Privacy Policy

The short version

• We collect what we need to run your account and the communities you take part in.
• We don’t sell your personal information, show ads or use third-party analytics or advertising trackers.
• Your messages are stored on our servers so they sync across your devices. They are not end-to-end encrypted.
• Features that use an outside company, such as AI, transcription, GIFs and wallet checks, send only what the feature needs. Most are off until a hub turns them on. The companies are listed below.
• You can export your data or delete your account in Settings → Privacy → Account data.

Information you give us

• Account details: your handle, display name and password. We store your password only as a salted scrypt hash, never as readable text. When you sign up, we also record which version of the Terms and this policy you accepted, when, and when you confirmed you are 13 or older. We don’t ask for your birth date.
• Profile details you choose to add: a bio, status, avatar, accent color and any community-specific profiles.
• Optional email address: if you add and verify an email, we use it for the email described under “Email” below.
• Sign-in protections: if you turn on two-step verification, we store your authenticator secret encrypted and your recovery codes as hashes. If you add a passkey, we store its public key and the name you give it. Fingerprints, face scans and device PINs stay on your device.
• Your content: messages, replies, reactions, files and images you upload, posts, discussions, documents, events, support requests, reports and anything else you create, plus the hubs you create and their settings.
• Messages to us: what you send when you contact us.
• Feedback: what you write in the Feedback box. Nothing about the page is sent unless you tick “Include details about this page,” and the box shows you exactly what it adds: the kind of page you were on (without the names of hubs, channels and people, or the details after the address), the app version, whether you use the web, desktop or mobile app, your operating system and browser family, your window and screen size and whether you use the light or dark theme. It never includes your messages. Signed in, you can add up to three screenshots; you can crop them and blur anything private before they leave your device, and only the edited picture is sent, without camera or location details. Signed in, it’s linked to your account and you choose whether we may reply. Signed out, it’s linked only to the email you choose to leave, if any. Only the Hubs team reads it.

Information created when you use Hubs

• Sessions and devices: when you sign in, your browser or app keeps a random session token in a secure cookie. We store only a hash of it, a short device label taken from your browser’s user agent (for example, “Chrome on macOS”), and when the session started and was last used. Sessions end after 30 days or when you sign out. A session in the Hubs app for iPhone, iPad or Android renews while you use the app and ends after 90 days without use; signing out, or signing it out from your list of sessions, still ends it at once.
• IP addresses: we use your IP address to deliver the service and to apply rate limits and other abuse protections. Rate-limit counters are kept in memory. For live connections we keep a keyed one-way hash of the address for about a minute. The key is never stored, so the hash can’t be matched back to your address, even from a backup. Our application doesn’t write IP addresses to its request logs or store them with your account.
• How you found Hubs: when you create an account, we record an approximate country and region, worked out once on our own servers from your IP address (the address itself isn’t kept or sent to anyone), and how you found us: an invite, a search engine, the name of a site that linked to us, or a campaign tag in the link. Only the Hubs team sees this, for 30 days; after that we keep totals only. If your browser sends Global Privacy Control or Do Not Track, we don’t record it.
• Service logs: a request ID, the type of request, the response status and how long it took. These logs don’t include your identity, the content you send or full web addresses.
• Error reports: if the app hits an error, it sends us a short report: the error message and where in our code it happened, the kind of page you were on, the app version, whether you use the web, desktop or mobile app, your operating system and browser family, and the time. Before a report is saved, we remove email addresses, passwords, keys and codes, the details after a web address, and the names of hubs, channels and people in page addresses. A report from a signed-in device keeps a one-way code for the account, never your handle, name or email, so we can tell whether a known problem affected an account. Reports come only to us, not to an outside company, and are deleted within 30 days. Turn them off in Settings → Privacy → Account data.
• Automated security check: when you create an account, request a reset code or send feedback while signed out, your device solves a small computing puzzle so we can tell people from bulk sign-up scripts. We keep only the puzzle’s ID until it expires, so it can’t be reused. No third-party service is involved.
• Activity that makes the app work: read positions, notification and appearance preferences, drafts saved to your account, hub memberships and roles.

