1. Who is responsible
Finnian Wisak, Im Auholz 8, 2344 Maria Enzersdorf, Austria · finnian.wisak@icloud.com
2. This website
Server logs
Visits to this website and to the Hatch service are not logged. To deliver a page, the web server holds your IP address briefly in memory. If a technical error occurs, the web server writes an error message (with IP address, time and requested address) to an error log, which is deleted automatically after 52 days at the latest. The purpose is secure and stable operation; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR).
No cookies, no tracking, no third parties
We use no cookies and no analytics or marketing tools. Fonts, images and scripts are served exclusively from our own server — visiting does not send any data to Google Fonts, CDNs or social networks.
Hosting & DNS
Website and service run on a rented server from Hostinger International Ltd. (Larnaca, Cyprus) in a data centre in the European Union. A data processing agreement is in place. The domain's name resolution is handled by Cloudflare (DNS only, no proxy).
3. The Hatch apps and online service
Account
To use Hatch you need an account: email address, name and password (stored only as a scrypt hash). The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).
Your content
Projects, tasks, notes, checklists, images, reminders, planner blocks, focus sessions and agent handoffs are stored on our server so they stay in sync across your devices. Transfers are encrypted (TLS).
Usage display
The Windows app reads the local session logs of Claude Code and Codex on your PC and sends only aggregated numbers (tokens per day/window, models, limit percentages) to your account — never content. You can turn this off under Settings → Shortcuts & Windows.
4. Connected services — only if you turn them on
- GitHub (GitHub, Inc., USA): with your token, the server fetches commits, pushes, pull requests and repository information for repos you link. The token is stored encrypted with AES-256-GCM.
- Google Gemini (Google Ireland Ltd. / Google LLC, USA): when you use AI features, the content they need (e.g. your quick note, task titles, project descriptions) is sent to Google with your own API key. With free Gemini keys, Google may use inputs to improve its services under its terms — use a paid key or no AI for sensitive content. The key is stored encrypted.
- Calendar feeds: ICS addresses you add (e.g. iCloud) are fetched regularly to show your events.
- Discord webhook (optional): notifications are sent to the address you provide.
- Claude Code & Codex: these programs run on your computer and access your Hatch data with a token you create. What they do with it is governed by the terms of Anthropic and OpenAI respectively.
For transfers to the USA, these providers rely on the EU-US Data Privacy Framework or standard contractual clauses. The legal basis is your consent by enabling the connection (Art. 6(1)(a) GDPR); you can revoke it at any time in Settings.
5. How long we keep data
Your data stays stored until you delete it or remove your account (Settings → Account & data → Delete account). Then all content, files and tokens are deleted irreversibly. Daily database backups are deleted automatically after 30 days — by then, your data is gone from them too.
6. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability (export as JSON right in the app) and to object. Just write to finnian.wisak@icloud.com.
If you believe the processing of your data violates data protection law, you can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
7. Security
Passwords are stored only as hashes, keys to third-party services are encrypted, and sessions and agent tokens can be revoked. Please report security issues to finnian.wisak@icloud.com (see security.txt).