1. Who we are
Hypno (hypno.chat, the Hypno web app, and the Hypno Voice desktop app) is operated by Cipher Zero ("Cipher Zero", "we", "us"). Cipher Zero decides how and why your personal data is processed and is responsible for it under this policy.
Our approach is simple: collect as little as possible, keep what we can on your device, encrypt what we hold, never sell it, and delete it when you ask. Where a feature cannot work without our servers reading your data, this policy says so plainly.
2. What we collect
We only collect data for features you use. If you never connect a bank, a calendar or a health service, we hold nothing from them.
- Account data: your email address, optional name and username, your theme and onboarding preferences, and the public part of your passkey credentials. Passkeys never give us your biometrics.
- Content you create: your mindset map (emotional needs, life domains, goals), tasks, projects, habits, schedule blocks and planner settings.
- AI conversations: stored only as ciphertext that we cannot read (see section 6), plus content-free metadata such as the model used, token counts and cost.
- Voice notes from Hypno Voice: stored only as ciphertext that we cannot read, plus metadata such as length and time.
- Health and fitness data, if you use those features: workouts, sets, body measurements, meal logs, and data you connect from WHOOP (recovery, sleep, strain and workouts).
- Calendar and work tools, if you connect them: events and availability from Google Calendar, and items from Jira or Linear, used to plan your schedule.
- Booking pages, if you publish one: the name, email address, note and answers that people enter when they book time with you.
- Financial data, if you turn on and connect it: see section 4.
- Plans and billing: family or team plan membership and invitations, subscription status and credit allowances. Payment details are handled by Stripe; we never receive your card number.
- Usage metering: how many seconds of audio and how many AI tokens were generated, which voice, model and provider was used, and when. It records the amount used, not what was said, and it is the basis of your allowance and our billing.
- Technical data: the IP address, browser and device type, and request information our servers and hosting providers record to operate, secure and debug the Service.
3. What never leaves your device
Some features are designed so the data never reaches us at all.
- Camera and microphone in sessions: nod detection at checkpoints and optional hum confirmation run entirely in your browser on on-device models. No video or audio from them is recorded, stored or sent to us or anyone else.
- On-device speech recognition in Hypno Voice: when you choose a local model, dictation is transcribed on your computer.
- Your Anthropic API key, if you add one: kept in your browser's local storage and sent only with your own requests. It is never stored on our servers.
- Your session library, practice statistics, streaks, preferences and cached audio: kept in your browser's storage.
- Your encryption keys: the keys that protect your conversations and voice notes are created on your device and protected by your passkey or your recovery code. We never hold them in a form we can use.
4. Financial data and Plaid
Finance features are optional and off unless you turn them on. To connect a bank account we use Plaid Inc. ("Plaid"). When you connect an account you sign in to your bank inside Plaid's own interface, Plaid Link. Hypno never sees or stores your bank username or password.
By connecting an account you authorize Plaid to collect data from your financial institution and share it with us, as described in Plaid's End User Privacy Policy: https://plaid.com/legal/#end-user-privacy-policy. You can see and manage the connections you have made through Plaid at https://my.plaid.com.
From Plaid we receive the information the Transactions product provides for the accounts you choose:
- Account details: institution name, account name and type, and the last few digits of the account number (never the full number).
- Balances: current and available balances.
- Transactions: date, amount, merchant or description, category and pending status.
We use this data only to show you your accounts, balances and spending, to build the budgets, debt plans, subscription lists and summaries you ask for, and to answer questions you ask the assistant about your money. We never sell it, use it for advertising, use it to decide credit or eligibility, or share it with anyone except the service providers in section 7 that are needed to run these features.
How it is protected: the access token Plaid issues for your connection is encrypted with AES-256-GCM before it is stored, and is decrypted only on our servers at the moment we call Plaid. Your financial records are stored in our database, which is encrypted at rest. Unlike your conversations, they are not end-to-end encrypted, because features like syncing, budgets and reminders run on our servers.
Disconnecting: you can disconnect a bank at any time from Finance, under Manage accounts. When you do, or when you delete your account, we tell Plaid to remove the connection, which ends our access to that account, and we delete its accounts, balances and transactions right away. You can also revoke access from my.plaid.com; when Plaid tells us access was revoked, we delete the data the same way. A connection that stays broken for 90 days is removed after we email you, and bank transactions older than 24 months are deleted on a rolling basis.
5. AI features
When you use the assistant, chat, session writing or other AI features, your message and the context the feature needs are sent through our servers to an AI model provider to produce the reply. That context can include your goals, plans, calendar, health data, or, for finance questions, your accounts and transactions. Our servers pass this along without keeping a readable copy.
By default these requests go through OpenRouter, which routes them to the model provider that serves the model in use, such as Anthropic, OpenAI, Google or xAI. If you add your own Anthropic API key, those requests go to Anthropic under your key and your agreement with Anthropic. If you turn on web search, your search query is sent to the search provider OpenRouter uses.
Requests we send through OpenRouter are routed only to model endpoints that have a zero data retention policy, meaning the provider does not store your prompts or the replies. OpenRouter itself does not store them either. We use these providers under API terms that do not allow them to train models on your content, and we do not use your conversations, health data or financial data to train any AI model.
