Send, to deliver a problem report (see Problem reports and crashes). These requests carry your IP address, the app's version, whether it runs on macOS, Windows or Linux, and its sign-in token, so we know which account and computer asked; that is how we know when a computer was last used. In Mac app versions up to 1.0.1 the update check also sends a random number the updater creates once (its installation ID); we neither log nor store it. The Windows app has never sent one. Our server logs these requests like any other (see Website). For downloads from your account page and of the bot computer we count how often each version was downloaded, without recording who downloaded it. Legal basis: Art. 6(1)(b) GDPR.

Problem reports and crashes

In the app you can report a problem, and after the app stopped unexpectedly it offers to report that. A report reaches us only when you choose Send, and the app shows you what it contains before you send it. A report contains:

• What you write.
• If you leave the diagnostic info in: the app's version, update channel and whether it is a release build; the version of macOS or Windows; on a Mac the kind of Mac (for example "MacBook Pro") and its chip, on a PC the name of its processor (for example "AMD Ryzen 7 5800X 8-Core Processor"); the processor type, number of cores and memory size; the app's language; which features are turned on and how many of each you use (for example how many bots), never what is in them; and the app's most recent log lines. In these lines the app hides keys, tokens, passwords, email addresses, your user name in folder paths and the names of your bots before anything is sent.
• If your bots run on your own server and you leave the diagnostic info in: the server's version, its Linux distribution and kernel, processor type, number of cores and memory size, how Hesperan Bots was installed there (Docker, a system service or a folder), which features are turned on there and how many of each you use, and the server's most recent log lines. In these lines the server also hides the names of your bots, devices, shared folders and projects, its own name and public IP addresses.
• If you add it: a screenshot of the app's window. It shows what was on the screen, which can include your chats.
• After a crash, only if you agree in the notice: which part of the app stopped, the reason and exit code, when it happened and in which version. The crash files themselves (minidumps) stay on your computer; the app deletes them after 30 days and never sends them.

Apart from what you write and what a screenshot shows, a report contains none of your chats, memory, files or keys. It comes to us, Hesperan, and is stored on our server in Germany (see Processors) together with your account and the name of the computer that sent it. We use it only to find and fix problems in the app and give it to no one else. Like every request from the app, sending it carries your IP address, which our web server logs (see Website).

We delete a report automatically 90 days after it arrived. You see the reports you sent on your Hesperan Bots page and can delete each of them earlier; deleting your account deletes them too. Legal basis: Art. 6(1)(b) GDPR for receiving and answering the report you send us, and Art. 6(1)(f) GDPR for using it to find and fix problems in the app (our legitimate interest in an app that works; you decide what a report contains, and you can object, see Your rights).

Other services the app contacts

The memory search model. Ten seconds after the app starts, until it has them, the app downloads the files of the model it uses to search memory by meaning (IBM's Granite Embedding, about 124 MB, Apache-2.0). Current versions download them from hesperan.com, without the sign-in token; we log these requests like any other (see Website) and count nothing. Mac app versions whose Memory page says "downloaded once from Hugging Face" while they prepare search (1.0.1 and earlier) download them directly from huggingface.co instead: Hugging Face, Inc. then receives your IP address and the usual request data and processes them as its own controller under its privacy policy, on servers in the USA (its establishment in the EU is Hugging Face SAS, Paris). Either way this happens also before you sign in, and we chose it so that memory search works on your computer without sending your memory anywhere (Art. 6(1)(f) GDPR).

The AI you choose. To answer, and in the background to tidy up its memory (after a quiet period and at night), a bot sends the conversation and what it needs from memory, your profile and your files directly from your computer to the AI provider you chose for it: for example OpenAI, Anthropic, OpenRouter or another service you entered, or Codex or Claude Code on your computer, signed in with your own account. With a local model (Ollama, LM Studio) this stays on your computer. The provider processes these data under its own terms and privacy policy; we do not receive them. Codex and Claude Code may send their own usage data under their settings. If you let the app set them up, it downloads them from their makers: on a Mac, Claude Code with Anthropic's installer from claude.ai; on a PC, Codex and Claude Code from the npm registry (registry.npmjs.org). These servers receive your IP address and the usual request data.

Websites and services your bots use. A bot's browser visits websites directly from your computer, and the websites see what it sends them. Web searches go to Brave Search (search.brave.com) unless you choose another search address in Settings. Extensions you add connect to their own services (for example your email provider, Google, Microsoft, Notion or Slack), and Telegram (api.telegram.org) is contacted only if you connect your own Telegram bot. Each of them receives your IP address and what the bot sends it, under its own terms.

Bot computers. They are off until you turn one on. A bot's computer reaches the internet only through the app on your Mac or PC and only if you allow it; it cannot reach your computer (apart from the folders the app shares with it, such as the bot's own folder), your home network or your other devices. Programs inside it, such as Debian's package tools or its browser, may contact their own servers.

AI tools you connect. If you pair an AI tool such as Claude Code or Codex with your bots, it connects to your computer directly over your own network, not through us. It can then read your bots' chats, send them messages and see what waits for your approval (it can never approve anything), and it may send what it reads to its own AI provider under that provider's terms. We do not receive any of it.

