Hubort Privacy Policy

This policy covers both parts of Hubort: the browser extension (Chrome, Edge and other Chromium browsers, and Firefox) and the Hubort desktop application for Windows, which runs the local server the extension talks to. They are designed to work together and are described together here.

1. Who we are, and why this policy is short

Hubort is built and published by Muhammad Faizan Raza (“we”, “us”). You can reach us at support@hubort.app.

Hubort is local-first software. We do not operate an account system or a data warehouse, and there is no analytics unless you switch on usage reports. There are three parts to what that means, and each is absolute rather than hedged.

Your conversations: still nothing, still nowhere. We never receive your conversations, your search queries, your account labels, or any identifier tied to them. Most of what a privacy policy normally has to explain — how long we keep your data, who we share it with, how to request deletion — does not apply to any of it, because we never hold it in the first place.

Your purchase, if you make one. Hubort is free for two accounts, and starts with 14 days of Pro that need nothing from you. A subscription or a one-time purchase lifts the limit. If you buy, the checkout runs on Paddle's own page, in your browser: Paddle is the seller of record and receives your name, email address, country and payment details. From that we receive an email address and a licence record, and we send you a licence key. We never see card details. We never link a purchase to conversation data, because we have none to link it to. Section 6 sets out exactly what that involves.

What you choose to tell us. A problem report, the one question Hubort asks after a week, the one question after an uninstall, and the optional daily usage report reach us only when you send them or switch them on. None of them contains your conversations, their titles, your searches or your accounts' names, and each shows you what it holds before it goes. Section 12 says exactly what each one does, where it goes and how long it is kept.

2. What the browser extension reads

Once you install the extension in a browser profile, it uses that profile's existing signed-in session to read your own conversation data from each AI service you switch on in the extension — Claude, ChatGPT, Gemini, Grok, or any combination — the same data the website itself loads when you open your chat sidebar. Every service is off until you tick it, and your browser asks your permission before the extension can read that service's site at all. Specifically:

• Your conversation list: titles, conversation IDs, and created/updated timestamps.
• The full text of the messages in each conversation, both yours and the assistant's.
• The filenames of files attached to a conversation. The contents of attached files are not read.
• The titles and descriptions of tool or “steps” cards shown inside a conversation.
• Your current usage-limit status (how much of your rate limit is used, and when it resets), for Claude and Grok only.
• Each service's internal identifier for your account, and for you as the person signed in to it, so Hubort can recognise the same account when another browser syncs it. For Claude these come from the account details claude.ai's own website loads; for Gemini, from the page Gemini's own web app loads; for Grok, from the sign-in details grok.com's own website loads. In each case the name and email address in that answer are not kept.

ChatGPT. To read your conversations on chatgpt.com, the extension asks it for the short-lived access token its own website uses. That token is held in memory for the length of one sync and sent only back to chatgpt.com. It is never stored, and never sent to the Hubort app or anywhere else. The same answer from chatgpt.com also contains your session token, which the extension does not keep or use. Unticking a service withdraws its permission and stops all reading of its site; conversations already copied stay on your computer until you delete them.

Gemini. Gemini has no sign-in of its own to Hubort: the extension reads your conversations from gemini.google.com with the Google session that browser profile already holds. Every one of those reads has to carry the short-lived page token that Gemini's own web app puts in its page, so the extension reads that token from the page, holds it in memory for the length of one sync, and sends it only back to gemini.google.com. It is never stored, and never sent to the Hubort app or anywhere else. From the same page the extension reads Google's own numeric identifier for the account, which is how Hubort recognises that account when another browser syncs it. One browser profile can be signed in to several Google accounts at once, and you choose which of them Hubort syncs: when you open that list in the extension, it reads each signed-in account's email address purely so that the list can show you which account is which. That address is shown in the extension and nowhere else — it is not stored, not sent to the Hubort app, and not part of what identifies the account. The extension signs you into nothing, requests no Google account permissions, and reads no Google service other than Gemini.

