Privacy Policy

Hugo runs the AI model on your phone. Your tasks, chats, notes, and documents are stored on your phone. Static Hum Studio never receives any of that content, because there is no Hugo server to receive it.

The one time Hugo talks to us at all is downloading the AI model during setup, and even that is optional ... you can supply your own model file instead and Hugo will never contact us. If you do let it download, that is a file download, logged the way any web server logs a request: your IP address, the time, and which file, by us and by Cloudflare, who serve the site. No account and nothing from inside the app, though a download log does record that someone at your address set Hugo up.

We do not collect analytics. We do not run crash reporting. There are no ads and no tracking libraries we added. One exception we did not choose and cannot switch off: the text-recognition component Hugo uses to read documents reports diagnostics to Google. It sends nothing of what it read. There is a section on it below.

Hugo can reach the internet, but the skills that do are switches you turn on yourself, and those ship off. The exceptions are the voice and setup paths, and each heading below says exactly when its path applies.

In a private database only Hugo can read:

• Tasks, due dates, reminders, and completion history
• Chat sessions and every message in them, including images you attached
• Documents you imported, the text extracted from them, and the search index built over that text
• Research runs and their results

As plain markdown files in Hugo’s own folder on your device’s storage:

• Notes and markdown documents you or Hugo wrote
• Links you shared into Hugo, and whatever text was read for them

These are deliberately plain files, so your notes are yours to copy off the phone. Other apps cannot read them without your say-so, but you will see them if you browse your phone’s files over USB. They are removed when you clear Hugo’s data or uninstall it.

In Hugo’s private file storage, which no other app can read:

• The AI model files you downloaded, and the speech models if you set up on-device speech
• A copy of every image you attached to a chat, kept as long as the message is

In temporary storage your phone can clear on its own:

• Photos taken with the in-app camera, until you attach one
• Staging files while a document is being imported, or while an image is on its way out to another app

In app preferences:

• Your display name, theme, and which model you are using
• Model tuning settings, speech backends, and which skills you turned on

Encrypted with AES-256, in Android’s hardware-backed keystore:

• The API key you entered for image generation

All of this stays on the device. None of it is transmitted to Static Hum Studio.

Android’s automatic cloud backup is turned off for Hugo, deliberately. Your conversations and tasks are not copied to Google Drive. The trade-off is real and worth stating: if you factory-reset your phone, that data does not come with you.

Android’s phone-to-phone transfer, the one that runs when you set up a new device from your old one, is a separate mechanism, and turning off cloud backup does not turn it off. Hugo opts every one of its storage areas out of it explicitly. Nothing rides across. That is the same trade as above, doubled down: a new phone starts empty, and the way to carry your work over is to export it yourself.

This is the whole list. Rather than summarise which of these are off by default, which has been wrong here more than once, every heading below states its own condition: off until you turn it on, on by default, or no switch at all.

Some PDFs are pictures of pages rather than text ... a scan. To read one, Hugo uses Google’s ML Kit. The recognition itself is genuinely on your phone: the models ship inside the app, and your pages and the text found in them are never uploaded.

What we did not choose: as that component starts up, it reports diagnostics to Google. Your device make, model and Android version, Hugo’s package name and version, an identifier tied to this installation, timings, and error codes. Not your images. Not the text it read. Google publishes the full list, and there is no setting of theirs that turns it off.

So we did the only thing left to us: we made sure it never starts. Reading scanned PDFs is a setting, it ships off, and while it is off the component is never created ... which is the moment the reporting would happen. Nothing is sent, because nothing is running. Turn it on and you get scanned pages read, and Google gets the list above. The setting says so on the screen, whether it is on or off, so you can read the trade before you make it rather than after.

Left off, a scanned page is simply skipped, and Hugo tells you which pages he could not read rather than quietly indexing half a document.

We are telling you at this length because an app that claims to tell you where your data goes does not get to leave out the part that surprised us. This was the one path that reported on Hugo himself rather than carrying something you asked him to carry, and it is now the one path we closed by default instead of only disclosing.

Hugo permits plain http connections. This is a deliberate choice, and it applies to one thing: reading a link you hand it. There are two ways to do that and they behave differently, so both are worth stating.

Ask Hugo to read a link, or share one into it, and Hugo tries https first, falling back to plain http only when the secure version is genuinely unreachable. Most http links end up encrypted that way. Add a URL through Sources with an explicit http:// address, though, and Hugo fetches exactly that ... no upgrade attempt, so it is unencrypted.

What this means for you: an unencrypted fetch crosses the internet in the open, and anyone in between can see which page was requested. It is the same exposure your browser has visiting the same link. Nothing of yours is sent along with the request.

• No analytics or usage tracking that we added, and none we receive. See Text Recognition below for the one component that reports to Google
• No crash reporting
• No advertising frameworks or third-party tracking SDKs
• No location data, no contacts, no advertising identifier
• No account. Hugo has no sign-up, no login, and no profile
• No data sent to Static Hum Studio. There is no Hugo server to send it to
• No training. Nothing you say to Hugo is used to train any model by us

Document text recognition and the AI model both run on your phone. Neither one needs a network connection.

• Notifications — to show reminders. Without it, reminders fire silently and you will miss them
• Alarms and reminders — so a reminder set for 3:00 arrives at 3:00 rather than whenever the system feels like it
• Microphone — only while you are talking to Hugo
• Camera — only when you take a photo to show him
• Start on boot — to re-register your reminders after a restart, so they survive one
• Internet — for the paths listed above, and nothing else

• The skills that reach the network are switches in Settings or Skills, and they ship off. Turning one off stops that path immediately. The voice and setup paths differ, and each heading above says how
• Delete any task, chat, note, or imported document from inside the app
• Remove an API key at any time in Settings
• Switch speech recognition to whisper.cpp to keep your voice on the phone
• Clear the app’s data or uninstall it to remove everything Hugo owns. See below for the one exception

Hugo is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13.

To be exact rather than reassuring: we run no account system and receive no app content from anyone, of any age. The one thing we do receive is the web-server log line from a model download, which holds an IP address and a timestamp and nothing that identifies who was at the keyboard. If you believe a child under 13 has provided personal information through the app, contact us at [email protected] and we will take steps to remove it.

Each one’s own privacy policy governs what it does with what it receives. Some are reached only when you turn a feature on; others apply by default or have no switch at all. Each entry below says which it is, so you do not have to hold a list in your head. Sites you hand Hugo a link to, and hosts an image in a reply points at, are not on this list at all ... those are whatever address was involved, and both are covered above.

• [email protected]
• github.com/StaticHumStudio

If this policy is updated, the revised version will be posted here with a new effective date. That is the only place it will be announced.