Privacy

What the app collects

Three things. The first two are on by default and can each be switched off in Settings, under Advanced.

• Crash reports. If the app crashes, a report is sent so the fault can be fixed. It contains the stack trace, the Hydra version and your macOS version. It carries no connection details, hostnames, credentials or file contents, and it is not tied to you or to your machine. Handled by Bugsnag. Turning this off takes effect the next time Hydra launches, because a crash reporter cannot be safely half-removed once it is running.
• Usage analytics. Which features get used, plus the Hydra and macOS version, device model, CPU architecture, screen size, language, timezone and country. These are tied to a random identifier generated on first launch, which stays the same for that installation. Our server also records the IP address each request arrives from, as any web server does. Event names come from a fixed list in the app: they record that a feature was used, never what you used it on, so no connection name, hostname, path, query or file content is included. Handled by Hankinsoft on our own infrastructure, not a third-party analytics provider. Turning this off stops it immediately.
• Your email address, if you give it. The welcome flow has an optional screen offering to keep you posted. If you leave it blank, nothing is collected. If you fill it in, the address is used for that and nothing else.

A random per-installation identifier alongside an IP address is not the same as anonymous data, and we would rather say so plainly than claim otherwise. If you would prefer not to send it, the switch is in Settings, under Advanced, and it works immediately.

What it does not collect

• No advertising identifiers, and nothing shared with or sold to advertisers or data brokers.
• No record of what you connect to, open, edit or transfer. Connection names, hostnames, file paths, queries and folder contents are never sent.
• No copies of your files, queries, database contents or credentials.
• No account. The app does not require you to sign up for anything.

Where your connection library lives

On your Mac. If you are signed in to iCloud, it also syncs through your own private iCloud database, which is your Apple account rather than a server operated by Hankinsoft. If iCloud is unavailable the app runs entirely locally and says so in its status bar.

Where your passwords live

In the Keychain, stored separately from the connection library and marked for iCloud Keychain sync. They are never written into the synced library database, and they are never transmitted to Hankinsoft.

Scanning a project folder

When you ask the app to scan a folder, the walk happens on your Mac. The judgement about whether a discovered credential is a real secret or a placeholder is made by a model running on your device. The contents of your configuration files are not uploaded anywhere for that, or for anything else. Nothing found in a scan is imported until you select it, and secret values are not displayed on screen.

Network connections the app makes

The app connects to the servers you configure. Beyond that it contacts Hankinsoft to check for updates, to deliver a crash report, and to send usage analytics — the last two only while they are switched on, and both are in Settings under Advanced. Two optional automation surfaces — a local control socket and a network server — exist for scripting and are switched off by default.

This website

hydradevstudio.com serves static pages, and uses Google Analytics to count visits and see which pages get read. That is a third-party service: it sets its own cookies in your browser, and your IP address, the pages you view and rough location go to Google. No advertising or remarketing features are switched on, nothing here is sold to data brokers, and none of it is joined to anything the app collects.

This is worth saying plainly, because the app deliberately does the opposite: its usage analytics run on our own infrastructure precisely so that a third party is not involved. The website is the one place that is not true, and a content blocker will stop it. Nothing on the site needs it to work.

Contact

Questions about any of the above can go to support.

Last updated 3 August 2026.