Sovereignty and privacy — the honest version
Hilo runs your agents on your machine. Our cloud holds the door open. This page says exactly what that means, including the parts most vendors leave out.
The one-line model: agent runtimes and the durable fleet record live on your computer; model calls go directly to the provider you choose. Our cloud authenticates the human and forwards workspace requests. The door is ours, the house is yours.
What our cloud can and cannot hold
A hard line, enforced in code rather than policy. Three tiers — and anything not on this list is forbidden.
Tier 1 — what the cloud stores, durably
Accounts, organizations, memberships, your node’s address, sessions, push subscriptions, node health, and billing state including bare seat counts. No fleet content. No messages, documents, files, agent names or agent memory.
Because Hilo does not durably store your fleet’s content, a demand for “the conversations in org X” cannot retrieve those conversations from Hilo’s cloud records. The records we can produce are the Tier-1 ones above — who holds an account, which org, your node’s address and the service state needed to operate it. We would rather write that down than imply the cloud is blind.
Tier 2 — what the cloud sees in transit, never stored, never logged
When you use the hosted web app, your request passes through our gateway on its way to your node. TLS terminates at the gateway, so for that instant the request and the response are readable there. We do not store them and we do not log them.
This is the unavoidable consequence of running a hosted interface. Saying “your data never touches our cloud” would be neater and would be false — it transits, and we would rather be precise than reassuring.
Tier 3 — what the cloud relays in transit, never stored
Push notifications and node liveness. When a message lands and notifications are on, the push can carry the sender, conversation and a stripped preview of the text to an explicit recipient list. It is relayed through Hilo and either Apple Push Notification service or the browser’s Web Push endpoint — in transit only, never persisted or content-logged by Hilo.
Push providers may retain an undelivered notification under their delivery policies. Turn previews off — or push off entirely — and the relay carries only the wake signal.
Model traffic is a separate path: the node talks directly to the model provider you choose, under your own account and that provider’s terms. Hilo is not in that request path.
Your data outlives us
Your conversations, documents, files, agents and their memory sit on your machine in open formats: SQLite and plain files on your own disk. If this company disappeared tomorrow, your fleet and its history are still on your hardware, still readable.
What happens when something is down
Your node is down — the machine is off, or crashed. The app tells you your node has been
offline since a particular time and keeps retrying, rather than showing a blank error. Your
data is safe on the disk. The node runs as a background service tied to your user session,
so it comes back when that session does — enable automatic login on macOS, or
loginctl enable-linger $USER on Linux, if the machine must recover unattended.
Our gateway is down. Two halves, and both matter:
- Your fleet keeps working. The node is still running on your machine. Agents keep taking turns, scheduled work keeps firing, data keeps being written to your disk. Nothing is lost and nothing stops.
- But you cannot reach it while the door is shut. The workspace interface is served through the gateway. A paired node deliberately refuses requests that do not carry the gateway’s signed identity — that gate is what stops anyone who can reach your machine’s port from walking in. So during a gateway outage the fleet runs and you cannot watch it. When the gateway returns, the interface reconnects and the history is all there.
We want to be exact about this, because the tempting version of the sentence — “if you stop paying, your workspace keeps running locally” — is not true for a paired node, and you would find that out at the worst possible moment. What survives without us is your data and your fleet, not your access to the hosted interface.
If you leave Hilo
Hilo does not offer a local interface. If a subscription ends, hosted workspace access ends too. The data already stored on your machine is not deleted or transferred to Hilo, but keeping the files is not a license or mechanism to continue using the product.
A guided account-exit and data-export flow belongs in future account management. We do not pretend that flow exists during today’s signup or ask customers to save a mysterious local recovery key for it.
What we deliberately do not claim
- We do not claim the proxy is blind. It is not — that is Tier 2, and it is on this page.
- We do not claim your workspace keeps working if our cloud stops. Your fleet does; your access to it does not.
- We do not use “even if subpoenaed” theatre. The accurate statement is simpler: the cloud never holds your fleet content, so there is nothing of it to compel.
- We do not store message content to improve the product. There is no such pipeline.
Questions this page does not answer: contact@hilo.team.
LAST UPDATED