HrokBot
Sign in

Privacy policy

Last updated:

This policy explains what personal data HrokBot collects, why we collect it, who receives it, and how you can delete it. HrokBot lets you run AI bots that have their own memory, schedule and computer. It is in private beta, and accounts are created by invitation only.

Who is responsible

The HrokBot team runs HrokBot and is responsible for your personal data ("we"). You can write to us at support@hrok.bot.

What we collect

We collect only what the service needs to work.

  • Account data: your email address, your name if you give one, and your sign-in methods. A password is stored only as a hash. Passkeys are stored as public keys. One-time sign-in codes are sent to your email address.
  • Sessions: for each device where you are signed in, we keep the IP address and the browser type until you sign out or the session expires.
  • Your content: the messages you send, your bots' instructions, memory, files and routines, and the credentials you store for them.
  • Security log: a record of security-related actions, such as sign-ins, changes to your sign-in methods and changes to approval settings. Each entry has the IP address and the browser type.
  • Server logs: our server software writes technical logs that can include IP addresses and the pages requested. They rotate by size, so old entries are overwritten.

We do not use analytics, advertising or error-reporting services, and we do not load third-party trackers. The website at hrok.bot does not record visits.

Why we use it, and on what basis

We use your data to run your account and your bots, to keep the service secure, to prevent abuse and to answer your questions. We do not sell personal data, and we do not use your content to train AI models.

Where the GDPR applies, our legal bases are performing the contract with you (running the service), our legitimate interest in security and in preventing abuse, and your consent for sending your content to a model provider. You give that consent in the app and can withdraw it at any time.

Who receives your data

We share data only in these cases.

  • Model providers. You connect a provider and your own key in Settings. When a bot writes a reply, it sends the provider you chose the part of your conversation, memory and tool results that it needs. The provider's own terms and privacy policy apply, and we do not choose a provider for you. If you connect a voice provider, voice data goes to it in the same way.
  • Email delivery. We send sign-in codes and notices through Resend. Resend receives your email address and the content of the message.
  • Websites and services your bots use. Each bot's computer runs on our server, so websites see our server's address and not yours. Anything a bot types or sends on a website or in a connected account goes to that site or service and follows its rules.
  • Hosting. HrokBot runs on a rented server in Germany.
  • Authorities, when the law requires it.

Where your data is stored and how it is protected

Your data is stored on our server in Germany. Messages, memory, files and credentials are encrypted in storage. The key is kept on the same server, so this is not end-to-end encryption. It protects the stored data if a copy leaks. Someone with access to the server can still read it.

Each bot's computer is a separate container. Network rules keep it away from our internal services and from other bots' computers. Access to the server is limited to people we authorize.

How long we keep it

  • Account and content: until you delete them or delete your account.
  • Sessions: until you sign out or they expire.
  • Security log: 90 days.

We do not keep separate backups of your data at the moment.

Deleting your data and your rights

You can delete your account yourself in your account settings ("Delete account"). That deletes your bots together with their memory, files, routines and computers, your sessions and notification tokens, and your account record.

Some things remain after deletion. Security log entries stay until their 90 days end. We cannot take back data that model providers, the email provider or websites already received. Ask them directly to delete it.

You can export a bot from its panel. The export contains the bot's profile, memory, routines and workspace files. It does not contain chat history or the values of stored credentials.

Under the GDPR and similar laws you have the right to access your data, correct it, delete it, restrict or object to its use, receive it in a portable form, and withdraw consent. To use these rights, write to support@hrok.bot. We answer within one month. You can also complain to the data protection authority in your country.

Cookies and local storage

HrokBot sets one session cookie that keeps you signed in. It does not set advertising or analytics cookies.

Your browser also stores preferences on your device, such as language, theme, draft messages and interface settings. The website at hrok.bot stores only your language and theme choice. This information does not leave your device.

Children

HrokBot is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has an account, write to us and we will delete it.

Changes to this policy

When we change this policy, we update the date at the top. For significant changes we also tell account holders by email.

Languages

This policy is available in English, Ukrainian and Spanish. If the versions differ, the English version applies.