Site analytics

We run simple analytics of our own on our public website, so we can see how many people visit, which pages they use and how many finish signing up. They work like this:

• No cookies, and no outside analytics company.
• For each page view we record the page address (keeping only a campaign tag or referral code from the link, if it had one), the site that sent you, whether you use a phone, tablet or computer, your browser family and the time.
• We count visitors with a one-way code made from your IP address, your browser details and a random value that we replace and delete every day, so we can’t follow you from one day to the next.
• We don’t store your IP address or your full browser details.
• Sign-up steps are counted as daily totals, with no code, page or account attached.
• If your browser sends Do Not Track or Global Privacy Control, we don’t count you at all.
• Page view records are deleted after 30 days. Daily totals are kept for 25 months.

Hub owners also see totals about their own hub, never about one person, and groups too small to keep people anonymous are left out.

Voice, video and recordings

Voice and video calls and screen sharing run through a media server that we run ourselves. Audio and video pass through it to the other people in the call.

Ringing: when someone in a direct message call rings you, your devices ring through the Hubs app, the website, Apple Push Notification service or Firebase Cloud Messaging. Apple and Google only carry a reference to the call; the app gets the caller’s name from us. Nobody rings you while you have blocked them or they have blocked you, while you are in Do not disturb or quiet hours, or when you muted the conversation or the person. We keep who rang, the conversation, when, and whether it was answered, declined or missed, for one day after the ringing ends.

Calls are not recorded by default. A call is recorded only when we have turned recording on for our service and someone who runs the hub or meeting asks to record it. When it is on:

• Everyone must agree. A hub owner, administrator or meeting host can ask to record. Recording starts only after every person in the call explicitly agrees. Anyone who joins later, or reconnects, stays muted with their camera off until they agree. While it records, everyone in the call, including anyone who joins later, sees a REC notice that the call is being recorded.
• What is recorded. The host picks either microphones only, or a room video of the cameras, screens and microphones of the people who agreed. Nobody who hasn’t agreed is recorded.
• Who can see it. Anyone who currently has access to the room or channel can play the recording and read its transcript and recap until it is deleted. Losing access to the room means losing access to the recording. Hosts can download a room video only if they allowed downloads when they asked to record.
• How long it lasts. The host picks 1, 7 or 30 days. Then the recording, its transcript and its recap are deleted, and the files are removed from storage. We keep a short record that the recording existed and who agreed to it.
• Changing your mind. You can withdraw at any time, even after you leave the room. Withdrawing deletes your audio and your transcript lines and the recap. A room video can’t be edited to remove one person, so withdrawing deletes it for everyone. A host can also delete a recording early.
• Transcription is a separate choice in the request. If you agree to it, your own recorded microphone audio is sent to Deepgram to make a transcript. Your name and account aren’t sent with it. If we change the provider, the request names the new one and people agree again.
• AI recap. If the hub turned AI on before the request, the transcript, the speakers’ display names and the call’s chat are sent to Anthropic to write a recap. The request tells you this before you agree.

Live captions and voice message transcripts

• Live captions are off until a hub turns them on, and they use the hub’s AI switch. Each person in a call can then turn captions on for themselves. While anyone has them on, everyone in the call sees a notice, and short pieces of each speaker’s speech are sent from our servers to Deepgram to turn them into text. Nothing is sent while you are muted. Caption lines are kept in memory for about a minute and aren’t stored; we keep only how many caption minutes each hub used. If you choose a caption language, the lines are translated by Anthropic. Captions never run in encrypted calls. Turn on Don’t caption my voice in Settings → Privacy → Your data or in the captions notice during a call to keep your speech from being sent for live captions, call transcripts or voice message transcripts.
• Voice message transcripts are off until a hub turns them on. Then voice messages sent in that hub’s channels go to Deepgram to make a transcript, which is stored with the message and deleted with it. Voice messages in direct messages and group conversations are never sent.
• Automatic captions for demo recordings are off until a hub turns them on. Then the sound of demo videos recorded in that hub goes to Deepgram to make captions.

AI features

AI is off in every hub until its owner turns it on, and each hub has a monthly spending limit. When it is on, the feature sends only the text it needs to Anthropic, which runs the AI models. Some requests may reach Anthropic’s models through an AI routing service.

