Hiroba is made by Ludo Technologies LLC (合同会社Ludo Technologies), a company in Kanagawa, Japan. This page explains what we collect, why, where it is processed, and how to have it deleted. It covers:
- the website hirobaoffice.com, including the blog and the browser edition of Hiroba at
/app/; - the hosted service: the sign-in and organization backend (
auth.hirobaoffice.com), the signaling server (ws.hirobaoffice.com), and the update service (update.hirobaoffice.com); - the desktop app we distribute through GitHub Releases, Homebrew, winget, and the Microsoft Store.
It does not cover servers that someone else runs. Hiroba is open source and anyone can self-host it. The operator of a self-hosted server decides what that server keeps, and the only thing an official desktop app sends us while connected to one is the update check described below, which a self-hosted build can turn off.
The principle behind all of it: a virtual office needs to know who is in the office. It does not need to hear what is said, and Hiroba is built so that it cannot.
What we collect and why
Your account
When you sign in with Google or GitHub, the provider gives us an identifier for your account, your email address together with whether the provider has verified it, and your display name. When you sign in with an email code, we receive the address you type; the code we mail you is stored only as a salted hash and is deleted once it is used, expires, or has been guessed wrong too often. We never see your password. The verified email address is what identifies your account across sign-in methods.
Your organization
An organization's name, its members and their roles, and the invites its administrators issue, including the address an invite was mailed to. The signaling server also keeps the organization's spaces (floors and rooms) and the chat messages posted in them, each with its author's name and avatar colour, plus reactions. Chat messages are the only thing you write that our servers store; their author or an administrator can remove them in the app.
Presence while you are connected
Your display name, avatar colour, optional avatar image, position on the floor, status such as do-not-disturb, and which space you are in. The signaling server holds these in memory for as long as you are connected and shares them with the other members of your organization so they can see you. They are never written to disk.
Voice, video, and screen sharing
Calls go directly between participants' devices over WebRTC, encrypted end to end (DTLS-SRTP). Our servers never receive audio, video, or shared screens. The signaling server relays the connection-setup messages two devices exchange to find each other, which include network addresses. When a direct connection is not possible, for example behind a strict corporate firewall, the traffic is relayed by a TURN server; on the hosted service that relay is Cloudflare's. A relay forwards the encrypted packets and cannot decrypt them. Camera background blur and replacement run entirely on your device, and a background image you choose is stored only there.
Billing
Paid plans are billed through Stripe. We send Stripe the organization's name and identifier and the administrator's email address, and we keep the Stripe customer and subscription identifiers, the subscription status, the seat count, and the end of the current billing period. Card numbers go to Stripe directly and never reach us. How Stripe handles your payment details is described in Stripe's privacy policy.
Guests
A teammate who joins from an invite link in the browser, without an account, enters a display name; the browser also keeps a random guest identifier so a return visit is recognized as the same guest. Guest sessions are short-lived and issued afresh on each visit. For each guest visit we record the organization, the day, how long the guest stayed, and how many other people were present at most. The name is used only to tell visits apart within a day and is not stored.
Update checks and downloads
Official desktop builds check update.hirobaoffice.com for a new version shortly after launch and every four hours while open. From those requests we keep one row per device per day: platform, architecture, installed version, and the country Cloudflare derives from the IP address. The device is a hash of the IP address and user agent salted with the date, so rows cannot be linked across days. Apps installed from the Microsoft Store are updated by the Store and do not check. The download buttons on the website pass through the same service, which records the day, the hashed device, and the chosen platform before redirecting to GitHub, where the download itself happens.
The website
hirobaoffice.com uses Cloudflare Web Analytics, which counts page views without cookies or cross-site tracking. The landing page additionally reports which of its sections you scrolled to, whether you pressed the demo button, and the page language, recorded per day against the same kind of hashed device.
Server logs
Like every service on the internet, our servers and Cloudflare's edge keep request logs: IP address, user agent, the request, timestamps, and errors. We use them to keep the service running, to limit abuse, and to investigate problems, and they are kept for a limited time only.
Support
If you write to us through the in-app help form or by email, we receive your message and your email address and keep the conversation for as long as it takes to help you.
On your device
The desktop app keeps your session in the operating system's keychain (Keychain on macOS, Credential Manager on Windows, Secret Service on Linux) and your display name, colour, avatar, language, server address, and camera background in its local storage. The browser edition keeps the same things, session included, in your browser's storage. Uninstalling the app or clearing the site's data removes them.
Cookies
The website sets no cookies. The invite page sets one short-lived cookie while you sign in there, to tie the sign-in that comes back from Google or GitHub to the browser that started it. It serves no other purpose.
Who processes data for us
We do not sell personal data and we show no advertising. These companies process data on our behalf:
- Fly.io runs the hosted servers, in its Tokyo region.
- Cloudflare provides DNS, the CDN and hosting for the website, web analytics, the update service and its database, the TURN relay, and the backups of the sign-in database.
- Stripe processes payments.
- Resend delivers our email: invites, sign-in codes, and support messages.
- Google and GitHub act as sign-in providers under their own privacy policies. GitHub also hosts the app downloads and the source code.
- Microsoft, when you install the app from the Microsoft Store, under Microsoft's privacy statement.
Ludo Technologies is in Japan and the servers are in Tokyo, but several of these providers are based in the United States and operate worldwide, so your data may be processed outside your own country, under each provider's terms and the laws that apply to it.
How long we keep things
- Account and organization data: until the account or the organization is deleted.
- Sign-in sessions: a refresh token is valid for 30 days and replaced on each use. Email sign-in codes expire after 10 minutes, and the one-time codes that hand a web sign-in to the desktop app are used once.
- Invites: they expire after 7 days unless used or revoked; a used invite is kept as the record of who joined.
- Update, download, website, and guest statistics: deleted after 90 days.
- Backups of the sign-in database: 7 days.
- Server logs: a limited time.
Deleting your data
Administrators can remove members and revoke invites in the app, and chat messages can be removed there too. To delete your account, your organization, or anything else, email us at the address below; we will delete it and confirm.
Security
All connections use TLS. Session and invite secrets are stored hashed. Calls are encrypted end to end between participants. The source code is public, so anyone can check these claims; see SECURITY.md to report a vulnerability.
Children
Hiroba is a workplace tool and is not intended for children under 16. We do not knowingly collect their data.
Your rights
You can ask us what we hold about you, have it corrected or deleted, or object to a use of it. Under Japan's Act on the Protection of Personal Information, and where the GDPR, the UK GDPR, or similar laws apply to you, you may have further rights, including data portability and the right to complain to a supervisory authority. Email us and we will respond without undue delay.
Changes
We will post changes here with a new date. Changes that matter to you, such as a new category of data or a new processor, will also be announced on this website and in the app's release notes.
Contact
Ludo Technologies LLC (合同会社Ludo Technologies) Representative: Daisuke Yoda Kanagawa, Japan. The registered address is available on request. Email: [email protected]