Grok. The extension reads your conversations from grok.com with the session that browser profile already holds, and reads no token of any kind. From the sign-in details grok.com's own website loads, it keeps only xAI's identifier for you and, if your account belongs to a team, the team's; your name, email address and any X account linked to it, which the same answer contains, are not kept. It also asks grok.com how much of your account's query limit is used and when it resets, the same figure grok.com shows you when you reach it. Grok conversations held on X (x.com) are a separate history, and the extension does not read x.com at all.

While Claude is switched on, the extension also runs a small script on Claude's pages (claude.ai), and on no other site, that looks at exactly two on-screen elements — the “upgrade to keep chatting” dialog and the message composer's usage banner — solely to read the time a rate limit resets. It does not read the rest of the page, and it never reads your conversation transcript from the page.

If you enable the optional instant-sync feature, the extension additionally observes the address and success status of Claude's own conversation requests, and of ChatGPT's, Gemini's and Grok's while those services are switched on, so that it knows to re-check when you create, rename, pin, archive or delete a chat. It does not read the contents of those requests or responses.

3. Where that data goes

To exactly one place: the Hubort server running on your own computer, at http://127.0.0.1 on port 8787 — or, if another Windows account on the same computer is already using that port, the next free one up to 8796. Alongside the conversation data, the extension sends the account label you gave that account in its popup, so the app can tell your accounts apart; which service each conversation came from, with that service's own identifiers for the account it was read from and for the person signed in to it, so two accounts on one service are never mixed up and one account synced from two browsers is recognised as one; whether each sync worked, as a short error code and never the error's text, so the dashboard can tell you when an account has stopped syncing; and the pairing token your Hubort app issued to that browser profile, so the app only accepts data from browsers you have paired with it.

127.0.0.1 is the loopback address — traffic to it never touches a network. It cannot leave your computer, and it is not reachable by anyone else, including us.

4. What the desktop app stores, and where

The desktop app keeps everything in a single SQLite database file, hub.db, in your local application-data folder (on Windows, %LOCALAPPDATA%\com.hubort.desktop). It holds your synced conversations and messages, the search index built from them, when each account last synced, and anything you create in the dashboard — collections, notes, pins, ordering and settings. If you connect Google Drive (section 5), the credentials for that live in a separate drive-config.json beside it.

If you use Related Chats, the database also holds what the app works out, on your computer, about what each conversation is about: a list of numbers per conversation, and the vocabulary it learnt them from, which is made of words from your own conversations. It is worked out from nothing but your archive, sent nowhere, and erased with hub.db. If you use Live Sync, its settings — the folder you chose and, for Notion, your integration token and your consent — live in a separate live-sync.json beside the database, and a Live Sync folder receives a Markdown copy of each conversation, inside a Hubort folder in the place you picked. Those copies are ordinary files on your computer: anything else that reads that folder, such as a note-taking app or a sync service you have set up for it, reads them too.

Beside those is hub-identity.json: a random identifier and secret, created on your computer, that let the app tell its own server apart from another Windows account's and decide which browsers and dashboard windows it answers. The database also records each browser you have paired, but only as a one-way hash of its token, never the token itself. None of this ever leaves your computer.

The database also keeps a log of what happens in Hubort, as counts and dates: that the dashboard was opened, that a ChatGPT sync started failing and with which error code, which setup steps are done, which tips you have seen. Accounts in it are numbers, like “chatgpt#1”, never their names, and it never records conversation text, titles, searches, or the names of accounts, folders or notes. It keeps 90 days, and it stays on your computer: it is what a problem report's diagnostics and the optional usage report are made from, and nothing of it leaves unless you send one of those (section 12).

These files are yours. Deleting hub.db erases the entire archive.

5. The only nine things that use the internet

Everything above is local. These nine are the complete list of ways Hubort contacts anything outside your machine, and what each one involves.

A licence bought once adds nothing to this list: the checkout happens in your browser on Paddle's page, the key arrives by email, and the app checks it on your own computer. The trial and the free version add nothing either. A subscription adds the last row, a daily check for its renewed key, and only while the key you entered is a subscription (see section 6).