• Catch me up and the catch-up digest: your unread messages from channels you can see, never from people you blocked.
• Translation: the message or caption line you asked to translate and the language you want.
• Recaps and transcript cleanup: described under recordings above.
• Replies when you mention the hub’s AI: your question, your display name, recent messages in that conversation, staff notes for the channel and any memories you saved for it.
• Support drafts and suggested posts for staff: the help request and its replies, or the event and guidance staff gave.
• The community assistant: the hub owner must agree to outside processing first, and you see the exact request and source excerpts before anything is sent.

We keep usage records of which feature ran, the model and the cost, without the text. We don’t keep prompts or answers, with one exception: the platform owner can turn on a log of recap requests for fixing problems. Those logs are deleted after 7 days, or sooner with their recording. We don’t use your content to train AI models.

Hub owners using their own keys

We are adding a way for hub owners to use their own accounts with AI and some other outside services, by adding their own provider keys to their hub. When an owner does, that hub’s requests go to the owner’s account with that provider, and the owner’s agreement with the provider covers them. An optional mode uses only the owner’s keys, never ours, so nothing from that hub goes through our provider accounts. Keys are stored encrypted and are never shown again after they are saved.

Wallets

You can link a crypto wallet so a hub can give you roles for holding certain tokens. You can link EVM wallets (the kind used on Ethereum) and Solana wallets, and hubs can check holdings on seven blockchains: Ethereum, Base, Polygon, Arbitrum One, OP Mainnet, BNB Smart Chain and Solana.

• What we store: your public wallet address, a label if you add one, when it was verified and checked, and the last balance we read for the tokens your hubs check.
• Proving it is yours: you sign a one-time message in your wallet. We check the signature and then throw it away. The message expires after 10 minutes. We never ask for your recovery phrase or private keys.
• Balances and holder checks: we read balances when you link a wallet, when you ask, and about every 6 hours after that. To read them, we send your public address and the token contract to blockchain data (RPC) providers, which read the blockchain for us. They are the only outside companies we send your address to.
• Who can see it: your address is private. Hub staff see it only if you choose to share it. Remember that anything on a blockchain is public to everyone.
• Disconnecting a wallet deletes it and its balances from Hubs.

GIFs

When a hub turns GIFs on, GIF search uses GIPHY. Your searches go through our servers, so GIPHY gets the words you search for but not your IP address or anything about your account. The GIFs themselves load through our servers too. We keep your favorites and recent GIFs so you can find them again.

Hub Packs

Hub owners can add Hub Packs, which bring outside information into a hub. Our servers fetch it, so your device never contacts these services, and we never send your name, account or IP address.

• Gaming: game news and server status from game stores and publishers. They get only the game the hub picked.
• Sports: scores, schedules and betting odds. They get only the league or game. If you open betting features, you confirm you are 21 or older and pick your state. We keep only a yes or no for your age, for a year, and your state for 24 hours. Your state goes only into the link to the sportsbook you choose.
• Neighborhoods: weather alerts from the US National Weather Service. The ZIP codes hub staff enter go to OpenStreetMap to find the area. Your own location is never used.
• Entertainment: movie, show and book details from The Movie Database (TMDB) and Open Library, and stream and video details for channels the hub picked. If you search for a title, your search words go to TMDB or Open Library.
• Collectibles: card details and prices from TCGdex, Scryfall, YGOPRODeck and Lorcast. If you search for a card, your search words go to that source.
• Arts and crafts, and Schools: no outside sources.

What you save in a pack, such as follows, lists and projects, stays in Hubs and is in your data export. Follows and lists are deleted when you leave the hub, and everything is deleted with your account.

Email

If you add an email address, our email delivery provider delivers our email. It gets your address and the message. We send:

• Account and safety email: codes to confirm your address or reset your password, and, if ever needed, important notices about your account’s security or safety. You can’t turn these off while you have an email on your account, but you can remove your email in Settings.
• One welcome email after you verify your address. We are adding it now, and it is sent only once.
• Catch-up digests, only if you turn them on. Every digest has a one-click unsubscribe link, and you can change or stop them in Settings.
• Meeting invitations: hub staff can invite someone to a meeting by email. That address goes to our email delivery provider only to deliver the invitation.

