Privacy Policy

1. Who handles your information

This policy covers HO-SO at ho-so.net, including its website, Workspace, API, and connected-agent interfaces. “We” means the operator of HO-SO. The operator’s legal name, address, and representative where applicable are pending confirmation for the published version. Service and privacy requests can use the contact below.

We use account and service information to operate HO-SO. A Workspace owner decides who to invite and whether to publish a document through a public link. If your organization supplies content containing personal information, it is responsible for having authority to share it and for informing the people concerned.

2. Information we collect and why

Account and sign-in information

Google account identifier, name, email address, email-verification status, and profile image when supplied; linked-account credentials and sign-in records; session identifiers, expiry times, IP address, and browser information. We use these to sign you in, identify your account, maintain sessions, and protect access. HO-SO does not receive your Google password. You can save a separate display name and profile photo in HO-SO; these do not change your Google sign-in identity.

Workspace membership

Workspace name and icon, member and invited email addresses, account identifiers, roles, and membership dates. We use these to manage access, match an invitation to a verified Google account, and enforce plan limits. An owner may provide an invited person’s email before that person signs in.

Documents and review history

Uploaded HTML and packaged assets, titles, sanitized revisions, extracted text, version identifiers, authors, timestamps, sharing links, comments, replies, anchors, edit and deletion history, and attachment files and metadata. We process these to render, search, share, export, and preserve the review history you create. In-app review notifications and per-user read status help you follow relevant comments and revisions.

Connected clients

Client names and redirect addresses, authorization scopes, account identifiers and email, authorization records, token hashes, expiry and revocation records. We use these to grant and verify the access you authorize for agents, the CLI, and other clients.

Billing information

Workspace, customer, order, subscription, store, product, and plan identifiers; subscription status and renewal or end dates; customer-portal links; and payment-event processing records. We send the purchasing account’s email and Workspace identifier when preparing checkout. These records reconcile paid access with Lemon Squeezy. HO-SO does not store full payment-card numbers or card security codes.

Inquiries

Work email, company, team size, requirements, submission date, and inquiry status when you contact us through the Enterprise form. We use these to assess and respond to your inquiry. Please avoid including confidential documents or unnecessary personal information in the message.

Security and operational records

Action, actor, target, Workspace, and timestamp records, plus hashed network/user rate-limit keys and content-free daily request and retained-content usage counters. Invitation audit targets can include the invited email address. We use these for abuse prevention, access investigation, and service operation; these records are not necessarily anonymous. Infrastructure providers also process network and request information to deliver and protect the service.

We do not sell your personal information or use document content for advertising. We may use necessary records to comply with legal obligations, investigate abuse, and establish or defend legal claims. We do not use the Enterprise form to enroll you in a marketing mailing list.

3. Workspace and public sharing

New documents are visible only to their creator until the creator shares them with Workspace members. Existing Workspace-visible documents retain that access. Members can access shared documents and review history, and can see member email addresses and comment authors. A review URL does not grant access by itself. Setting a document back to creator-only also disables any active public link. Notifications show only documents the receiving user can still access.

Only a Workspace owner can enable a public share link. Anyone with that link can view the currently shared document without signing in and can copy or redistribute it. Public sharing does not expose the private comment panel or comment attachments, but personal information written inside the HTML itself will be visible.

Disabling public sharing stops subsequent access through HO-SO. It cannot recall copies, screenshots, or content already received by other people or services. Re-enabling sharing creates a new public link; the revoked link remains invalid.

We may disclose information when legally required or when necessary to address fraud, security threats, or unlawful activity. Any business transfer involving personal information must respect applicable law and the purposes described in this policy.

4. AI agents and connected clients

When you authorize an AI agent or another client, it can request the documents, comments, and account or Workspace information permitted by your access and its scopes. Requests can include reading HTML, text, Markdown, or JSON and making authorized changes. Connecting an agent is a decision to provide the requested information to that client and its provider.

The current HO-SO service does not send uploaded content to a model for training or inference on its own. A connected AI provider applies its own privacy, retention, and training settings to information it receives. Review those settings before connecting a client or asking it to read sensitive content.

Revoking a personal token, or revoking an OAuth token through the supported revocation flow, blocks future use of that credential. It does not delete information already received by the client. Removing a connection from a client may require a separate revocation step.