6. Buying a licence

Everything above applies whether or not you ever pay for anything. This section covers the one part of Hubort that involves us at all.

Where the checkout happens. On hubort.app, in your own browser, on a page operated by Paddle.com Market Ltd, who act as the merchant of record — that is, they are the seller, they take the payment, and they handle sales tax and VAT. They receive your name, email address, country and payment details, and they process that data as their own controller. Their privacy policy is at paddle.com/legal/privacy. There is no payment field anywhere inside the Hubort app, and never will be.

What we receive and keep. When a purchase completes, Paddle tells our licence service — a small hosted endpoint that exists only to answer that message — the transaction, what was bought, and (on our asking Paddle for it) the buyer's email address. We keep the email address, a licence id, what was bought, and the dates. For a subscription, Paddle also tells the service when it renews, changes plan, or is cancelled or paused, and we keep that status beside the licence so the daily check can answer. That is the whole record, and it is kept in our licence service's own storage on Cloudflare, which hosts it. We do not receive card details, a postal address, or anything about how you use Hubort. Our lawful basis is the contract between us; we keep the purchase record for as long as tax law requires invoices to be kept, and delete anything beyond that on request (see section 8).

Renewing or upgrading. These pay for a licence you already have, so the checkout has to know which one. When you choose Renew or Upgrade to Pro in Hubort, it opens our page in your browser with your licence key after the # in the address — the part of an address a browser never sends to any server. The page hands the key to Paddle's checkout, and Paddle passes it to our licence service with the purchase, which checks it and sends the renewed or upgraded key to the address the licence belongs to. The key holds your licence id, email address and dates, all of which we already keep. The app itself still makes no network request: opening the page is your click.

How the key reaches you, and what it does. We email you a licence key, sent through Resend, an email delivery service, which receives your email address and the message in order to deliver it, and nothing else. You paste it into Hubort, which checks its signature on your own computer, against a key built into the app. For a licence bought once, the app makes no network request for licensing at any point — not when you enter a key, not when it starts, not ever. It does not phone home, count installs, or report which computer it is on, and a subscription's key does none of that either beyond its one daily check. Very little paid software can say that, and we would rather say it than have a convenient way to switch your copy off.

Subscriptions. A subscription is billed by Paddle, monthly or yearly, until you cancel it. You change or cancel it in Paddle's customer portal, which Manage subscription in Hubort opens in your browser (through hubort.app/manage); cancelling stops the next charge, and what you have paid for runs to its end. Its key renews itself: once a day the app sends the key to our licence service and takes back the renewed one, as the last row of the table in section 5 describes. When the subscription ends the check stops, and the key runs out on its own date, a few days after the last period paid for.

The free trial. Every copy of Hubort starts with 14 days of Pro, counted on your computer from the first account it syncs. Nothing is sent to anyone to start it or to end it, and no email address or card is asked for: when it ends, Hubort goes back to the free version by itself.

Refunds and support. If you write to us about a purchase, we hold that correspondence as any business does. Our refund policy and licence terms are in the Terms of Sale.

7. What never happens

• We never receive your conversations, message text, titles, search queries, notes, collections, or account labels. There is no server to receive them. A problem report carries only what you write in it and the diagnostics it shows you. The two exceptions are yours to turn on (section 5): Ask Your Archive sends a few short excerpts of matching conversations — directly from your computer, using your own API key — to the AI provider you chose, and Live Sync to Notion copies the conversations you chose into your own Notion workspace, with your own integration token. Never to us; we have nothing to do with either connection.
• Your session cookie is never read, stored, or transmitted by Hubort. Your browser attaches it to requests to the AI service exactly as it does when you browse there yourself. The one credential the extension handles is ChatGPT's short-lived access token, held in memory for one sync and sent only back to chatgpt.com, as described in section 2.
• Nothing is ever written back to your AI account. Hubort never sends, edits, renames, archives or deletes anything there. It only reads.
• There is no advertising, no analytics, no telemetry, no tracking pixel, and no fingerprinting anywhere in the extension, and nothing in the app that sends usage data unless you switch on usage reports.
• Your data is never sold, rented, shared with third parties, used to train any model, or used for any purpose other than showing it back to you in your own dashboard.
• The extension does not read pages other than the AI services it supports, does not access your browsing history, bookmarks, downloads, or passwords, and — beyond the conversation-request observation described in section 2, which only runs for a service you've switched on if you also turn on instant sync — does not observe any other network requests.
• The extension loads no remote code. Everything it runs ships inside the reviewed, published package.

