HIVEBack to Hive →

Privacy policy

How Hive handles your data

Hive is a private messenger. We do not sell data, show no ads, use no trackers and do not train AI models with your content ourselves. We earn money with plans and credits, not with your data. This page explains what Hive processes, why, with whom and for how long.

1. Controller

Typhora Group LLC
Limited Liability Company (LLC), incorporated in Wyoming, USA
33 N Gould St, Sheridan, WY 82801, USA
with its place of management and establishment in Germany at Barbarossaplatz 2, 50674 Cologne, Germany
Email: hey@typhora.group

You can reach us at this address for all questions about data protection. We have not appointed a data protection officer.

2. Where your data is stored

Hive runs on Cloudflare, Inc. (USA). The database (Cloudflare D1) and the file storage (Cloudflare R2) are located in data centres in Western Europe. This is a location setting at Cloudflare, not a legal commitment to the EU. Individual requests to Hive are handled by the Cloudflare data centre closest to you, which may be outside the EU, for example when you travel.

Typhora Group LLC is a company organised under the laws of Wyoming (USA) and is managed from its establishment in Cologne. We process your data in the context of the activities of this establishment, so the GDPR applies to us directly (Art. 3(1) GDPR). Transfers to service providers in the USA and other third countries, with their legal basis, are listed in section 13.

As the provider of a messenger, we observe the secrecy of telecommunications (Section 3 TDDDG). We only process the content and circumstances of your communication to the extent necessary for the service or permitted by law.

3. Account and sign-in

All you need for an account is an email address. We store it together with your account number, language, plan and the times the account was created and last signed in. When you sign in, you confirm that you are at least 16. In the apps with the store country USA, you confirm that you are at least 18. We store this confirmation with the time as well, and likewise when you confirm that you are at least 18 before using a Google model for the first time and when you agree to content being passed to AI providers (section 8) or to a new version of the terms. Optionally, you add a display name, a username and a profile picture. Other members can see these three items, but they only find you through the people search if you leave discoverability switched on. We do not show your full email address to others. If you have set neither a display name nor a username, Hive shows others the placeholder “Member” instead of a name.

Bio and links: Optionally, under “Me”, “Account and profile”, you add a short bio and up to eight links. Your connections can see them. If you switch on “Public profile”, your picture, name, username, bio and links can also be seen by members who find you through search and by anyone who opens your profile link (hive.henny.info/u/your-username), even without a Hive account. We ask search engines not to index the page. Switching it off takes effect immediately. We store this information until you change it or delete your account. Legal basis: Art. 6(1)(b) GDPR.

To sign in, we send you a six-digit code by email. For this we store your email address, language, the code only as a hash, the IP address of the request and the number of attempts. The code is valid for 15 minutes; we delete the record one day after it expires. When a code is redeemed, we log the IP address, browser identifier (user agent) and referring page without any link to your account and delete this log after 30 days. After that, a cookie keeps you signed in in the browser (section 12), and in the iPhone and Android apps a sign-in key in the app’s storage. For each session we store the identifier of the device (browser identifier). A session in the browser is valid for 30 days; in the apps it is valid for 90 days from the last use and at most one year from signing in. We delete it once it has expired, when you sign out on that device, when you choose “Sign out on all other devices” under “Me” or when you delete your account.

Sign-in with username, backup email, two-factor: Instead of your email address you can also enter your username when signing in; we then send the code to your account's email address without showing it. Optionally, under “Me”, “Account and profile”, you add a backup email; we confirm it with a code sent to that address, notify your email address, and store it until you remove it or delete your account. You can sign in with it as well; others can't see it. If you switch on two-factor sign-in under “Privacy and security”, we store the secret for your authenticator app (encrypted once the key for it is set), the last time step used and ten backup codes only as a check value (hash); during sign-in we keep the intermediate step for at most ten minutes. Switching it off deletes the secret and the backup codes. Legal basis: Art. 6(1)(b) GDPR.

