Privacy
We can't see your data. Here's what that actually means.
The short version
HUPI is self-hosted software, not a hosted service. We never see, store, or transmit your conversations or memory data — everything lives in your own Postgres, encrypted with your own key. This page covers both what the software does and what this website (hupi.dev) itself collects.
What HUPI (the software) does with your data
Nothing, because it never reaches us. There is no HUPI-run backend, no telemetry, and no phone-home in the gateway, the consolidation jobs, the admin tooling, the VS Code extension, or HUPI Code (our VS Code fork with that extension built in). Every conversation, summary, and entity is stored in your own Postgres database, encrypted with your own key, on infrastructure you control — the extension and HUPI Code both talk only to the gateway URL you configure, nothing else. If you configure OIDC/SSO for Tier 3, the only data involved is what your identity provider already puts in a standard access token (a stable subject identifier and role/group claims) — verified locally against your own configured issuer, never forwarded to us or anyone else.
What this website collects
hupi.dev uses Google Ads conversion tracking to see which pages and ad campaigns are actually useful — nothing else. This is scoped to the website only: it is never loaded, referenced, or shipped in HUPI the software (the gateway, the VS Code extension, or HUPI Code), which remains fully self-hosted with zero telemetry, exactly as described above. On this website, it sets a Google-controlled cookie and records: which page you're on, whether you clicked through to our GitHub repo or the VS Code Marketplace, and whether you submitted the contact form. It does not see the content of anything you type into the contact form beyond what Google's own ad-attribution system needs (essentially none of it) — form submissions themselves go to Web3Forms, a third-party form-processing service, not through Google Ads at all (see "If you use the contact form" below). Nothing loads until you explicitly accept the cookie banner shown on first visit; declining (or ignoring it) means none of this ever runs for you.
If you use the contact form
Whatever you submit through the /contact form — name, email, company, and message — is sent directly to Web3Forms (web3forms.com), a third-party form-processing service, which emails it to us. We don't run our own backend for this (hupi.dev is a fully static site), so this is the one place data you type in passes through infrastructure we don't control before reaching us. We only use it to respond to your inquiry.
If you email us
Whatever you send to work@hupi.dev — for a Tier 3 license inquiry, a bug report, or anything else — is the only information about you we hold, kept only as long as needed to respond and, for a Tier 3 license, to administer it. We do not sell it, share it with third parties, or use it for anything beyond that.
Your rights (EU/EEA and elsewhere)
Because we collect essentially nothing about site visitors and don’t process your actual data at all (it stays on your own infrastructure), there is very little for these rights to act on in practice — but where they apply, you can ask to access, correct, or delete any information we do hold about you (realistically: the contents of an email you sent us), object to how it’s used, or ask for a copy of it, by contacting the address below. We act as the data controller only for that email correspondence, not for anything stored in your own HUPI deployment.
Changes to this policy
If what we collect changes further, this page will be updated to reflect it before that change takes effect, not after — same commitment that led to this page being rewritten when Google Ads conversion tracking was added, rather than left silently out of date.
Questions
Contact work@hupi.dev — or read the actual source code on GitHub to verify any of this yourself, rather than take our word for it.