8. Your control

• Stop all reading: remove the extension from that browser profile, or turn off syncing in its settings. Either takes effect immediately.
• Erase the archive: delete hub.db, or uninstall the desktop app and remove its data folder.
• Remove a single account: delete it from the dashboard, which removes that account's conversations, messages and search entries. A browser that is still syncing that account puts its conversations back on its next sync, so remove the extension from that browser profile first if you want the account gone for good.
• Disconnect Google Drive: disconnect in the app, and revoke access at myaccount.google.com. Note that revoking access also deletes the backups Google was holding for the app.
• Stop error reports: turn off Send Error Reports in the tray menu. Any reports still waiting are deleted.
• Stop usage reports: turn off Share usage reports in Settings → Privacy; nothing more is sent. Reset the install id there to cut the link between anything sent before and anything sent after.
• Have a problem report deleted: write to support@hubort.app quoting its reference, such as HB-0142, and we delete it, its screenshot and its copy on GitHub.
• Stop Ask Your Archive: choose Forget this key in Settings → Ask Your Archive. Your API key and your consent are deleted from this computer and the feature switches off; without a key it can send nothing, and it never could before you set one.
• Stop Live Sync: choose Stop and forget for the folder, or Stop and forget the token for Notion, in Settings → Data. Hubort stops updating it at once and, for Notion, deletes your token and consent from this computer. What it already wrote stays where it is — the files in your folder, the database in your Notion workspace — for you to keep or delete.
• Remove your licence key: delete it in Settings → Licence, or from the tray. Hubort goes back to the free version, nothing on your computer is deleted, and a subscription's daily check stops with it.
• Cancel a subscription: Manage subscription in Settings → Licence opens Paddle's customer portal. Cancelling stops the next charge, and the daily check stops once the subscription has ended.

Of your conversation data we hold nothing, so there is nothing for us to export or delete on your behalf, and no account for you to close. If you are in a jurisdiction with statutory data rights, this is our answer to them: we are not a controller or processor of your conversation data, because it never reaches us.

If you have bought a licence, we do hold your email address and the record of that purchase, with a subscription's status (section 6). Ask, and we will tell you exactly what that is, correct it, or delete it — with one honest exception: invoice records we are legally required to keep for a set number of years, which we keep and use for nothing else. Paddle holds its own copy of the purchase as the seller of record; their policy covers that.

9. Automated access to AI services — please read

Hubort works by reading the AI service's own web interface automatically, on a schedule, using your signed-in session. That is what allows it to keep an up-to-date searchable copy of your conversations without you exporting them by hand.

The terms of service of AI providers commonly restrict automated or scripted access to their services, and reserve the right to act against accounts that use it. Using Hubort may therefore be inconsistent with your provider's terms, and any consequence of that would apply to your account with that provider, not to your Hubort installation. We cannot indemnify you against that, and we would rather you know it before you install than after.

You can reduce automated activity by increasing the sync interval in the extension's settings, or by turning scheduled syncing off entirely and syncing only when you choose.

10. Not affiliated with any AI provider

Hubort is an independent product. It is not affiliated with, endorsed by, sponsored by, or connected to Anthropic, OpenAI, Google, xAI, or any other AI provider. All product names and trademarks belong to their respective owners and are used only to describe what Hubort is compatible with.

11. Children

Hubort is not directed at children under 13, and we do not knowingly collect information from anyone — which, as described above, includes not collecting information from adults either. Purchases are for adults: to buy a licence you must be old enough to enter a contract where you live, and the checkout is governed by Paddle's own terms as the seller.

