krz/krz.sh

 1+++
 2title = "Hutch — Privacy Policy"
 3description = "Privacy policy for Hutch, the Sourcehut client for iOS."
 4weight = 1
 5+++
 6
 7_last updated: 2 august 2026_
 8
 9Hutch is a native iOS client for [Sourcehut](https://sr.ht). it talks to
10Sourcehut directly from your device. we have no user accounts, and we never
11receive your Sourcehut credentials. the one exception — a small first-party
12service used to draw contribution graphs — is described below.
13
14## what we collect
15
16we have no krz account system, no analytics, no ads, and no
17third-party trackers or SDKs. the only data that ever reaches a server we
18operate is described under "the Hutch Stats service" below, and it is limited
19to the public Sourcehut usernames you ask to see contribution graphs for.
20
21## what stays on your device
22
23your Sourcehut personal access token is stored in the iOS Keychain on your
24device. cached repositories, tickets, and activity are stored locally so the
25app stays fast and works offline. deleting the app removes all of it.
26
27## network connections
28
29most of Hutch connects only to the Sourcehut instance you point it at — sr.ht
30by default, or a self-hosted instance you configure. those requests carry your
31access token, go straight to that server, and are governed by its own terms and
32privacy policy. we are not a party to that traffic and never see it.
33
34## the Hutch Stats service
35
36to render contribution graphs (the calendar-style activity charts on user
37profiles), Hutch asks a small first-party service, `hutch-stats.krz.sh`, for a
38person's public Sourcehut activity. this happens when you open a profile,
39including your own.
40
41each request sends the public Sourcehut **username** you are viewing and a date
42range. it does **not** send your access token or any Sourcehut credentials; the
43only header is a generic `Hutch/<version>` user-agent that contains no device or
44account identifiers. as with any web request, the service also sees the network
45(IP) address it came from. we use this data only to answer the request and do
46not build profiles from it or share it.
47
48if you would rather not use this service, contribution graphs are the only
49feature that depends on it. advanced users and self-hosters can point Hutch at a
50different stats endpoint via the `HUTCH_STATS_BASE_URL` setting.
51
52## changes
53
54if this policy changes, the updated version will be posted here with a new date.
55
56## contact
57
58questions: [root@krz.sh](mailto:root@krz.sh).