Changing your email address: In your profile you can change the email address of your account; your account, username and chats stay. For this, we send a six-digit code to the new address and one to your current address, and you enter both. For each request, we store the current and the new address, language, both codes only as a hash, the number of attempts, the IP address of the request (for IPv6 only the network range) and the times. The codes are valid for 15 minutes; we delete a request that is not confirmed one day after it expires. After the change, we send a message to your previous address in which the new one is only partly shown. Of a completed change, we keep the previous and the new address with the time for as long as your account exists, without the codes and, from one day after the codes expire, without the IP address. This lets us help you if someone else changed the address, and match cancellations and withdrawals that you declare with the previous address to your account. We do not change the address at Stripe: receipts and purchase confirmations for purchases on the web still go to the address Stripe knows. If you delete your account, we delete these details immediately. Only requests from the last 24 hours remain, with the new address and the IP address of the request but without any link to your account and without the previous address, until one day after their codes expire, so that the limits against abuse (requests per network and per new address) cannot be bypassed by deleting the account.

Age check in the apps: Where a law requires it, the app asks Apple (App Store, Declared Age Range) or Google (Google Play, Age Signals) for your age range. The result stays on your device and is not sent to Hive. On the device, the app stores a status (for example “old enough” or “too young”) with a date and whether your store country is the USA, plus short check values (hashes) of the email addresses you have signed in with on this device, so that it does not ask again each time you sign in again. These check values do not leave the device.

The administrator account can also sign in with a password; we store failed attempts together with the email address entered for one day to slow down password guessing.

Legal basis: Art. 6(1)(b) GDPR (contract) for account, profile, sign-in and changing your email address; Art. 6(1)(f) GDPR for logs, limits against abuse and the history of previous addresses, because we have a legitimate interest in a secure service and in matching declarations to the right account.

4. Chats, media and location

Hive stores your chats, meaning one-to-one chats, frequencies (several separate chats with the same person), groups and your empty chats and AI chats, which only you can see: messages, replies, reactions, images, videos, voice messages and files including the original file name and caption, plus delivery and read status. You share read receipts by default; you can switch them off in general or per chat. Our server can read messages outside Secret Chats so that it can deliver them and offer features such as translation. In transit they are encrypted with TLS. Media can only be retrieved by the members of the respective chat.

Metadata in photos, videos and files: Before a photo you send to a chat is uploaded, the app shrinks it on your device and saves it again as a JPEG; embedded details such as the place where it was taken are not carried over. The app uploads videos, GIFs and files unchanged. They can contain metadata such as the place where they were recorded, and the other members of the chat can retrieve this information along with the file. Hive does not remove it.

If you add someone by email address, username or profile key, we only use what you enter to look the person up; what we store is the contact connection. The person receives a request they can accept or decline. Under Privacy you decide whether and how others can find you: by your username, your exact email address or your name. For your QR code we store a random profile key with your account. Anyone who has it can send you a request, even if you can't be found otherwise; you can create a new one at any time, and the old one then stops working. When you scan a QR code, the app only analyses the camera image on your device; it is neither stored nor uploaded.

Inviting friends: For the link you share to bring friends to Hive we store a random code with your account. Anyone who opens the link sees your name on our page for it or, without a name, your username. If someone signs up through your link, the app sends you a contact request, and we store who brought whom so the app can show you the number, until one of the two accounts is deleted. If someone gets the Android app from Google Play through such a link, the app reads Google Play's install referrer once on first start to recognise the invitation; it learns nothing else from it.

PIN lock: The PIN you use to lock the app or single chats only stays on your device as a check value; we never receive it. If you turn on Face ID, Touch ID or your fingerprint for it in the apps, your device's operating system checks your face or finger; the app only learns whether the check succeeded, and we receive nothing about it. For a locked chat we only store that it is locked for you, so that notifications from it arrive without name or content.

With the location feature, Hive only transmits a location if you explicitly share it: once, as a single point accurate to about one metre, without live tracking and never in Secret Chats. If you open the point in Google Maps, Apple Maps or OpenStreetMap, that map service receives the coordinates.

Deleting: You can delete your own messages for everyone; we delete the related media along with them. Disappearing messages (30 days at most) and the self-destruct of a one-to-one chat delete messages and media at the set time. “Delete chat for me” only hides the history for you; it remains stored for the other members. We store deletion requests to the other person together with their outcome.

Legal basis: Art. 6(1)(b) GDPR. Retention: until the message is deleted or expires, otherwise until you delete your account with “Delete everything” (section 15).