Your iPhone. The iPhone app connects to your Mac, PC or server directly over your own network (Wi-Fi or Tailscale), not through us, unless you use Hesperan Connect (below).

Hesperan Connect

If you choose "Away from home" for a paired iPhone (your Mac or PC asks when you pair it, and each paired iPhone has its own switch in the app's settings), your computer and those iPhones connect to hesperan.com so that your iPhone can reach your computer when they are not on the same network. While no paired iPhone has Away from home on, your computer does not connect to hesperan.com for this. We only pass the connection on: it is encrypted from your iPhone to your computer with your computer's own key, which your iPhone checks, so we cannot read or change your chats, bots, files or anything else that goes through it. What we do see: your computer's sign-in token when it connects (to know which account and computer it is), the IP addresses of your computer and iPhone, a random number for each paired iPhone (your computer creates it; we receive only a hash of the iPhone's key), and when and how much data each connection passes. The relay keeps this in memory only, while the connection lasts; the day's amount of data per account until the end of that day (for a fair-use limit); and the hashes of your iPhones' keys for 7 days after your computer disconnects (so a phone whose computer is asleep isn't mistaken for someone guessing). The relay writes none of this to disk. When your computer connects, the "last used" time of that computer on your account is updated, as when it checks for updates (at most every 5 minutes). Our server logs the connection requests like any other request (see Website). Turning Away from home off for an iPhone ends its connections through us. Legal basis: Art. 6(1)(b) GDPR (the service you turned on).

Notifications on your iPhone

If you turn on "Notify me when a bot needs me" in the iPhone app (it is off until you do, and it works only with Away from home on for that iPhone), your iPhone gives us its push token: an address Apple assigns so that notifications for our app reach your iPhone. We store it with whether it belongs to a test or a store version of the app, the random number your computer created for that iPhone, the hash of the iPhone's key (see above), your account and the Mac or PC it belongs to, and when it was registered, changed and last confirmed by that computer. When a bot needs you or finished something while you are away from your computer, your computer asks us to notify your iPhone, and we send it with one of two fixed texts, "A bot needs you." or "A bot finished something for you to read.", and a random reference that only your computer can resolve once your iPhone asks it. A notification never contains what it is about, the bot's name or anything else from your computer, and we don't store when we sent one. Apple delivers it through the Apple Push Notification service: Apple Inc. (USA) receives the push token, that text, the reference and the time, as part of your iPhone's operating system, under Apple's privacy policy; Apple Inc. is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). We delete the push token when you turn notifications off or unpair the iPhone, when you remove the iPhone, turn Away from home off for it or sign out on your Mac or PC, when that computer is signed out on hesperan.com, when Apple says the token is no longer valid, 30 days after your computer last confirmed it, and with your account. Legal basis: Art. 6(1)(b) GDPR (the service you turned on).

The iPhone app's test on TestFlight

During Early Access you get the iPhone app through Apple's TestFlight app, under Apple's terms; Apple Inc. processes the data of your Apple account for that as its own controller, under Apple's privacy policy. If you send feedback in TestFlight (what you write and, if you add one, a screenshot) or the iPhone app stops unexpectedly and you share the crash with developers, Apple passes it to us in App Store Connect, with your iPhone's model, iOS version, the app's version and the time, and the email address of your Apple account where Apple shows it to us. Apple also shows us how many people installed and opened the app, as counts. We use this only to find and fix problems in the app and give it to no one else. It stays in App Store Connect, where we delete feedback and crash reports once the problem is dealt with, at the latest after 12 months. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in an iPhone app that works; you decide whether you send feedback, and you can object, see Your rights).

Email to us

When you write to us, we use your email address and message to answer you (Art. 6(1)(b) GDPR where it concerns a contract, otherwise Art. 6(1)(f) GDPR). The mailbox is hosted by our email provider. We delete messages when the matter is settled, unless we must keep them for tax or commercial law.

Interest list

Before the first version was published you could register your interest. We stored your email, company and message to contact you (Art. 6(1)(a) GDPR). You can withdraw at any time; we delete the entries 12 months after the first public version at the latest.

Processors and hosting

OVHcloud (OVH GmbH, Cologne, Germany; servers in Limburg, Germany) for hosting, and ALL-INKL.COM – Neue Medien Münnich (Friedersdorf, Germany; data centres in Germany) for email, including the sign-in links, and for encrypted copies of our database backups. Both act as processors on our behalf (Art. 28 GDPR).

Hugging Face, the AI providers, websites and services you choose for Hesperan Bots, Apple (notifications to your iPhone) and GitHub are not our processors; they process data as their own controllers, as described above.

Retention

Your rights

Access, rectification, erasure, restriction, portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work. The authority responsible for us is Der Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany (postal address: Postfach 221, 30002 Hannover), poststelle@lfd.niedersachsen.de, www.lfd.niedersachsen.de. Where we rely on your consent, you can withdraw it at any time for the future. Write to hello@hesperan.com.

Right to object. Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We then stop, unless we can show compelling legitimate grounds or need the data to establish, exercise or defend legal claims.

We make no automated decisions about you that have legal or similarly significant effects (Art. 22 GDPR).