Uploads and media

Files and images you upload are stored with our cloud hosting and storage providers in the United States. Files shared in private places are served only to people who are allowed to see them.

We scan uploads for malware. The scanner runs on our own servers, so your files aren’t sent to another company for it.

We also use Microsoft PhotoDNA, which checks uploaded images against lists of known child sexual abuse material. Each image you upload is sent to Microsoft for matching. If an image matches, we refuse the upload, keep an encrypted copy locked away for at least a year, pause the uploader’s ability to post, and report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) as US law requires.

Names and verification

We check new hub names, hub addresses, organization names and handles against reserved names and look-alikes of the Official badge. If you ask for the Official badge, we keep your request: the method you chose, the domain or link you gave as proof, the result of our DNS check, notes from our team and the decision. Organizations can prove a domain with a DNS record or a verified email at that domain. People are reviewed by hand.

If we take a name back, the holder keeps their account or place under a new plain name and gets a notice with the reason. We keep a record of the name and every action in our audit trail. Our Names and verification policy has the details.

Other optional features

These features are off unless we have set them up and you, or the hub you use, choose to use them.

• Connected accounts: Google Calendar, Outlook Calendar, Mastodon, Steam, and read-only GitHub.com or GitLab.com project activity, only when you connect them. Access tokens are stored encrypted, and you can disconnect at any time.
• Mobile notifications: if you turn them on, Apple Push Notification service or Firebase Cloud Messaging delivers them. Device tokens are stored encrypted, with which Hubs app the device has, and alerts contain general text rather than your messages. The Hubs phone app then asks us for a notification’s text over its own signed-in connection, so your messages, names and places never pass through Apple or Google; for that we keep, for two hours, which inbox items each notification covers (never their text).
• Embedded videos: when you play a YouTube, Vimeo or Twitch video someone shared in a hub, your device loads it from that site, which sees your IP address. We use their privacy-friendly modes where they offer one.
• Organization sign-in: if your organization connects its sign-in or directory, we receive the identifiers needed to link your account and manage your access to its hubs.
• Hub bots, API keys and webhooks: a hub owner can connect outside apps, bots and services to channels they choose. An API key can let an app read the messages in those channels, including the text, file details and the author’s handle and display name. A webhook sends each new or edited message in those channels, with its text and the author’s ID, handle and display name, to an outside address the owner picks. Those services handle what they receive under their own terms, not this policy.

Sparks, Hubs+ and payments

Hubs+ and Sparks are paid upgrades. During the beta nothing is charged, and we don’t collect payment details. Plans and prices may change, and we will tell you before any charge starts. When payments start, our payment processor will process them. We will receive the status of your subscriptions, purchases and refunds, but not your full card number.

Outside companies that receive data

These are the outside service providers that receive information about you or your content, listed by what they do, and why. Each handles it under its own privacy terms. Most are used only when you or your hub turn the feature on.