5. Secret Chats (end-to-end encryption)

You can turn a one-to-one chat into a Secret Chat if both sides have a key. In the apps, Hive creates it by itself on first launch, in the browser the first time you switch it on. Messages are then encrypted and decrypted on your devices; our server only stores ciphertext and cannot read it. This applies only to Secret Chats and only to one-to-one chats. Texts are encrypted and, since 29 October 2026, so are images, videos, voice messages and files: your device encrypts each file with its own key before uploading it, and this key, together with the file name, file type, dimensions, duration and caption, is part of the encrypted message. Our server only stores the encrypted bytes. Locations and AI features are blocked in Secret Chats. What remains unencrypted and visible to us are the circumstances: who sends a message of what length in which chat and when, for files the size of the encrypted file, which message it replies to and who has read it. Reactions (emojis) and call entries are not end-to-end encrypted either.

Your private key is stored only in the storage of your browser or the app. We store your public key so that others can write to you in encrypted form. If you wish, we store a key backup that is encrypted with your recovery code or passphrase; we cannot decrypt it. You can also connect another device by QR code: your device then sends the private key in encrypted form to the new device, using a key that only the two devices know. For this we store the encrypted key and two single-use keys only until the new device collects it, for ten minutes at most. The browser identifier of the new device and the country of its connection, which we show you before you confirm, are kept for one hour to limit repeated attempts. Without a backup and without your device, nobody, including us, can recover Secret Chat messages.

6. Calls, recordings and podcasts

Voice and video calls between two people run via WebRTC. Sound and picture travel encrypted between the devices; we do not hear or see them and do not store them unless you agree on a recording (see below). To set up the connection, your devices exchange their network addresses via our server, including their public and local IP addresses. The other person on the call receives these addresses on every call, even if the call then runs through a relay. The app uses Cloudflare (Cloudflare Realtime STUN and TURN) to discover addresses and as a relay; the relay sees your IP address and only forwards encrypted packets.

Group calls do not run directly between the devices but via Cloudflare Realtime SFU, a relay service from Cloudflare: every device sends sound and picture encrypted to Cloudflare, where they are decrypted and forwarded encrypted to the other participants. Group calls are therefore not end-to-end encrypted. Cloudflare does not store sound or picture, and we do not hear or see them. Cloudflare sees the IP addresses of all participants; the other participants do not see your IP address. During the call we process who is in the call (name and profile picture), whether microphone and camera are on, who is speaking (your device detects this from the volume and only reports “speaking”, no sound) and which cameras you are viewing. If you treat everyone, everyone in the call sees your name with it; only you see your limit. So that nobody stays in a call after signing out or being removed from the group, the call checks every minute whether your sign-in and your membership still exist. The chat shows an entry when the call starts (“Group call started”) and one after the call with duration, number of people and who treated everyone, if anyone. If anyone paid with credits in the call, we also store for billing: who started the call, start and end, how many people took part, an estimate of the data traffic, for each paying person the amount charged and the share for others, and your consent before any costs arise with time and price or limit (section 9). For free calls we delete this information when the call ends; only the chat entries remain.

In the chat we store an entry about the call (answered or missed, duration, with or without video). So that we can fix connection problems, the app sends a technical report for every call between two people: browser identifier, type of connection (direct or via relay, without IP addresses), connection states, duration, amounts of data, audio and video quality and error messages. We delete these reports after 14 days.

So that a call between two people rings only once on each of your devices and the notification turns into “Missed call” if nobody answers, we briefly store for each such call who is calling whom in which chat, whether with video, how the call ends (answered, declined or missed) and to how many devices we sent a notification. We also use this to limit notifications if the same person calls you very often within a short time; the call then only rings in open windows and apps. We also note which of your sign-ins (that is, which device) started or answered the call, so that another of your devices cannot end the conversation. We delete this information after one day, and immediately together with your account.

Recordings and podcasts only happen if the caller chooses this when calling; the person being called sees it while the phone is still ringing. Each device only records its own microphone and, for video, its own camera, and uploads the recording as a message to your chat; section 4 applies there. If you merge a podcast on our server, a container at Cloudflare renders the recordings into one video; we cannot determine where this container runs. Its working files are deleted after the job, at the latest when the container shuts down after a few minutes without a job. The finished video is posted as a message in the chat. If you merge the podcast in your browser instead, the result stays on your device.

