Modernize Marketing LLC runs Flex Hydra. This policy explains what we collect and why. The short version: your code, terminals and agent conversations stay on your computer, and when the phone app shows them they travel end-to-end encrypted, so we can’t read them. What a team shares in a company (messages, files, tasks, pages and time records) is stored on our server so the team can see it. Beyond that, we only know who you are, which devices are signed in, and whether you’ve paid.
What stays on your computer
Your files, terminal output, prompts, agent conversations, the screenshots you capture, and your sign-ins with Claude Code, Codex and other agents stay on your computer. The agents talk to their own providers directly, under those providers’ privacy policies. The app’s logs and crash reports are also stored only on your computer and reach us only if you choose to send them. What you share in a company is the exception: see Companies.
What we collect
- Your email address, to sign you in, to contact you about your account, and now and then to tell you about Flex Hydra (news and offers). Every such email has an unsubscribe link.
- Your name and profile photo, if you add them. Everyone in the companies you’re in sees them.
- Sign-in codes, stored only as a hash and deleted within a day, with the IP address that asked for them so we can limit abuse.
- Signed-in devices: a random install ID, the computer’s or phone’s name, its operating system and when it last checked in — so you can see and sign out your devices and we can enforce the device limit.
- Subscription status: your plan, its status, when the current period ends and, if you own a company, how many seats it pays for. Card details are handled by Stripe; we never see them.
- License checks: the desktop app contacts our server at launch, every 12 hours and after your computer wakes to confirm your subscription or your seat in a company.
Companies
Company mode brings a team into Flex Hydra: chat, task boards, docs, time tracking and calls, in the desktop and phone apps. A company’s owner creates it and invites its members, and with the admins they choose decides what the team uses: whether time tracking is on and how often it takes screenshots, who can send direct messages, and who opens which boards and notebooks. If you’re a member, your company’s owner can tell you how it uses Flex Hydra.
What a company holds is stored on our server so its members can see it on their computers and phones. It travels encrypted, but it isn’t end-to-end encrypted: our server can read it. We use it only to run Company mode.
What a company stores
- Members: each member’s name, email, photo, role and when they joined, and their settings: whether they can message everyone directly, have a personal board and track time, and their hourly rate. Whether someone is online or away comes from their open connections and isn’t stored; the desktop app reports you as away after 10 minutes without keyboard or mouse input.
- Messages and files: channels, direct and group messages with their threads, reactions, mentions and files, and how far each member has read. What you search for is used only to answer the search, and isn’t stored.
- Tasks and comments: boards, tasks with their descriptions, files and history, comments, who follows each task, and each member’s inbox.
- Pages: notebooks and their pages, with their files.
- Time records: time sessions with their screenshots and activity (below).
- Invites: the invited email address, the role offered, who sent it and when it expires. Resend sends the invite email for us.
Who sees what
- Everyone in a company sees its members’ names, emails, photos, roles, join dates and whether they’re online, and its public channels.
- Private channels, direct messages and group messages are seen only by the people in them. Owners and admins can’t read the ones they’re not in.
- Boards: a team board is seen by its members, and a personal board by its member. The owner and admins see every board.
- Shared notebooks are seen by the members given access, and by the owner and admins.
- Personal notebooks are seen by their member and those above them: the owner reads everyone’s, and admins read members’ (not the owner’s or another admin’s). Each notebook says who can see it. Once its member has left, only the owner can.
- Time records and screenshots are seen only by the member they belong to and the company’s owner and admins, and so are each member’s settings, hourly rate and pay.
- Files are seen by whoever sees the message, task or page they’re attached to.
Time tracking and screenshots
Time tracking is off until an admin turns it on for the company. Then every member can track, except those an admin turns it off for. It runs only in the desktop app, only while that member’s own timer is running, and the app shows when it is. The phone app shows your time and can stop the timer, but never tracks.
- Screenshots: one in each interval the admins set (1, 3, 5, 10, 15 or 30 minutes), at a random moment, of the screen the pointer is on. They’re deleted after 30 days, and the member or an admin can delete one sooner, which takes its interval off the recorded time. If the admins turn it on, the desktop app shows a notification each time it takes one.
- Activity: every 10 seconds, whether the computer had any keyboard or mouse input in those 10 seconds, from its idle time. While the member is in a call with someone in the company on that computer, those 10 seconds count as active. Only these counts are kept, never which keys were pressed.
