1. Who we are
The controller is HidraNet, Lda, Lisbon, Portugal, registered at address to be added, company number company number to be added. Privacy contact: privacy@hidranet.org.
For the purposes of Brazil's General Data Protection Law (LGPD), HidraNet, Lda is the controller, and its data protection contact is the address above.
2. The principle
HidraNet is designed to know as little as possible about the people who use it. There are no mandatory accounts, addresses are generated on your computer, and chat and mail content is encrypted before it leaves your device.
What HidraNet never collects:
- your browsing or search history;
- the content of your HidraChat conversations or HidraMail messages;
- your private keys;
- your IP address linked to your browsing activity;
- browser telemetry or usage reports.
Since we do not store this data, we cannot hand it to anyone, nor lose it in a breach.
3. Where your data lives
Most of the data the software uses stays only on your computer: preferences, your address keys, received mail, sites you created and Tor state. Keys are sealed with your operating system's keychain where one is available. HidraNet has no access to any of it. You can delete it at any time by deleting the browser's data folder.
4. Data processed, context by context
4.1 Using the browser
| What | Who sees it | Why |
|---|---|---|
| Your browsing traffic | Tor network relays and the sites you visit, which see the Tor exit address, not yours | Anonymous routing |
| One request to check.torproject.org after connecting | The Tor Project, which sees the Tor exit address | Confirming that the connection is protected |
HidraNet receives none of this data.
4.2 Messaging applications
In this version, HidraChat, HidraMail, the Forum and SevenNine exchange messages through public MQTT brokers run by third parties (EMQ Technologies at broker.emqx.io and HiveMQ at broker.hivemq.com). With Tor connected, these brokers see the Tor exit address, not yours.
| Application | What reaches the brokers | Content readable by third parties? |
|---|---|---|
| HidraChat | Encrypted messages, a room identifier, nickname and time | No: content is encrypted on your computer |
| HidraMail | Messages encrypted to the recipient's key, destination address | No |
| Forum | Posts, nickname, category and time | Yes: the forum is public |
| SevenNine | Published site content, encrypted | No, except by those who have the site address |
Messages awaiting delivery and forum posts are retained on those brokers. HidraNet does not control the operators' retention policies. Replacing the public brokers with HidraNet's own network is planned.
4.3 Search
HidraSearch sends queries through Tor to third-party search engines (DuckDuckGo, SearXNG, Brave Search). The engine sees the search text and the Tor exit address. The browser keeps no search history.
4.4 Network count (optional, off by default)
If you turn on "Count me on the network" in the browser's Anonymity Settings, the browser sends a presence signal every 30 seconds, made of a random code that changes each session, the software version and the time. It carries no location, no room, no name and no address. The signal goes to a public channel and is used only to count how many browsers are running.
Legal basis: your consent (GDPR art. 6(1)(a); LGPD art. 7, I). The option is off by default, and turning it off stops the signal immediately.
4.5 This website
When you visit this website, the hosting provider (Vercel Inc.) logs technical request data, including the IP address, to serve the pages and protect them against abuse. Legal basis: legitimate interest in keeping the site available and secure (GDPR art. 6(1)(f)).
The website uses no analytics, no advertising, no cookies and no third-party scripts, and its fonts are served from our own server.
4.6 Paid services
When paid plans or business services are offered, we will process the data needed for the contract and invoicing: name or company name, tax number, billing address, email and payment history. Card data will be handled by the payment provider and never reach HidraNet. Legal basis: performance of the contract and tax obligations (GDPR art. 6(1)(b) and (c)). Retention: ten years for invoicing records, as Portuguese tax law requires; other data up to two years after the contract ends.
4.7 HNET and the support wallet
Support sent in HNET goes to a public Solana wallet. Solana is a public ledger: the sending wallet, the amount and the time are visible to anyone, permanently, and HidraNet cannot change or delete them. We do not ask who is behind a wallet and do not try to find out.
4.8 Contact and support requests
If you write to us, we process your address and the message to reply. Legal basis: legitimate interest in answering people who contact us. Retention: two years after the last exchange.
4.9 Security reports
Vulnerabilities may be reported anonymously. If you identify yourself, we keep your name to credit you, and only with your permission.
5. We do not sell data
HidraNet does not sell, rent or share personal data for advertising, and does not use tracking advertising.
6. Processors and third parties
| Entity | Role | Data |
|---|---|---|
| Vercel Inc. | Website hosting | Technical request logs |
| EMQ Technologies, HiveMQ | Message brokers used by the applications | See section 4.2 |
| Tor Project | Exit address check | The Tor exit address |
| Our email provider | Company email | Messages exchanged with us |
The public message brokers are not HidraNet processors: the applications connect to them directly from your computer. They are listed so you know where information goes. When paid services launch, the payment provider will be added here.
7. Transfers outside the European Economic Area
Some of the third parties above may process data outside the EEA or Brazil, including in the United States. When HidraNet engages a processor in that situation, it relies on a European Commission adequacy decision or standard contractual clauses (GDPR art. 46; LGPD art. 33).
8. Your rights
Under the GDPR (arts. 15 to 22) and the LGPD (art. 18), you have the right to:
- know whether we process your data and obtain a copy;
- correct inaccurate data;
- request erasure;
- restrict or object to processing;
- receive your data in a portable format;
- withdraw consent, without affecting earlier processing;
- not be subject to solely automated decisions. HidraNet makes none.
Since most data lives only on your computer, many of these rights are exercised directly: delete the data folder. For data we do process (sections 4.5 to 4.9), write to privacy@hidranet.org. We reply within one month, extendable under GDPR art. 12, or within fifteen days for data subjects covered by the LGPD.
One limit follows from the design: we cannot identify or delete messages retained on third-party brokers, forum posts or encrypted content, because we do not know whom they belong to. Forum posts can be hidden by moderation.
10. Minimum age
HidraNet is intended for people aged 16 or over. We do not knowingly process data of younger people.
11. Security
We apply client-side encryption, session isolation, data minimisation and an incident response process, with notification to the authority within 72 hours where the law requires it.
12. Changes
Each version of this policy is published with a date. If a change reduces your rights or widens processing, we announce it beforehand on this website and in the browser release notes.
13. Contact
privacy@hidranet.org · HidraNet, Lda · address to be added · Lisbon, Portugal