• Cloud hosting and storage: Everything Hubs stores, on servers and private storage we rent in the United States. Runs Hubs and keeps its data and backups.
• Content delivery: Your IP address and browser details when your device loads the app's own files. Delivers the app's code and images quickly. Your messages, uploads and account don't pass through it.
• Email delivery: Your email address and the email we send you. Delivers our email.
• AI features (Anthropic): The text an AI feature needs, such as messages to summarize or translate. Runs our AI features when a hub turns AI on.
• AI routing: The same AI requests, on their way to Anthropic's models. A route we can use to reach those models, and the route the community assistant uses.
• Transcription and captions (Deepgram): Recorded microphone audio of people who agreed to transcription, speech in calls while someone has captions on, voice messages in hubs that turn transcripts on, and the sound of demo recordings in hubs that turn automatic captions on. Turns speech into text.
• Child safety image matching (Microsoft PhotoDNA): Images uploaded to Hubs. Compares images with lists of known child sexual abuse material.
• Blockchain data (RPC) providers: Public wallet addresses and the token contracts a hub checks. Read token balances and holdings from the seven blockchains we support.
• GIF search (GIPHY): The words you search for, without your IP address or account. GIF search, when a hub turns GIFs on.
• Entertainment pack (The Movie Database (TMDB)): Words typed into an Entertainment pack search. Movie and show details.
• Entertainment pack (Open Library): Words typed into an Entertainment pack book search. Book details.
• Collectibles pack (TCGdex, Scryfall, YGOPRODeck and Lorcast): Words typed into a Collectibles pack card search. Card details and prices.
• Neighborhoods pack (OpenStreetMap): The ZIP codes hub staff enter in the Neighborhoods pack. Turns a ZIP code into a map point for weather.
• Calendar, notifications and videos (Google): Calendar data if you connect Google Calendar, push alerts if you turn them on in the Android app, and your IP address when you play an embedded YouTube video. Calendar sync, Android notifications and YouTube videos.
• Calendar (Microsoft): Calendar data if you connect Outlook Calendar. Calendar sync.
• Notifications (Apple): Push alerts if you turn them on in the iPhone app. iPhone notifications.
• Connected accounts (Valve (Steam)): Your Steam sign-in, on Steam's own page, if you connect Steam. Shows your Steam profile on Hubs.
• Connected accounts (GitHub): Your sign-in to GitHub.com if you connect it. Read-only project activity in a hub.
• Connected accounts (GitLab): Your sign-in to GitLab.com if you connect it. Read-only project activity in a hub.
• Connected accounts (Mastodon): Posts you share and your profile, on the Mastodon server you pick, if you connect it. Sharing to Mastodon.
• Embedded videos (Vimeo): Your IP address when you play an embedded Vimeo video. Embedded videos.
• Embedded streams (Twitch): Your IP address when you play an embedded Twitch stream. Embedded streams.

We will add our payment processor here before any charge starts.

How we use information

• to run Hubs: deliver messages, sync your devices, send the notifications you ask for and show your communities to you;
• to run the features you and your hubs turn on, such as AI, recordings, wallet checks and Hub Packs;
• to keep people safe: prevent spam, fraud and abuse, review reports and enforce our Terms of Service and Community Guidelines;
• to answer your questions and support requests;
• to process payments once paid features start;
• to keep the service reliable, using counts and timings that don’t identify you; and
• to meet our legal obligations.

We don’t sell your personal information, share it for targeted advertising or use your content to train AI models.

Who can see your information

• People in your hubs and conversations see your display name, handle, profile and what you post, according to each hub’s and channel’s permissions.
• Anyone on the internet can see content you make public, such as a public profile, public posts, public events or a public hub page.
• Hub owners and moderators can see activity in their hub, reports made there and their hub’s moderation records.
• Apps and services a hub connects, such as bots and webhooks, receive the messages in the channels the hub owner chose, as described above.
• Our team can access information when needed to run the service, keep it secure, answer support requests, review safety reports or meet legal obligations.
• Service providers listed above, only to provide their services to us.
• Authorities when the law requires it or when we believe it is needed to protect someone’s safety. We report child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) as US law requires.
• A successor if Hubs is reorganized, merged or sold. This policy would continue to apply to your information.

Where your information is stored

Hubs is hosted by our cloud hosting and storage providers in the United States. A content delivery provider delivers the app’s own code and images, but not your messages, uploads or account. If you use Hubs from outside the United States, your information is transferred to and processed in the United States. Some of the outside companies above may process it in other countries.

How long we keep information

• We keep your account information while your account is active.
• When you delete your account, we replace your handle and sign-in details, change your display name to “Deleted account,” and remove your profile, avatars, uploads, sessions, settings, drafts, reactions, follows, linked wallets, GIF favorites and Official badge requests from the service. Messages and discussions you posted in shared conversations stay in place under “Deleted account” so those conversations still make sense, so edit or delete anything you don’t want to remain before deleting your account. Safety reports, moderation history, consent records and financial records are kept as long as needed for safety, accounting and legal reasons.
• Before you can delete your account, you need to transfer ownership of hubs you own and end any paid subscriptions or open purchases.
• Recordings, their transcripts and recaps are deleted after the 1, 7 or 30 days the host picked, or sooner if someone withdraws.
• Encrypted backups are kept for up to about six months: hourly copies for a day, daily copies for two weeks, weekly copies for two months and monthly copies for six months. Deleted information can remain in these backups until they expire. We use backups only to recover the service after a failure and to test that recovery works.
• Email codes expire after 10 minutes, security check IDs after 15 minutes and wallet sign-in messages after 10 minutes. Recap request logs, if turned on, last 7 days. Community assistant usage records and error reports last 30 days. Feedback sent while signed out, and any email left with it, is deleted 90 days after its last change. Screenshots sent with feedback are deleted 90 days after the note is closed. Catch-up digests we sent last 90 days. Site analytics page views last 30 days and their daily totals 25 months. Live caption lines last about a minute. Service logs are rotated automatically.