Legal basis: Art. 6(1)(b) GDPR; for the technical reports Art. 6(1)(f) GDPR (our legitimate interest in working calls); for the records of consent in group calls Art. 6(1)(f) GDPR (proof in case of queries and disputes).

7. Push notifications

In the browser (web push): If you switch on notifications, we store your browser’s push subscription (the address at the push service and the related keys), at most ten per account. For new messages and calls we send an encrypted notification with the sender’s name and a short note such as “sent you a message” or, depending on your setting, the beginning of the message (see below). For a group call, it contains the title of the group and the name of the person calling. It is delivered via the push service of your browser vendor, for example Google, Apple or Mozilla. The service cannot read the notification, but it sees when something is sent to which device. We delete the subscription when you switch off notifications, sign out, choose “Sign out on all other devices” under “Me” (this deletes all push subscriptions and device tokens of your account), the push service declares it invalid or you delete your account.

In the apps (iPhone and Android): If you switch on notifications in the app, we store one device token per device: on the iPhone from Apple (Apple Push Notification service, APNs), on Android from Google (Firebase Cloud Messaging, FCM). Together with the browser subscriptions, this is at most ten per account. For new messages and calls we send Apple or Google a notification with the sender’s name and a short note such as “sent you a message”, “is calling you”, “Missed call” or “is starting a group call”, plus the internal number of the chat so that tapping the notification opens the right chat. For a group call, it contains the title of the group and the name of the person calling. In Hive under “Me” > “Notifications and ringtone” > “Preview in notifications” you choose what notifications about new messages show: name and message (default), name only, or just “New message”. With “Name and message”, the notification contains the beginning of the message (at most 140 characters) or the type of attachment, such as “Photo”, and in groups also the title of the group. Notifications from secret chats never contain the text. This applies to notifications in the browser and in the apps; in the apps, the message text also passes through Apple or Google. This information passes through Apple or Google and is not end-to-end encrypted there; both also see when something is sent to which device. We delete the device token when you switch off notifications in the app, sign out on the device, choose “Sign out on all other devices” under “Me” (this deletes all push subscriptions and device tokens of your account, including browser subscriptions; this device registers itself again afterwards if notifications are switched on here), delete your account, or Apple or Google report the token as invalid.

Legal basis: Art. 6(1)(b) GDPR.

8. AI features

AI features only run when you trigger them, and only after you have agreed once to content being passed to the providers listed below. You can withdraw this consent at any time under “Me”, “AI features”; Hive will then ask again before the next AI feature. We then send the content required for this to the respective provider and receive the result. All requests pass through a Cloudflare node that is normally located in Western Europe; the providers therefore do not see your IP address. Content from Secret Chats and the coordinates of shared locations are never sent to AI providers. Members of a chat can also apply AI features to other members’ messages in that chat, for example to translate or summarise them or to turn a voice message into text.

We store generated images and videos, except the AI profile picture, with their description, model and format in your gallery until you delete them there or delete your account. If you send them to a chat, section 4 applies there. Your browser remembers your latest descriptions and models. For every request we record the feature, model and usage (section 9).

The providers process the data on our behalf and keep it for a period under their own terms, for example to detect abuse; according to their own statements this is usually up to 30 days for Anthropic and up to 30 days for images at OpenAI. For fal: for images, including the AI profile picture made from your photo, fal does not store the request and response and deletes generated and uploaded files after one day. For videos, including transforming and extending, fal deletes the generated and uploaded files after 7 days; under its standard rules, fal may keep the request and response for up to 30 days there. Until they are deleted, the files are stored at fal under addresses that are hard to guess but publicly accessible. Some of the makers behind fal are based in China (ByteDance, Alibaba, Kuaishou).

Legal basis: Art. 6(1)(b) GDPR, because you trigger the feature. Where names and messages of other chat members are processed, Art. 6(1)(f) GDPR: you and we have a legitimate interest in the feature you trigger in a shared chat working.

9. Plans, credits and payment

For your credits we store the balance (monthly credits and bought credits), a transaction log (charges, credits returned after failures, purchases, refunds and chargebacks of packs, the monthly top-up and upgrades to a higher plan, each with feature and time) and, for every AI request, the feature, model and usage. For group calls with more than four cameras, the billing per call and the records of your consent are added (section 6); we keep both for three years, even if you delete your account. We use this to charge credits, return them after failures and manage our costs.

