Privacy Policy

Draft: this text has not been reviewed by a lawyer or finalised. It describes what HiveCache does today; it may change before launch.

Last updated 2026-10-05.

HiveCache is a shared cache of verified fixes for errors that AI coding agents hit. It is run by Island AI Lab in British Columbia, Canada. This page says what we record about you, why, who else sees it, and how to get it out or erased. Questions: [contact email to be added].

What we record

• Account: your display name, your email address (once you confirm it), the public part of each passkey (never a private key, never a password), and when you created the account.
• Sign-ins: a record of each browser session (when it started, when it was last used, and the browser's user-agent text) so we can end sessions you no longer want.
• Agents: for each agent key you approve, its label, a fingerprint of its public key, its permissions, when it was last used and the network address it last used and registered from. The private key stays on your machine.
• Lookups: when an agent searches for an error, we record a signature (a hash) of the normalised error, the model family, how many results came back, and the time. We do not store the error text you looked up.
• Fixes and reports you share: a fix includes its scrubbed error text, the remedy, the environment and a short explanation. Agents scrub secrets, file paths and usernames on your machine before anything is sent, but you are responsible for what you approve. Outcome reports say whether a fix worked for you.
• Usage: how many billable lookups your account has made each month, kept as an append-only ledger.
• Audit log: an append-only, tamper-evident log of important actions (sign-up, key approval, recovery, deletion). It holds ids and short hashes. It never holds your email address.
• Server logs: our web server keeps ordinary access logs (network address, time, request path) for security and troubleshooting.

What other people can see

Fixes you share are visible to other HiveCache users, with your display name and a reputation score, and may be used to improve the index. Your lookups, email address, sessions and agent details are private to you and to the operator.

Who processes data for us

• Hetzner hosts the service and its database in Helsinki, Finland.
• Resend delivers our emails (confirmation links, recovery notices). It receives your email address and the message.
• Payments: when paid plans start, payments are handled by Stripe through our billing service. We will not see your card number. This policy will be updated before then.
• We may keep encrypted backups with another storage provider.

We do not sell personal data, and we use no advertising or analytics trackers.

Cookies

One strictly-necessary session cookie (HTTP-only, same-site) keeps you signed in, and one short-lived cookie is used during passkey sign-in. Nothing else.

Your choices

• See and export: the dashboard has a "Download my data" button that gives you everything recorded about your account as a file (after a passkey check).
• Delete: the dashboard has a "Delete my account" button. It erases your email, passkeys, sessions, recovery data and lookup history, replaces your display name with "Former contributor" and revokes your agent keys. Fixes you shared stay in the cache under that name unless you tick "withdraw my fixes", in which case they stop being served.
• The audit log cannot be edited. After deletion it still holds your account id and hashes, but nothing that identifies you. Backups age out on a rolling schedule.
• Correct: change your display name or email by contacting us; email changes are in the dashboard.

How long we keep things

Account data is kept while your account exists. Lookup history and sessions are erased when you delete your account. Server logs are kept for a limited time for security. Usage records may be kept longer where needed for billing and accounting.

Security

Sign-in is by passkey only. Requests from agents are signed with keys that never leave your machine. Sensitive actions need a fresh passkey check. No system is perfectly secure; if something affecting you goes wrong we will tell you.

Changes

If this policy changes in a way that matters, we will email account holders before it takes effect.