privacy policy

effective 8 November 2026 · Boolescale Engineering Private Limited, Hyderabad, Telangana, India

hlog ("hlog", "we") is run by Boolescale Engineering Private Limited, Hyderabad, Telangana, India. This policy explains what hlog collects, why, who else handles it, and what you can do about it. Short version: hlog collects what it needs to run your log, keeps it private unless you choose to share it, uses no tracking, and lets you export or delete everything.

what we collect

• Account: your email address (to log you in), your handle, timezone and settings (public levels, retention, theme, whether to show who you tail), and your optional bio, links and pinned line, which are public.
• How you found hlog: if you signed up from a "tail" button, one word for where it was (a profile, a shared line, the website widget or the README card). Never the address you came from, and never anything from other sites. Used only for aggregate counts.
• What you write: your lines, each with its level, the time hlog received it, and which client sent it (web, cli, api, or an AI assistant's name). Also who you tail, lines you save (private, never shown to their author), references between lines, per-line share/hide choices, and notifications.
• Sign-in data: login codes and links (stored only as hashes, valid 15 minutes, deleted within about a day), and tokens for each browser, CLI, API key and AI connection (stored only as hashes, with a name like "web · chrome mac" and when it was last used).
• Reports you send about public content: the reason, your optional note, and a copy of the reported text.
• Feedback you send through the feedback form: your message, the page you sent it from, and an email address only if you ask for a reply.
• Technical data: your IP address reaches our hosting provider with every request (that's how the internet works). hlog itself stores IP addresses and emails only as one-way hashes inside short-lived rate-limit counters (deleted within a day). The sign-up form uses Cloudflare Turnstile, which checks your browser to stop bots.

what we don't do

• No analytics, no tracking pixels, no advertising profiles, no third-party cookies. hlog sets one cookie, the login session, which is needed for the service to work.
• Ads on free accounts are plain text, chosen from the words on the page you're viewing, not from anything about you. Impressions and clicks are counted only as totals.
• We don't sell or rent your data, and we don't use your private lines to train AI models.
• Usage numbers we look at are aggregate counts (for example, how many people logged this week), never per-person tracking.

why we use it

To run your log and the features you use (signing in, storing and showing lines, feeds, search, notifications); to keep hlog secure and free of abuse (rate limits, bot checks, reports); to comply with the law; and, where you choose to make something public, to publish it. We process your data on the basis of your consent and to provide the service you asked for, under India's Digital Personal Data Protection Act, 2023 and, where it applies, the GDPR.

what's public

Nothing is public until you make a level public or share an individual line. If you also opt in to discovery (settings → discovery), your public lines can appear in /everyone and public search. Public lines appear on your profile, as plain text and RSS, in your followers' feeds, in link previews, through the API, and to AI assistants reading public logs. Making a level public includes its past lines; hlog asks you to confirm first. You can make things private again at any time, but copies that others already made (RSS readers, AI tools, search engines, screenshots) are outside our control.

AI assistants and other apps

If you connect an AI assistant (via MCP), the CLI, or an API key, that app can read and/or write your log within the permissions you granted. Data it reads is handled by that app's provider under their own privacy policy. Every connection is listed in settings → tokens, where you can revoke it.

who else handles your data

• Cloudflare, Inc.: hosting, the database, bot checks and network security.
• Resend: delivering login emails.
• GitHub: hosting the open-source CLI downloads (no hlog account data).

These providers may process data outside India, under their own security and privacy commitments.

how long we keep it

• Lines: until you remove them through your retention settings or delete your account. hlog is append-only, so single lines can't be edited or deleted, but you can hide any line from public view.
• Login codes: deleted about a day after they expire. Rate-limit counters: within a day.
• Account deletion is immediate and permanent: your account, lines, tokens, follows and notifications are deleted. Our database provider's point-in-time recovery may retain a copy for up to 30 days before it is overwritten. Your handle alone is kept, with no link to you, so nobody else can register it and inherit your old links and references.
• Reports and moderation records: as long as needed to handle abuse and meet legal obligations.

your rights

• Access & portability: export your full log any time (settings → export, as text or JSON lines).
• Correction: change your settings any time. Lines are append-only: correct one by adding a new line, and hide the old one from public if you like.
• Erasure: delete your account in settings, or ask us.
• Withdraw consent to sharing by making levels or lines private.
• Nominate someone to exercise these rights if you die or become incapacitated, and raise a grievance, by writing to admin@boolescale.com.

If you're not satisfied with our response, you can complain to the Data Protection Board of India or, if you're in the EU/UK, your local data protection authority.

age

hlog is for people aged 18 and over. We don't knowingly collect data from anyone younger; if you believe we have, contact us and we'll delete it.

security

Traffic is encrypted (HTTPS). Passwords don't exist: you log in with one-time email codes. Codes and tokens are stored only as hashes, and every token can be revoked. No system is perfectly secure; if we learn of a breach affecting you, we'll tell you and the authorities as the law requires.

changes

If we change this policy materially, we'll update the date above and tell you in your log before the change applies.

contact & grievance officer

Grievance Officer, Boolescale Engineering Private Limited, Hyderabad, Telangana, India · admin@boolescale.com. We acknowledge grievances within 24 hours and resolve them within 15 days.