12. Problem reports and usage reports (only when you send them)

What a problem report contains is in section 5's table, and you see all of it, as the exact text that will be sent, before it goes. Your email address is in it only if you type it, and is used to acknowledge the report and to reply to you, nothing else.

Where it goes. To our report service on Cloudflare, at hubort.app, which keeps it, and any screenshot, in its own storage there. The report, without your email address or your screenshot, is also filed as an issue in a private GitHub repository that only we can read, where reports about the same problem are grouped together; GitHub hosts it. If you gave an address, Resend delivers our acknowledgement with the report's reference, and we reply from support@hubort.app. We may use AI tools on our own computers to help read reports; no AI service is part of the report service itself.

How long. A report, its screenshot, and its copy on GitHub are deleted 12 months after it was sent, automatically. To have one deleted sooner, write to us quoting its reference, such as HB-0142. The one question asked after a week, and the one asked after an uninstall, are kept the same 12 months, with no name or address beside them.

Usage reports are stored one per install per day, under the random install id, and deleted after 12 months. Turning the switch off stops them at once; resetting the install id means nothing sent before can be connected to anything sent after. Our basis for keeping any of this is your choice to send it.

13. Changes to this policy

If we change this policy we will update the date at the top of this page. If a change ever means Hubort starts transmitting something it did not transmit before, we will say so plainly here and in the application, and where the change concerns your personal data we will ask before it takes effect rather than assume.

What changed, 24 September 2026, later the same day. This is the kind of change this section exists for. Hubort can now send us things you choose to send: problem reports, from the app or from the extension (whose report opens our page in your browser rather than sending anything itself), and the one question asked after a week; an optional daily usage report, off until you turn it on; and, after an uninstall, a page with one question. Each has its own row in section 5's table, and section 12 says where they go and how long they are kept. The app also now keeps a log of what happens in it, as counts and dates, on your computer (section 4); it leaves only inside a report you send or a usage report you switched on.

What changed, 24 September 2026. Two new Pro features, and one of them is the kind of change this section exists for. Live Sync can keep your own Notion workspace up to date with your conversations: it is off until you create an integration in Notion, give Hubort its token, and say yes to sending, and it has its own row in section 5's table. Live Sync can also keep a folder on your computer up to date with Markdown copies, which sends nothing anywhere (section 4). Related Chats works out which of your conversations are about the same thing, entirely on your computer, and sends nothing anywhere either (section 4 says what it keeps).

What changed, 23 September 2026. This is the kind of change this section exists for, in one narrow place. Hubort now sells monthly and yearly subscriptions beside the licence bought once, and a subscription's key renews itself: once a day, and only while the key you entered is a subscription's, the app sends that key, and nothing else, to our licence service for the renewed one. It is the last row of section 5's table. Until now this policy said the app makes no network request for licensing at all. That is still true of a licence bought once, of the trial and of the free version; a subscription makes its check because you chose one, and Hubort says so in its Licence settings and in the email that brings the key. The trial also became automatic: 14 days of Pro from the first account you sync, with no email asked for (section 6). (24 September 2026: the email service that delivers keys, Resend, is now named in section 6, and the contact address is support@hubort.app.)

What changed, 22 September 2026. Two things, and one of them is the kind of change this section exists for. Hubort gained Ask Your Archive, the first feature that can send anything drawn from your conversations anywhere: it is off until you set it up with an API key of your own, and then it sends your question and short excerpts to the AI provider you chose and pay — never to us. It has its own row in section 5's table, which describes exactly what goes and what is stripped out first, and section 8 says how to switch it off for good.

Hubort also gained a paid tier, so this policy gained section 6: buying a licence means Paddle receives your payment details as the seller of record, and we receive an email address and a record of the purchase. Nothing about how the application handles your conversations changed for it, and the application still makes no network request for licensing. (23 September 2026: a Personal licence can now be upgraded to Pro, and renewing or upgrading gives our checkout page your key, as section 6 describes.)

14. Contact

Questions about this policy, or about anything above: support@hubort.app.