Hero Agent privacy notice

This notice covers the Hero Agent product only — the browser app at agent.herostudios.dev and the desktop shell that wraps it. The website's own policy (a static site, no analytics, no tracking cookies) stays on the main privacy page. Where this notice and the main policy disagree for Hero Agent data, this notice wins.

1. What stays local

• Workspace files (browser app). In the browser product, the files you create and edit live in your browser's storage on your machine. They are not uploaded just because you edited them.
• Local edits. Typing, saving, and running commands in the IDE stay between your machine and whatever tool you ran. Terminal output is shown to you, not logged to Hero servers.
• Offline preferences. Theme, layout and keymap preferences are stored locally; nothing requires a network round-trip to apply them.
• BYOK keys, at rest on your device. Keys you paste stay encrypted locally; they are not echoed back to us in plain text (see section 4 for how they travel on a call).

2. What goes to Hero servers

• Conversations (D1). Chat messages and replies are stored server-side so your chats survive reloads and devices, tied to your herostudios.dev account if you sign in. Deleting a conversation deletes its rows.
• Project files (D1). Projects you build through the hosted flow are copied to our D1-backed file store so builds and previews work across sessions. This is a copy — your local originals stay local.
• Memories (D1). Facts the Agent extracts from your chats to remember later are stored server-side and injected into future prompts (capped, ~3K characters of injected memory). You can view, edit, delete, export or opt out at any time from the Memory Panel (Ctrl+M).
• Progress milestones (optional). Only when telemetry is enabled: coarse milestones such as first chat, first build, voice used, theme chosen, project saved, provider connected and plan upgraded, reported to the shared herostudios.dev catalog so the ecosystem can reflect your progress. Never your file contents or prompt text.
• Crash reports from the desktop build (planned fields). The desktop shell's crash reporter collects a stack trace, file paths and OS version. Path redaction is planned, not yet complete — treat desktop crash reporting as the most sensitive telemetry in the product and disable it if that matters to you.
• Checkout orders (when checkout launches). Plans & checkout is still planned; when it ships, orders are processed by our payment provider and we keep the billing records required for accounting and legal compliance (see section 6).

3. What goes to model providers

• Prompt + context for the selected slot. Every message you send — together with the context the Agent attaches for that call (relevant files, memories, conversation history within the model's window) — is sent to whichever engine the server resolves your slot (NOVA, FORGE, SAGE, LENS, SCRIBE, ATLAS or SWIFT) to for that request.
• Who the provider is, is server-side. The UI shows slots, not vendor model ids; the mapping happens on our API. That also means a provider sees your prompt and attached context as part of serving the call — that is inherent to using a hosted model.
• No BYOK keys to Hero on provider-routed calls. When you use your own key, the key goes from you (or our API on your behalf, over TLS) directly to the provider — Hero does not receive your BYOK key as part of serving the model call, and your key is never written to D1.

4. BYOK key handling — the honest threat model

• Encrypted at rest. Keys you store with us are encrypted with a PBKDF2-derived Fernet key before they touch the database.
• Sent directly to the provider. On a call with your key, the key is decrypted only long enough to attach it to the outbound request to the provider you chose, over TLS.
• What that does and does not protect. Encryption at rest protects against database exposure — someone reading the store does not get plaintext keys. It does not protect against: a compromised server that is actively serving your requests (it must be able to decrypt to use the key), the provider itself seeing the key on the wire of its own API, or a provider-side breach. If any of those are in your threat model, use the hosted slots with metering instead of storing keys with us — that is the safer configuration, and it is the default.
• Never logged, never telemetried. Keys are not written to application logs, crash reports or analytics.

5. Your controls

• Memory panel (Ctrl+M). Edit, delete, export, or turn off automatic memory extraction entirely — opt-out stops new extraction; existing memories stay until you delete them.
• Conversation delete. Deleting a chat in the ChatsBar removes it from D1; it stops appearing everywhere you sign in.
• Telemetry toggle. Progress-milestone reporting is off unless you enable it. Disabling it stops new milestone reports; it does not retroactively delete milestones already recorded.
• One account, one session. Browser sessions on *.herostudios.dev use the hs_token cookie; the desktop Hero Agent app sends that exact same session as a Bearer header instead (no cookie). It is one Hero account either way — signing out or revoking sessions revokes access on every surface at once.
• Data export. Request an export of your stored conversations, memories and account data via your account or by emailing privacy@herostudios.dev.
• Account deletion. Email the same address — deleting the account deletes its conversations, memories and metering rows, subject only to the retention limits in section 6 (things already legally required to be kept) and backups on their normal expiry.

6. Retention

• Chats & memories: kept until you delete them (or delete the account). There is no automatic chat expiry today.
• Crash logs: 90 days, then purged.
• Billing records: as long as tax and accounting law requires (once checkout exists — it is still planned today, so there are no orders to keep yet).
• Backups: rolling backups expire on their normal cycle (days, not months); deletion propagates as backups roll over.

7. Changes & contact

When this notice changes materially, the version it applies to is restated in the header above and the update appears on the releases page. Questions, exports and deletions: privacy@herostudios.dev · contact the studio · general terms: terms of service.

Independent software studio — not affiliated with any other company using a similar name. This notice describes the product as shipped; where we say something is "planned", it does not describe today's behaviour.