Purchases on the web: You buy plans and credit packs in the web app through the Stripe checkout. The sale is handled by Sold through Link, LLC (“Link”), a Stripe company, for us but in its own name and under its own responsibility as so-called merchant of record: Link collects the payment, remits the tax, sends receipts and invoices and handles questions about payment, subscriptions and refunds. You enter your payment details (such as card number or bank details), your name and your billing address only at the checkout with Stripe or Link. We never see your full card number or your Link login details. Our Stripe account does, however, store for each purchase your name, email address, billing address and country, your tax number if you provide one, the payment method and, for cards, card brand, last four digits and expiry date; we only use them for refunds, queries and proof. Stripe and Link are responsible for the payment processing itself, independently of us; their privacy policy applies: https://link.com/privacy.

We send Stripe your email address, your Hive account number and what you are buying. From Stripe we receive a customer number, the subscription ID, plan, billing period, status and any pending cancellation, the payment ID and notifications about refunds and chargebacks.

After every purchase on the web we send you an email with the terms, the withdrawal notice and the model withdrawal form; we record that it has been sent together with your email address. If you cancel or withdraw via our pages that work without signing in (Terms, sections 7 and 8), we store the details you enter there (email address, name, contract and, for a cancellation, its type, requested date and reason, or, for a withdrawal, whether it concerns a subscription or a credit pack), the language, your account number if the address belongs or used to belong to an account, the time of receipt, what happened automatically as a result, and your IP address to curb abuse. The confirmation of receipt goes to you by email, with a copy to us. If we match the declaration to your account through a previous address (section 3), the confirmation with all details also goes to the current address of your account, and only the confirmation of receipt goes to the address entered. We keep these records and the records of purchase confirmations for three years, even if you delete your account.

Purchases in the apps: In the apps, you buy plans and credit packs not through Stripe but through Apple In-App Purchase (StoreKit) on the iPhone and Google Play Billing on Android. Apple or Google handle the payment as independent controllers; their privacy policies apply: https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy. We do not see payment details such as card number, name or billing address. From the store we receive only the details of the purchase: from Apple the transaction signed by Apple, from Google a purchase token that we look up at Google. It contains, among other things, the product, period, transaction ID or purchase token and the environment (production or test); the status of the subscription (for example renewed, cancelled or refunded) is added later. So that we can match a purchase to your Hive account, every purchase carries a random account identifier (at Apple the appAccountToken, at Google the obfuscatedAccountId). It is not derived from your account number or email address. Of this, we store only what we need for crediting and matching: the purchases with plan, period and status on your account. We also record which account a transaction ID or purchase token belongs to. On the iPhone, the app also reports at startup, once per account and device, the identifier of your app with your Apple account (AppTransaction), even if you have not bought anything. We verify Apple’s signature and record which account this identifier belongs to, so that notifications from Apple that carry only this identifier are matched to the right account. We delete this record as soon as you delete your account. From Apple’s notifications about a purchase (App Store Server Notifications) we keep an extract for 180 days: the type of notification, the environment, the identifiers of the purchase, the time and a note on how we processed it. From Google we keep only the ID of the notification, for 30 days, to recognise duplicates. Both periods keep running even if you delete your account. To Apple and Google we send only IDs of purchases and queries about their status, never your email address or your name.

Legal basis: Art. 6(1)(b) GDPR; for cost control, for keeping proof of purchases (towards tax authorities and in disputes), for the records of cancellations, withdrawals and purchase confirmations, for the details from Apple’s and Google’s notifications and for the identifier that remains without any link to you after “Delete everything”, Art. 6(1)(f) GDPR (purchases and notifications are to be matched to the right account and never to a new one, and duplicate notifications are to be noticed). Retention: three years for the records, 180 days for the details from Apple’s notifications and 30 days for Google’s, otherwise until you delete your account with “Delete everything”. With “Delete only my account”, this data remains attached to your account number without your email address for as long as we need it for refunds, chargebacks and proof. With “Delete everything”, we delete it, except for the records, the details from the notifications (they expire after their period) and the identifier of a store purchase, which remains for one more year without any link to your account (sections 14 and 15); Stripe and Link keep their records under their own obligations (section 15).