6. How your data is protected
Different data gets different protection, and we want you to know exactly which is which.
- End-to-end encrypted (unreadable to us): conversation titles and messages, and voice notes. They are encrypted on your device with AES-256-GCM under a key protected by your passkey or recovery code. If you lose both, we cannot recover this content for you.
- Encrypted by us at the application level: Plaid access tokens and the sign-in tokens for Google, WHOOP, Jira and Linear.
- Encrypted at rest by our infrastructure: everything else in our database and file storage.
- Encrypted in transit: all connections to Hypno and between our servers and providers use TLS (HTTPS).
- Sign-in: passkeys replace passwords, so there is no password of yours to phish or leak. Signing in requires your device plus your biometric or device PIN.
- Inside Cipher Zero: access to production systems is limited to the people who need it, requires multi-factor authentication, and is logged.
7. Who processes data on our behalf
We share data only with the service providers that run parts of Hypno for us. Each receives only what its job needs, under contracts that limit its use to providing that service. We do not sell personal data, share it for cross-context behavioral advertising, or give it to data brokers.
- Plaid: bank connections and financial data (section 4).
- OpenRouter and the AI model providers it routes to (Anthropic, OpenAI, Google, xAI and others), and Anthropic directly when you use your own key: AI features (section 5).
- Cartesia and ElevenLabs: turning session text into speech. The text sent does not carry your name or account identifiers.
- Stripe: subscription payments and billing.
- Resend: transactional email such as invitations and booking confirmations.
- Google, WHOOP, Atlassian (Jira) and Linear: only when you connect them, to exchange the data you authorized.
- Cockroach Labs (CockroachDB Cloud): our database.
- Hetzner: the servers that run the application.
- Cloudflare: DNS, network security and file storage (R2) for avatars and encrypted voice audio.
- Doppler and GitHub: secure storage of our application secrets and code. They do not receive your personal data in normal operation.
8. How we use data
To provide the Service you asked for: composing and narrating sessions, running the assistant and planner, syncing the integrations and accounts you connect, metering your allowance, operating plans and billing, sending the emails you expect, and keeping the Service secure and working. That is the list.
We do not sell your data, we do not show advertising, we do not build advertising profiles, and we do not use health or financial data for anything except the features you turned on.
9. Retention and deletion
We keep your data while your account is active and only as long as each feature needs it. Our full schedule is in our Data Retention and Disposal Policy, available on request. The main periods:
- Account data and app content: until you delete it or your account, then deleted within 30 days.
- Financial data: while the bank is connected, then deleted when you disconnect it or delete your account. Bank transactions older than 24 months are deleted on a rolling basis.
- Encrypted conversations and voice notes: until you delete them or your account. They remain unreadable to us the whole time.
- Usage metering: 24 months, for billing questions.
- Billing records: as long as tax and accounting law requires, typically 7 years.
- Security logs: 12 months. Encrypted backups: 30 days, after which deleted data is gone from them too.
- Accounts not used for 24 months: deleted after we email you 30 days and 7 days beforehand.
To delete your account, open Account and choose Delete account, or write to support@hypno.chat from the email address on the account. Deleting removes every bank connection through Plaid and deletes your personal data from our live systems right away; copies in encrypted backups expire within 30 days. You can delete individual conversations, voice notes and other content in the app at any time. Data in your browser is yours to clear whenever you like.
10. Your rights and choices
Wherever you live, you can ask to access, export, correct or delete your personal data, ask what we hold and who receives it, and withdraw consent by disconnecting a service or turning off a feature. Residents of California (CCPA/CPRA), other US states with privacy laws, and the EU and UK (GDPR) have these rights by law. We give them to everyone.
Send requests to support@hypno.chat. We verify that the request comes from the account holder, usually by a confirmation sent to the account email, and answer within 30 days. An authorized agent may act for you with your signed permission. If we decline a request, we explain why, and you may appeal by replying to our decision. EU and UK residents may also complain to their data protection authority.
Health data: we treat health and fitness data as sensitive consumer health data, including under Washington's My Health My Data Act and similar laws. We collect it only to provide the features you use, never sell it, and share it only as described in sections 5 and 7.
We will never charge you more, give you a worse service, or treat you differently for using these rights. Because we do not sell or share personal data for advertising, there is nothing to opt out of. We still honor Global Privacy Control signals.
11. Cookies and local storage
We use only the cookies needed to keep you signed in and to secure the Service. We use no advertising cookies, no third-party trackers and no cross-site analytics. Your browser's local storage holds your preferences, session library, cached audio and, if you add one, your own API key. All of it stays on your device.
12. Children
The Service is for adults. It is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a minor has given us data, write to us and we will delete it.
13. Where data is processed
Our database runs in the United States, and our servers and service providers may process data in the United States and other countries. When personal data of EU or UK residents is transferred, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
14. Security incidents
If a security incident affects your personal data, we will notify you and the relevant authorities as the law requires, without undue delay, and tell you what happened and what we are doing about it.
15. Changes and contact
If we change this policy in a material way, we will notify you by email or in the app before the change takes effect. The date at the top shows when it was last updated.
Questions, requests or concerns: support@hypno.chat.