Legal
Privacy Policy
Your privacy is the foundation of everything we build at Hubree. This policy explains what data we collect, why, and how we protect it. We do not sell your data. We do not profile you. We do not serve ads.
1. Who we are
Hubree is a product of GT3 Custom SoftDesign (gt3.ro), which operates the Hubree messaging application and the website at hubree.app. In this policy, "we", "us" and "our" mean GT3 Custom SoftDesign. For privacy enquiries, contact us at .
2. Data we collect
Account information
When you register we collect your email address, display name, and a hashed password. We use this only to authenticate you and to communicate service-related information.
If you turn on two-step verification, we also keep the secret your authenticator app shares with us, encrypted, and your recovery codes only as hashes — never in a form that could be read back. We email your address when two-step verification is turned on or off or a recovery code is used, so that a change you did not make does not go unnoticed.
Message content
Your messages are processed and relayed by our infrastructure solely to deliver them to you and to the intended recipient(s), and to file them into the right conversation. Merging a channel such as WhatsApp, Slack or Signal into one inbox requires our server to read those messages as they pass through; Signal messages in particular are decrypted on our server for that purpose. Email is never handled by our servers at all: it is fetched and sent by the app on your device, and only the shape of your mail accounts (never a password or a message) is stored with us. The one exception is the AI tools: when you ask for a summary or a draft, the text you asked about — a conversation, or a page of mail — is sent to our servers and on to the AI provider for that answer, and is not stored by us beyond a count of what you used. Stored messages are encrypted at rest. We do not analyse or use message content for any purpose other than delivery and the features you explicitly invoke, such as an AI summary you ask for.
Device information
For push notification delivery we process device tokens. These are never shared with third parties and are deleted when you unregister a device.
Contact form submissions
When you submit our contact form we collect your name, email address, and message to respond to your enquiry. This data is not used for any other purpose.
Log and diagnostic data
Our servers record standard access logs (IP address, timestamp, HTTP method and path, response code) for security and debugging purposes. Log records are retained for a maximum of 30 days then automatically deleted.
Crash reports
When the app or our servers hit an error, a crash report is sent to Sentry, our error tracking provider, so we can fix it. This is on by default and you can switch it off in Settings › Privacy and security › Crash reports; with it off, the app sends nothing, straight away and without restarting.
A report carries the error, where in the code it happened, the app version, the platform and your device model — and, while reports are on, the numeric id of your account, so we can tell one person's recurring problem from everybody's. It never carries your messages, your email, your phone number, your name, your IP address, screenshots or a picture of what was on your screen. Text that travels with an error is filtered first: email addresses, phone numbers, access tokens and anything stored under a name that means message content are removed before the report leaves the device or the server. One honest exception: a crash inside the operating system's own code cannot be intercepted by the app, so it is sent as a plain crash log with no account id attached.
Abuse reports
You can report a message or a conversation from inside the app. When you do, we keep a copy of what you reported so that our team can review it even if it is later deleted: the text of the reported message (or the last few messages you received in that conversation), the sender's display name and address on that channel, any attached files, the reason you chose and the details you wrote. In a group conversation this copy may include messages from other members. Reports are read only by Hubree's own staff, through a separate administration system; the reported person is not told who reported them.
3. How we use your data
- To create and maintain your account.
- To deliver messages and notifications.
- To respond to your support or contact requests.
- To detect and prevent abuse, fraud, and security threats.
- To comply with applicable law.
We do not use your data to:
- Train AI or machine-learning models.
- Build advertising profiles.
- Sell or share data with third-party advertisers or data brokers.
4. Data sharing
We share personal data only in the following limited circumstances:
- Service providers: infrastructure providers (hosting, email delivery) and our error-tracking provider (Sentry) are bound by data-processing agreements and process data only on our instructions.
- Legal obligations: we may disclose data when required by applicable law or valid legal process.
- Business transfers: in the event of a merger or acquisition, users will be notified before data is transferred.
We do not sell personal data.
5. Data retention
Account and message data is retained for as long as your account is active. You may delete your account at any time; account data is purged within 30 days. Anonymised aggregate statistics may be retained indefinitely.
The copy kept with an abuse report is deleted 180 days after the report is closed, or 30 days after it is dismissed; the record of the decision itself (date, reason, outcome) is kept without the content. Deleting your account removes the details you wrote in your own reports.
6. Security
We use industry-standard encryption in transit (TLS) and at rest. Credentials for connected channels are encrypted on our servers; mail passwords and tokens are kept in the secure storage of your device. Voice and video calls between two people — two Hubree users, or a Hubree user and a guest who opened a call link — are peer-to-peer: the audio and video go directly between the two devices, and our servers relay only the connection setup. Group calls are routed through our media server, which forwards the streams to the participants and does not record them. Your account can require a code from an authenticator app at every sign-in (two-step verification, using the open TOTP standard), and the app itself can be locked behind your device's fingerprint or face recognition with a PIN as backup; in the apps the PIN is kept on your device only, as a salted, iterated hash. The web version can be locked with a PIN as well; there the PIN is checked by our servers, which keep it only as a slow, salted hash, so that the lock cannot be removed by editing what the browser stores. The junk filter for your email runs on your device, like the rest of the mail client. Hubree conversations are not end-to-end encrypted, because the unified inbox depends on the server filing each message. We conduct regular security reviews and promptly address vulnerabilities.
7. Your rights
Depending on your location, you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. Contact to exercise any of these rights.
8. Cookies
The Hubree app does not use advertising or tracking cookies. The website uses a small number of functional cookies (e.g., theme preference) stored locally in your browser. No third-party analytics cookies are set. The website uses your device's own fonts, so no font is fetched from a third party; the only third-party resource it loads is Cloudflare Turnstile on the contact and account-deletion forms, to keep automated abuse out.
9. Children
Hubree is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.
10. Changes to this policy
We may update this policy from time to time. Material changes will be notified via email or an in-app banner at least 14 days before they take effect. Continued use after the effective date constitutes acceptance of the updated policy.
11. Contact
For privacy questions or to exercise your rights, email or use our contact form. Hubree is a product of GT3 Custom SoftDesign — gt3.ro.