Your choices and rights

• Export a copy of your data from Settings → Privacy → Account data.
• Correct your profile at any time in Settings.
• Delete your account from Settings → Privacy → Account data, or follow the steps on our account deletion page, which also explains what to do if you can't sign in.
• Disconnect connected accounts and wallets, remove your email, stop digests and turn off notifications and error reports in Settings.
• Withdraw from a recording at any time.

Depending on where you live, including the European Union, the United Kingdom and several US states, you may have rights to access, correct, delete or receive a copy of your information, and to object to or restrict some uses of it. To make a request, write to contact@ascents.gg from the email on your account or tell us your handle. We may need to confirm the account is yours. You can also complain to your local data protection authority.

Where the law requires a legal basis, we rely on our agreement with you to provide the service, on our legitimate interest in keeping it secure and free of abuse, on your consent for optional features such as recordings, transcription, wallets, connected accounts, digests and notifications, and on our legal obligations.

Children

Hubs is for people 13 and older. When you sign up, you confirm that you are 13 or older. If you don’t, we don’t create the account and we don’t keep what you typed. Some countries set a higher age for agreeing to online services (up to 16 in parts of the European Union). If you are below that age where you live, you need a parent’s or guardian’s consent to use Hubs, where the law requires it.

We don’t knowingly collect personal information from children under 13. If we learn that an account belongs to a child under 13, we will delete it. If you believe a child under 13 is using Hubs, write to contact@ascents.gg with their handle and we will act on it.

Safety

• Reports: when you report a message, post or profile, we keep the report, what it points to and who made it. Reports in a hub go to its moderators. Reports about public content come to our team.
• Child safety: if we find apparent child sexual abuse material, whether someone reports it or PhotoDNA matches it, we keep it locked away for at least a year, along with the uploader’s account details, and we report it to NCMEC as US law requires. That account can’t be deleted until the report is made.
• New accounts: to slow down spam, we limit how many accounts can be created at once, and a hub can choose to hold back accounts that are only a few hours or days old. How old an account is also counts when we weigh reports.

Cookies and storage on your device

We use only the cookies Hubs needs to work: a session cookie that keeps you signed in for up to 30 days, and short-lived cookies during passkey and organization sign-in. Your browser or app also stores drafts, preferences and cached content on your device so the app loads quickly. We don’t use advertising or analytics cookies.

Recent conversations on your device: so the app opens with your content already showing, even offline, Hubs can keep a copy of your recent Home, Inbox, conversation list and the newest messages of the conversations you opened last on the device you use. It stays on that device, separate for each account, and is never sent to us or anyone else. It never includes private (end-to-end encrypted) conversations, calls, passwords, sign-in tokens or the files themselves. It’s cleared when you sign out, when your session ends, when you turn it off and when you choose Clear saved data on this device. It’s on by default in the desktop app and the installed app, and off in a private window or when your browser may clear stored data. Change it in Settings → Privacy → Your data → Keep recent conversations on this device for a faster start.

Security

We use HTTPS, hash passwords, encrypt sensitive secrets such as authenticator keys and access tokens, limit who can reach our servers and encrypt our backups. No system is perfectly secure, and messages are not end-to-end encrypted. If you find a security problem, please tell us at contact@ascents.gg.

Changes to this policy

We will post any update here with a new date and a short list of what changed. If a change is significant, we will tell you in the app and ask you to review and accept it.

Contact

Questions or requests about your privacy? Write to Ascent Collective LLC at contact@ascents.gg.

By mail: Ascent Collective LLC, 1900 E Golf Road, Suite 950, Schaumburg, IL 60173.