Legal

Privacy Policy

What Hypheus keeps on your Mac, what it sends, to whom, and why. Hypheus is made by Crowe Logic, Inc., a Delaware corporation based in Phoenix, Arizona. Last revised October 9, 2026.

The short version

• Your code stays on your Mac unless the agent reads it for a turn you started. Then it goes to the model you selected, to produce the answer.
• Hypheus has the editor's telemetry switched off. The app sends no usage analytics of its own.
• To run your plan, Crowe Logic records who used which model and how many tokens, not what you said.
• We do not sell your data and we do not train models on your content.

What stays on your Mac

• Settings, logs and extensions in ~/Library/Application Support/Hypheus and ~/.hypheus-code. See Uninstall to remove them.
• Sign-in tokens for your Crowe ID, kept in the editor's secret storage, not in a project file. Signing out revokes the stored refresh token.
• Your own provider keys, kept in the editor's secret storage and never written to a project file or sent to Crowe Logic.
• Autopilot checkpoints: copies of files Autopilot is about to change (up to 1 MB each), held in memory while it runs so you can undo. They are not uploaded, and they are gone when Hypheus quits.

Hypheus is built on Code - OSS, with telemetry disabled in the product configuration. It does not send crash reports or usage data to Microsoft or to Crowe Logic.

What leaves your Mac, and where it goes

Signing in: Crowe ID

Hypheus signs you in with Crowe ID at id.crowelogic.com, in your browser, using the authorization-code flow with PKCE. The browser returns to Hypheus through a local address on your own Mac (127.0.0.1). Crowe ID holds your email address, whether it is verified, your name if you give one, your password (stored hashed, never in plain text) and your plan. It sends you an email to verify your address.

Hypheus models: the Crowe Logic gateway

When you send a message on a Hypheus model, Hypheus sends to api.crowelogic.com your message, the conversation so far, and whatever the agent reads on your behalf, including file contents and command output you approve. Terminal buffers are not exposed to the agent. The gateway checks your plan, forwards the request to the service that runs the model, and streams the answer back.

For each request the gateway records your account, model, token counts, time and whether the call succeeded, to meter your allowance and to monitor the service. It does not store the text of your messages or of the answers. Like any web server, it also keeps short-lived technical logs, such as the address and path of a request and error details, to keep the service running and secure.

The services that run the models

The gateway forwards each request to the cloud service that runs the model you chose. Today these are Microsoft Azure (in the United States, with backup capacity in Sweden used when the primary is busy or unavailable), Anthropic, and Cloudflare. Each receives your content only to produce the answer, under business terms that do not allow it to train on that content. Hypheus shows engines by model name in the menu.

Your own provider keys

If you connect a key for OpenAI, Anthropic, Google or OpenRouter, turns on those models go directly from your Mac to that provider, with your key. They do not pass through Crowe Logic. That provider's privacy terms apply. Provider-key chat has not yet been fully qualified end to end.

Payment: Stripe

Checkout and the billing portal are run by Stripe on crowelogic.com. Stripe processes your payment details. Hypheus and Crowe Logic never see your full card number. Your Stripe subscription carries your Crowe ID email, and we keep your plan and subscription status with your account, so your plan follows you.

Updates: hypheus.com

Hypheus checks hypheus.com for a new version shortly after it starts and about every hour after that. The request carries your platform (for example Apple silicon or Intel), the release channel and the build you are running, along with your IP address as any web request does. It carries no account information. You can turn checks off in Settings. hypheus.com and the downloads are served by Cloudflare, which processes these requests under its own privacy terms.

Extensions: Open VSX

When you search for or install an extension, Hypheus contacts Open VSX, run by the Eclipse Foundation, under its own privacy terms. Extensions you install are third-party software and may send data of their own.

Support

If you write to support@hypheus.com, we keep your message and our reply to help you. We may use Intercom, including its automated assistant, to answer support questions from our published help content.

This website

hypheus.com sets no cookies and loads no analytics or advertising scripts. Fonts are served from hypheus.com itself.

Who processes data for us

• Cloudflare: hypheus.com, downloads and updates, Crowe ID hosting, email routing, and some model inference.
• Microsoft Azure and Anthropic: model inference.
• Stripe: payments and the billing portal.
• Supabase: the Crowe ID database.
• Zoho Mail: Crowe ID verification and account email, and support email.
• Intercom: support tools.

The gateway and its metering database are operated by Crowe Logic in the United States. Some processing happens outside your country, including in the United States and, for the backup model region, in Sweden. Where the law requires it, these transfers rely on safeguards such as the European Commission's Standard Contractual Clauses in our providers' data processing terms.

Why we use it

• To provide Hypheus and your plan, which you asked for: sign-in, model requests, metering and billing.
• To keep the service running, secure and free of abuse, which is in our and your legitimate interest.
• To meet legal duties, such as keeping tax and accounting records.

How long we keep it

• Crowe ID account and plan: while your account exists.
• Metering and billing records: while your account exists, and longer where tax or accounting law requires.
• Support messages: as long as needed to help you and to keep a record of what was agreed.
• Technical logs: only as long as needed to run and secure the service.

Your choices and rights

• Sign out from Settings, then Account. Remove local data as described in Uninstall.
• Turn automatic update checks off in Settings.
• To see, correct, export or delete what Crowe Logic holds about you, or to close your Crowe ID, write to support@hypheus.com from the address on your Crowe ID. We will answer within 30 days.
• Depending on where you live, including the European Union, the United Kingdom and California, you may also have the right to object to or restrict some processing, and to complain to your data protection authority. We do not sell or share personal information as California law defines those terms.
• Business customers who need a data processing agreement can ask at support@hypheus.com.

Children

Hypheus is for people 18 and over, and we do not knowingly collect data from children.

Security

Sign-in uses OpenID Connect with PKCE, and tokens and keys stay in the editor's secret storage. No system is perfectly secure. Report a vulnerability to support@hypheus.com with "Security" in the subject.

Changes

We will update the revision date above when this policy changes and, for material changes, tell you in the app or by email first.

Contact

Crowe Logic, Inc., Phoenix, Arizona. support@hypheus.com.