5. Service providers and international processing

• Cloudflare hosts HO-SO and processes service traffic, application records, document bodies, and attachments through its infrastructure and storage services. Cloudflare privacy policy.
• Google provides account authentication and supplies the profile information described above. Google handles its own account service under the Google privacy policy.
• Lemon Squeezy is the merchant of record for purchases and handles checkout, payment information, taxes, receipts, subscriptions, and transaction support under its own terms and Lemon Squeezy privacy policy.
• Clients you connect receive information requested through their authorized access, as described above.

These providers may process information outside your country. HO-SO does not currently offer a contractual choice of data-storage country. Before publication, the operator must confirm the relevant provider entities, processing locations, contractual safeguards, and any notices or consent required for international transfers.

6. Cookies and analytics

HO-SO uses cookies needed for sign-in, session continuity, and authentication security. Blocking or clearing them can prevent sign-in or end your session. Google and Lemon Squeezy use their own cookies when you visit their services.

When you choose a language, HO-SO saves that choice in a first-party cookie for up to one year. It contains only the language code and is not used for tracking. Clear the cookie to return to your browser language.

No external product analytics or advertising trackers are enabled in the current release. Operational records used for security and service delivery are still processed. A future change to optional analytics will require an updated notice and any legally required choice before activation.

7. Retention, deletion, and export

Documents preserve prior revisions. Editing a document or comment does not erase its earlier content. Deleting a comment hides its body and attachments from the normal review view, but the original comment, edit history, and stored attachments remain in service storage. It is not permanent erasure.

A document creator who still belongs to the Workspace can move their document to Trash. This immediately blocks document viewing, exports, review history, attachments, and public links. The creator can restore it for 30 days, preserving its private URL and history. After that, it can no longer be opened or restored through HO-SO and is omitted from Trash. This is logical deletion: the underlying records and files remain stored and continue to count toward storage limits. Restoration does not reactivate a public link.

Disabling a public link, signing out, revoking a token, or cancelling a subscription does not delete the account or Workspace content. A downgrade returns the Workspace to Free limits without deleting its documents.

The current release has no automated account or Workspace purge and no published fixed retention schedule. Expired or revoked credentials can cease to work while their records remain stored. Before publication, we must set and verify retention and deletion procedures for account data, revisions, attachments, invitations, inquiries, security records, and provider backups. We do not promise immediate erasure or a specific deletion deadline in this draft.

Authorized members can export document HTML and read supported document and comment representations through the API. This is not a complete account-data export. The operator must establish a separate process for personal-information requests and permanent erasure, including limits needed to protect other members’ data and records required for tax, fraud prevention, or legal claims. Lemon Squeezy retains its transaction records under its own obligations.

8. Security

HO-SO uses HTTPS, verified-account access checks, isolated document sandboxes, browser restrictions on external requests, private attachment retrieval, and request limits. Uploaded JavaScript can access its own document and information entered into that document; it is not given HO-SO account credentials or private review comment bodies. Do not enter secrets into uploaded content. Personal access tokens and agent access tokens are stored as hashes; Google OAuth tokens are encrypted by the authentication system. Browser isolation is not a complete network firewall or a guarantee against harmful content, excessive resource use, browser vulnerabilities, or unauthorized access.

Operator access should be limited to what is needed for support, security, and service administration. Report suspected security issues through the privacy contact below. An incident-response procedure, including legally required notifications, must be in place before publication.

9. Your choices and privacy requests

Depending on the law that applies, you may request information about processing, access or a copy, correction, deletion, restriction or cessation of use or disclosure, portability, or withdrawal of consent where processing relies on consent. You may also raise a concern with the relevant data-protection authority. These rights are subject to applicable legal conditions and the rights of others.

The privacy contact below accepts requests from account holders, invited people, and people whose information appears in uploaded content. We may need proportionate identity verification and enough detail to locate the information. Do not send passwords, access tokens, full payment details, or unrelated identity documents. We will explain any lawful reason for declining all or part of a request.

For an organization’s Workspace, its owner may need to assist with identifying and authorizing changes to shared content. This does not remove your statutory rights. The current Enterprise inquiry form is not an established privacy-request channel.

10. Changes and contact

The published policy will carry an effective date. Material changes will be explained before they take effect, with consent obtained where required. We will not treat this draft as authorization for new processing.

Privacy contact: support@ho-so.net. The operator’s legal identity, address, applicable representative, and request procedure must be included or made available as required before this draft is published.

For service and subscription conditions, read the service terms.