10. Reporting, blocking and security

If you block someone, we store this until you lift the block. If you report a person, a message, a group or an AI result, we store who reports, whom or what the report concerns (account, chat, message, file), the category, your description and the IP address of the report. So that the report can still be reviewed if the content is later deleted, we secure the reported message text, the group name, the description (prompt) of the AI image or the text of the reported AI result (such as a summary or translation, which may reproduce what others said). We cannot read the content of Secret Chats; there you only include the text if you tick the box for it. Reports are sent by email to our inbox (via Resend, section 13; if there are unusually many form reports, only as a summary), and a person reviews each one. If you report without an account via the report form on our help page, we store your description, where the content is located, your statement that the information is accurate to the best of your knowledge, your name if you provide it, and your email address for the confirmation of receipt (at most three per address and day), follow-up questions and our decision if you provide it, and the network of your IP address (for IPv6 shortened to the first 64 bits) to limit mass reports. The person reported does not learn who reported them. We delete reports after one year. If you delete your account, your own reports remain as proof without any link to you and without the IP address, and reports about you remain until their year has passed.

Suspensions: If we suspend an account, we store the time and the reason, end all sessions and send the person concerned the reason by email. The person who reported also receives our decision by email. The suspension remains stored until we lift it or the account is deleted.

Your feedback: If you send us a message via “Send feedback”, we store it with your account number, the type (bug, idea, praise, other) and technical details (app version, language, browser identifier, screen size, plan) and send it by email to our inbox so that we can read it and reply to you. No chat content is included. We delete it after one year or together with your account. The legal basis is Art. 6(1)(f) GDPR (improving Hive and replying to you).

Contact form: If you write to us via the form on the website, we store your email address, your name (if you give it), the topic, your message, the language and the section of the page, and send everything by email to our inbox so that we can reply to you. We keep your IP address for one day only, to curb abuse. We delete the message after one year; write to us if you want it gone sooner. The legal basis is Art. 6(1)(b) GDPR where it concerns a contract or a request about one, otherwise Art. 6(1)(f) GDPR (replying to you).

To prevent abuse, we limit how often sign-in codes can be requested, people looked up, chats created and reports sent. For this we count these actions per account or IP address; we delete the counters for lookups after 24 hours. We check uploaded files by their content to determine the file type; the app only displays images, PDF, audio and video directly, everything else only as a download. We automatically check display names, usernames, group and chat names and descriptions for AI images and videos against a list of prohibited terms. We do not scan messages or files automatically.

Technical error logs at Cloudflare may contain identifiers such as your account number and are kept for 7 days at most. Our database can be rolled back for up to 30 days to recover from errors (Cloudflare D1 Time Travel); deleted data may therefore remain in this history for up to 30 days.

If content indicates a criminal offence that threatens the life or safety of people, we inform the competent authorities (Art. 18 DSA). We only provide information to authorities where a law obliges us to do so.

Legal basis: Art. 6(1)(f) GDPR (a secure service free of abuse); Art. 6(1)(c) GDPR where the Digital Services Act or another law obliges us.

11. Our newsletter

If you sign up for our newsletter, we store your email address, language, source, time and IP address of the sign-up as proof and send you a confirmation email via Resend. You are only subscribed once you click the link in it (double opt-in); if you do not confirm, we send you nothing further and delete the sign-up after 30 days. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the unsubscribe link in every email or by writing to us. After you unsubscribe, we keep the address marked as “unsubscribed” for three years so that we send you nothing more and can prove your earlier consent (Art. 6(1)(f) GDPR).

12. Cookies and browser storage

All of this is technically necessary for Hive to work the way you use and set it up (Section 25(2) no. 2 TDDDG); no consent is required for it. There are no advertising or analytics cookies. The data in browser storage stays on your device until you delete it in your browser; signing out does not delete it. One exception is the device token for push in the apps: the app removes it when you sign out. On devices that are not yours, you should delete it after use. When you buy something, the Stripe checkout opens; Stripe’s cookies and rules apply there.

