Privacy Policy
This policy explains which personal data Hobfolk handles, for what purpose, with whom it is shared, how long it is kept and how you exercise your rights, under Brazil's General Data Protection Law (Law No. 13,709/2018, "LGPD"). It applies to the website (hobfolk.dev), the account area (app.hobfolk.dev), access from anywhere (remote.hobfolk.dev) and the app when connected to your account.
1. Who handles your data
- Contact about your data: the Hobfolk team, at contato@hobfolk.dev.
2. What stays on your computer
Hobfolk runs on your computer. Your projects, code, files, requests to the agents, conversations and the task board stay on your machine and with the AI providers you chose (such as Anthropic, OpenAI or Google), under their policies. We do not receive that content.
The exception is access from anywhere: when you use it, the screens and commands pass through our server in transit, encrypted, and are not stored.
3. The data we handle
| Data | When | What for |
|---|---|---|
| Name and e-mail | At sign-up | Identify the account, sign in and talk to you |
| Password | At sign-up | Sign in. We keep only a cryptographic digest (argon2id), never the password |
| Second factor and recovery codes | If you turn on two-step verification | Protect the account. The secret is encrypted; the codes, only as a digest |
| Sessions: IP address, browser and dates | On each access | Keep you signed in, show your sessions and detect misuse |
| Connected computers: name, system, Hobfolk version, IP address and last contact | When you connect the app | Check the license, list and disconnect computers |
| Plan, subscription, amounts, dates and the customer identifiers at the payment processor | When you subscribe | Charge, unlock the plan and meet tax obligations. Card details stay only with the processor |
| Security log: account actions, IP address and date | On sign-ins, password failures, password changes and administrative actions | Security, fraud prevention and the retention required by the Brazilian Internet Civil Framework (Marco Civil da Internet) |
| Days on which the account was used | When you use the account | Aggregate metrics of the service |
| E-mails we send | Confirmations, password resets and billing notices | Prove delivery and solve delivery problems |
| Acceptances of these documents: version, date and IP address | At sign-up and when a new version asks for acceptance | Prove the acceptance |
We do not use advertising cookies or third-party analytics tools, and we do not sell personal data.
4. Legal bases
- Performance of the contract (Art. 7, V): account, subscription, app and access from anywhere.
- Compliance with a legal obligation (Art. 7, II): tax records and keeping access logs for 6 months (Marco Civil da Internet, Art. 15).
- Legitimate interest (Art. 7, IX): account security, fraud prevention and aggregate metrics, always to the minimum necessary.
- Regular exercise of rights (Art. 7, VI): defense in proceedings and proof of acceptances and payments.
5. Cookies and browser storage
We use only what is strictly necessary:
__Host-hobfolk-session: keeps you signed in to the account area (app.hobfolk.dev);__Host-hobfolk-relay: keeps you signed in to access from anywhere (remote.hobfolk.dev).
They are secure session cookies, which only work over HTTPS and only on the address that created them. The website (hobfolk.dev) stores in your browser only the language you chose. Since all of this is necessary for the service, we do not ask for consent for these items.
6. Who we share with
Only with those who help us provide the service, to the extent necessary, and under contract:
- Hosting: Hostinger, where the server and the database are;
- Payments: Stripe, which handles payment data as an independent controller, under its own policies;
- E-mail: Hostinger, which delivers the account's messages;
- Authorities: when the law or a court order requires it.
Some of these providers may handle data outside Brazil. In those cases, the transfer follows Article 33 of the LGPD, with contractual guarantees of equivalent protection.
7. How long we keep it
| Data | Period |
|---|---|
| Account (name, e-mail, password, second factor) | While the account exists. When you delete it, this data is erased immediately and the account is anonymized |
| Ended or expired sessions | Up to 30 days |
| Credentials of disconnected computers | Up to 90 days |
| Security log (includes IP address) | 400 days |
| E-mails sent | 90 days |
| Notices from the payment processors | 90 days |
| Payments | 5 years (tax law), no longer linked to you once the account is deleted |
| Database backups | 14 days, replaced daily |
| Acceptances of these documents | As long as needed to prove the acceptance, without contact details once the account is deleted |
8. Your rights
You may ask, at any time (Art. 18 of the LGPD): confirmation that we handle your data, access, correction, anonymization, blocking or erasure of unnecessary data, portability, information about who we share it with and review of automated decisions. You may also object to processing based on legitimate interest.
- In the account area you correct your name, end sessions, disconnect computers and delete the account.
- For anything else, write to contato@hobfolk.dev. We answer within 15 days and may ask you to confirm your identity.
- You may also complain to the Brazilian National Data Protection Authority (ANPD).
9. Security
We protect the data with encryption in transit (HTTPS), argon2id passwords, two-step verification, secure cookies, limits on repeated attempts, audit logs and restricted access to administration. No system is infallible: if there is a security incident that may bring relevant risk or harm, we will notify you and the ANPD, as required by Article 48 of the LGPD.
10. Children and adolescents
Hobfolk is not intended for people under 18, and we do not knowingly handle data of children and adolescents.
11. Changes to this policy
Each version stays published with its date and history at hobfolk.dev/privacidade. Relevant changes are announced in advance and, when necessary, we ask for your new acceptance in the account area.