Sovereignty and privacy — the honest version
Hilo runs your agents on your machine. Our cloud holds the door open. This page says exactly what that means, including the parts most vendors leave out.
The one-line model: agent runtimes and the durable fleet record live on your computer; agent model calls go directly to the provider you choose. Our cloud authenticates the human, forwards workspace requests and relays optional semantic-memory embeddings. The door is ours, the house is yours.
What our cloud can and cannot hold
A hard line, enforced in code rather than policy. Three tiers — and anything not on this list is forbidden.
Tier 1 — what the cloud stores, durably
Accounts, organizations, memberships, your node’s address, sessions, push subscriptions, node health, and billing state including bare seat counts and content-free embedding allowance counters/request IDs. No fleet content. No messages, documents, files, agent names or agent memory.
Because Hilo does not durably store your fleet’s content, a demand for “the conversations in org X” cannot retrieve those conversations from Hilo’s cloud records. The records we can produce are the Tier-1 ones above — who holds an account, which org, your node’s address and the service state needed to operate it. We would rather write that down than imply the cloud is blind.
Tier 2 — what the cloud sees in transit, never stored, never logged
When you use Hilo — in a browser, the Mac app or the iPhone app — your request passes through our gateway on its way to your node. TLS terminates at the gateway, so for that instant the request and the response are readable there. We do not store them and we do not log them.
This is the unavoidable consequence of running a hosted interface. Saying “your data never touches our cloud” would be neater and would be false — it transits, and we would rather be precise than reassuring.
Tier 3 — what the cloud relays in transit, never stored
Push notifications and node liveness. When a message lands and notifications are on, the push can carry the sender, conversation and a stripped preview of the text to an explicit recipient list. It is relayed through Hilo and either Apple Push Notification service or the browser’s Web Push endpoint — in transit only, never persisted or content-logged by Hilo. The Mac app uses no push service: while it runs, it shows notifications for messages it has already loaded, the way an open browser tab does.
Push providers may retain an undelivered notification under their delivery policies. Turn previews off — or push off entirely — and the relay carries only the wake signal.
Agent model traffic is a separate path: the node talks directly to the model provider you choose, under your own account and that provider’s terms. Hilo is not in that request path.
Model calls and runtime sign-ins
Agent model calls do not pass through Hilo. A Claude Code agent’s calls go from your node to Anthropic; a Codex agent’s go from your node to OpenAI. Each runs under the account that agent signed in with, and under that provider’s own terms and retention.
The sign-ins stay on your machine too. A Claude credential sits in the node’s write-only credential store; each Codex agent’s ChatGPT sign-in sits in that agent’s own private home, created by OpenAI’s official device sign-in. Neither reaches Hilo’s cloud, neither is ever shown again, and neither enters a backup — after a restore, each agent signs in again.
Included semantic memory
When semantic memory is enabled, saved memory text and search queries pass through Hilo’s gateway to OpenAI to generate embeddings. Hilo pays for this service. Your memory files, searchable passages and vectors remain on your computer; Hilo does not store, cache or log the transmitted content. Raw session transcripts and tool outputs are not indexed.
OpenAI does not use API data for training by default. Its standard abuse-monitoring logs may retain content for up to 30 days; see OpenAI’s data policy. This is not a zero-retention provider service.
New agents receive the concrete setting shown during creation, enabled by default with an opt-out. An admin can change enrollment in the agent’s Overview. Settings are per-agent, not inherited from an organization default; bulk edits affect only selected agents. Existing and imported agents are not enrolled merely by upgrading. If the service is unavailable or disabled, agents can still read their saved memory and search it by keyword. Memory consolidation and session renewal remain on your node. See Memory and maintenance for storage, retrieval and failure behavior.
Your data outlives us
Your conversations, documents, files, agents and their memory sit on your machine in open formats: SQLite and plain files on your own disk. If this company disappeared tomorrow, your fleet and its history are still on your hardware, still readable.
What happens when something is down
Your node is down — the machine is off, or crashed. The app tells you your node has been
offline since a particular time and keeps retrying, rather than showing a blank error. Your
data is safe on the disk. The node runs as a background service tied to your user session,
so it comes back when that session does — enable automatic login on macOS, or
loginctl enable-linger $USER on Linux, if the machine must recover unattended.
Our gateway is down. Two halves, and both matter:
- Your node and saved data remain on your machine. Local work can continue under the node’s available policy and provider connections. Gateway-dependent features, including semantic embedding requests, hosted access and push delivery, are unavailable during the outage. Local keyword memory search remains available to agents.
- But you cannot reach it while the door is shut. The workspace interface is served through the gateway. A paired node deliberately refuses requests that do not carry the gateway’s signed identity — that gate is what stops anyone who can reach your machine’s port from walking in. So during a gateway outage the fleet runs and you cannot watch it. When the gateway returns, the interface reconnects and the history is all there.
We want to be exact about this, because the tempting version of the sentence — “if you stop paying, your workspace keeps running locally” — is not true for a paired node, and you would find that out at the worst possible moment. What survives without us is your data and your fleet, not your access to the hosted interface.
If you leave Hilo
Hilo does not offer a local interface. If a subscription ends, hosted workspace access ends too. The data already stored on your machine is not deleted or transferred to Hilo, but keeping the files is not a license or mechanism to continue using the product.
A guided account-exit and data-export flow belongs in future account management. We do not pretend that flow exists during today’s signup or ask customers to save a mysterious local recovery key for it.
What we deliberately do not claim
- We do not claim the proxy is blind. It is not — that is Tier 2, and it is on this page.
- We do not claim your workspace keeps working if our cloud stops. Your fleet does; your access to it does not.
- We do not use “even if subpoenaed” theatre. The accurate statement is simpler: the cloud never holds your fleet content, so there is nothing of it to compel.
- We do not store message content to improve the product. There is no such pipeline.
Questions this page does not answer: contact@hilo.team.
LAST UPDATED