- Sessions: when the timer started and stopped, and why it stopped (stopped from one of the member’s devices or by their removal, or no word from the computer for 5 minutes); the computer it ran on, with its name, and the device a stop came from; notes on time added by hand; and the hourly rate each session is paid at.
Calls
Voice, video and shared screens in calls go through our own call server, which runs LiveKit, open-source software we host ourselves. They’re encrypted in transit but not end-to-end, and the call server passes them on in real time: we don’t record calls or keep their audio or video. While a call is on, our server keeps who is in it, in memory only, to show the conversation’s members. Our server’s request logs record each request to join a call (the conversation, the time and the IP address it came from), as they do other requests.
Leaving a company, and deleting one
- Leaving or being removed: what you posted stays with the company (messages, tasks, comments, pages and time records). Your personal board and notebook are archived, where admins can still open the board and the owner the notebook, and a running timer stops.
- Deleting a company, which only its owner can do, deletes everything in it for every member: messages, files, tasks, pages, time records, screenshots and invites. It leaves our database at once, and file storage right after.
- Deleting your account: see Delete your account.
The phone app
The phone app signs in with your email like the desktop app and shows up among your devices. It has no ads, analytics or tracking.
- Between your phone and your computer: agent threads, their messages, photos and approvals are end-to-end encrypted with keys that exist only on the two devices. They pass through our relay server, which can’t read them and doesn’t store them. The relay does see which of your devices are connected, when, and how much data they send.
- Companies: the phone app reaches your companies through our server directly, as the desktop app does, with or without a paired computer. What it shows and sends there is covered under Companies.
- Camera, microphone and photos: the camera scans the pairing code on your computer and takes the photos you choose to send. Photos you send to your agents go only to your computer; photos you post in a company, and your profile photo, are stored on our server. In a call, the app uses the microphone, and the camera when you turn it on.
- Face ID or fingerprint: your phone checks it. Neither the app nor we ever see your face or fingerprint.
This website
The website has no ads or tracking cookies. We count visits with our own analytics (pages viewed, where visitors came from, approximate location, browser), run on our own server, which keeps a random visit ID in local storage. When you create an account, we keep the ID of the visit it came from, so when you first sign in on the app or subscribe we can see which sites send us customers.
When you sign in on the account page, the browser keeps your sign-in for that tab only (session storage) and a random browser ID (local storage).
Who processes data for us
- Hetzner — hosts our server, database, call server and the phone app’s relay in Ashburn, Virginia (USA), and company files, screenshots and profile photos in its object storage in Falkenstein, Germany.
- DigitalOcean — hosts our analytics and the dashboard where we look up customer accounts.
- Resend — sends sign-in and invite emails.
- Stripe — takes payments, including a company’s seats, and calculates tax.
We don’t sell your data or share it with anyone else, except where the law requires it.
How long we keep it
We keep your account data while your account exists, and a company’s content while the company exists, until someone allowed to delete it does. Time-tracking screenshots are deleted after 30 days, and company files that were uploaded but never attached to anything after 7 days. Stripe keeps payment records as tax law requires.
Your choices
You can see your devices and sign them out on your account page. To get a copy of your data or correct it, email thedev@flexhydra.dev from your account’s email address.
In a company, you can change your name and photo and delete your own messages and screenshots in the app. For anything else it holds about you, ask its owner or admins.
Delete your account
In the phone app, open the You tab and tap Delete account. Or email thedev@flexhydra.dev from your account’s email address and we’ll delete it.
Deleting your account removes your email, sign-in codes, devices and subscription record at once and signs out every device. A subscription ends immediately, without a refund. Stripe keeps payment records as tax law requires.
If you’re in a company:
- A company you own is deleted too, with everything in it, for all its members.
- You’re removed from every other company.
- Every chat message you wrote is erased, in every company: it shows as “This message was deleted” from “Deleted user”, so the conversations around it still make sense. Its files, and your reactions, are deleted.
- Your time records and screenshots are deleted in every company, and so is your profile photo.
- Tasks, comments and pages you wrote stay with their company, without your name. Your personal notebooks stay archived, with no owner or name, until the company’s owner deletes them.
Changes
If we change this policy, we’ll post the new version here with its date.
Contact
Modernize Marketing LLC, 888 Prospect St Ste 200, La Jolla, CA 92037. Email thedev@flexhydra.dev.