Website visitor statistics: For the pages of hive.henny.info (home pages, help, legal texts; not for the app) we count visits only as daily totals: which page, its language, the country (Cloudflare derives it from the IP address; we do not store the address itself), the address of the page you came from without its path (such as instagram.com), the name of a campaign from the link (utm_source) and whether it was a phone, tablet or computer. Once the page has loaded, it reports this once with its path only; if you tap a button such as “Google Play”, it reports only that button's name. We also count per day how many sign-in codes were requested and how many accounts were created. We store neither IP addresses nor browser identifiers, set no cookie and read nothing from your browser; individual visits or people cannot be recognised this way. The legal basis is Art. 6(1)(f) GDPR (understanding how people find Hive). We keep the daily totals for 800 days.

13. Recipients and transfers to third countries

We only pass on data where this is necessary for the feature in question. The following service providers process it on our behalf (Art. 28 GDPR):

The following receive data not on our behalf but under their own responsibility:

You can get a copy of the standard contractual clauses by writing to hey@typhora.group. You can find certifications under the Data Privacy Framework at https://www.dataprivacyframework.gov/list.

14. Retention at a glance

15. Deleting your account

You delete your account yourself in the app (under “Me”, “Delete account”), which takes effect immediately, or by email to hey@typhora.group. If you delete in the app, we first end running subscriptions automatically: we end a subscription through Stripe immediately, without refunding the remaining period. We cancel a monthly subscription through Google Play with Google for good, likewise without a refund. It runs on at Google until the end of the paid time and then no longer renews; you cannot restore it in the Play Store. We cannot end a subscription through Apple: it does not end when your account is deleted, and you cancel it yourself with Apple (in the app under “Manage subscription” or in the subscription settings of your Apple account), otherwise Apple keeps charging. The app then tells you which subscription is still running at Apple. Yearly passes never renew. If ending a subscription at Stripe or Google fails, the account remains and the app shows an error. If you ask us by email to delete your account, we end the subscriptions by hand before deleting. We delete the random identifier by which purchases in the apps are matched to your account with “Delete only my account” and with “Delete everything”. Your monthly credits expire. Unused bought credits that you bought on the web are refunded on request (Terms, section 5). Ideally, write to us before you delete: after “Delete everything” we no longer have any data with which we can match your credits to you. For subscriptions and credits from the apps, the refund rules of Apple or Google apply; please contact the respective store. We delete sessions, sign-in codes, push subscriptions and device tokens, contacts, your profile picture, your feedback, your AI gallery with all images and videos and the history of your previous email addresses (section 3).

In both cases, records of cancellations, withdrawals and purchase confirmations as well as the billing of paid group calls with the consents for it are kept for three years (section 9). The stored details from Apple’s and Google’s notifications expire by themselves after 180 and 30 days respectively, even if you delete your account earlier (section 9). What remains outside Hive: Stripe and Link keep their purchase data under their own rules and obligations; you can request deletion there from Link. Apple and Google keep their data on purchases in the apps under their own rules and obligations; you can request deletion there from Apple or Google. The providers in sections 8 and 13 delete according to their own time limits. Deleted data remains in the database recovery history for up to 30 days. If you later sign in with the same email address, a new, empty account is created.

16. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). To exercise these rights, write to hey@typhora.group. You change your display name, username, language, discoverability and profile picture yourself in the app; we change your email address on request. With “Export chat” you download up to 50,000 messages of a chat that you can still see in the app as a text file, the newest ones for longer chats (without images, videos and files); we send you a complete copy of your data on request.

Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

17. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW, the data protection authority of North Rhine-Westphalia), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany: https://www.ldi.nrw.de. Where we process data for telecommunications in Hive, that is for messages and calls, the Federal Commissioner for Data Protection and Freedom of Information (BfDI) is responsible (Section 29 TDDDG): https://www.bfdi.bund.de.

You can, however, also contact any other supervisory authority, in particular in the EU or European Economic Area country where you live or work or where the alleged infringement took place.

18. Obligation to provide data, no automated decisions

We cannot create an account without an email address; all other information is voluntary. For purchases, Stripe and Link (on the web) or Apple and Google (in the apps) need your payment details. Automated decisions within the meaning of Art. 22 GDPR, including profiling, do not take place. Technical limits, for example on sign-in attempts, are not such decisions.

19. Changes

If Hive changes, we update this privacy policy. We inform you about material changes in the app or by email.

Last updated: 8 November 2026.

Legal noticePrivacyTermsCancel contracts hereWithdraw from a contract← Back to Hive