Privacy Policy

The Short Version

Hugo runs the AI model on your phone. Your tasks, chats, notes, and documents are stored on your phone. Static Hum Studio never receives any of that content, because there is no Hugo server to receive it.

During first-run model setup, Hugo requests a small public model catalog from models.statichum.studio. Choosing one of those models also downloads its file from the address in that catalog. Cloudflare serves both requests and receives the ordinary network details needed to do that, including the request IP, time, path, and headers. Hugo sends no account, device identifier, tasks, chats, notes, or documents with either request.

You can import a compatible model file later in Settings, but opening first-run model setup still requests the catalog. Once setup is finished, using the local model for chats and tasks does not contact Static Hum Studio.

We do not collect analytics. We do not run crash reporting. There are no ads and no tracking libraries we added. One exception we did not choose and cannot switch off: the text-recognition component Hugo uses to read documents reports diagnostics to Google. It sends nothing of what it read. There is a section on it below.

Hugo can reach the internet, but the skills that do are switches you turn on yourself, and those ship off. The exceptions are the voice and setup paths, and each heading below says exactly when its path applies.

What Hugo Stores on Your Device

In a private database only Hugo can read:

• Tasks, due dates, reminders, and completion history
• Chat sessions and every message in them, including images you attached
• Documents you imported, the text extracted from them, and the search index built over that text
• Research runs and their results

As plain markdown files in Hugo’s own folder on your device’s storage:

• Notes and markdown documents you or Hugo wrote
• Links you shared into Hugo, and whatever text was read for them

These are deliberately plain files, so your notes are yours to copy off the phone. On Android 10 and newer, other apps cannot read them. On Android 8 and 9, an app with storage permission may be able to read them. You will also see the files if you browse your phone over USB. They are removed when you clear Hugo’s data or uninstall it.

In Hugo’s private file storage, which no other app can read:

• The AI model files you downloaded
• A copy of every image you attached to a chat, kept as long as the message is

In temporary storage your phone can clear on its own:

• Photos taken with the in-app camera, until you attach one
• Staging files while a document is being imported, or while an image is on its way out to another app

In app preferences:

• Your display name, theme, and which model you are using
• Model tuning settings, whether voice is on, and which skills you turned on
• Any custom personalities you wrote, and whether that feature is unlocked

Encrypted with AES-256, in Android’s hardware-backed keystore:

• The API key you entered for image generation

All of this stays on the device. None of it is transmitted to Static Hum Studio.

Android’s automatic cloud backup is turned off for Hugo, deliberately. Your conversations and tasks are not copied to Google Drive. The trade-off is real and worth stating: if you factory-reset your phone, that data does not come with you.

Android’s phone-to-phone transfer, the one that runs when you set up a new device from your old one, is a separate mechanism, and turning off cloud backup does not turn it off. Hugo opts every one of its storage areas out of it explicitly. Nothing rides across. That is the same trade as above, doubled down: a new phone starts empty, and the way to carry your work over is to export it yourself.

Where Data Can Leave Your Phone

This is the whole list. Rather than summarise which of these are off by default, which has been wrong here more than once, every heading below states its own condition: off until you turn it on, on by default, or no switch at all.

Text Recognition (off until you turn it on)

Some PDFs are pictures of pages rather than text ... a scan. To read one, Hugo uses Google’s ML Kit. The recognition itself runs on your phone. The models ship inside the app, and your pages and the text found in them are never uploaded.

What we did not choose: as that component starts up, it reports diagnostics to Google. Your device make, model and Android version, Hugo’s package name and version, an identifier tied to this installation, timings, and error codes. Not your images. Not the text it read. Google publishes the full list, and there is no setting of theirs that turns it off.

So we did the only thing left to us: we made sure it never starts. Reading scanned PDFs is a setting, it ships off, and while it is off the component is never created ... which is the moment the reporting would happen. Nothing is sent, because nothing is running. Turn it on and you get scanned pages read, and Google gets the list above. The setting says so on the screen, whether it is on or off, so you can read the trade before you make it rather than after.

Left off, a scanned page is simply skipped, and Hugo tells you which pages he could not read rather than quietly indexing half a document.

We are telling you at this length because an app that claims to tell you where your data goes does not get to leave out the part that surprised us. This was the one path that reported on Hugo himself rather than carrying something you asked him to carry, and it is now the one path we closed by default instead of only disclosing.

Unencrypted Connections

Hugo permits plain http connections. This is a deliberate choice, and it applies to one thing: reading a link you hand it. There are two ways to do that and they behave differently, so both are worth stating.

Ask Hugo to read a link, or share one into it, and Hugo tries https first, falling back to plain http only when the secure version is actually unreachable. Most http links end up encrypted that way. Add a URL through Sources with an explicit http:// address, though, and Hugo fetches exactly that ... no upgrade attempt, so it is unencrypted.

What this means for you: an unencrypted fetch crosses the internet in the open, and anyone in between can see which page was requested. It is the same exposure your browser has visiting the same link. Nothing of yours is sent along with the request.

What Hugo Does Not Do

• No analytics or usage tracking that we added, and none we receive. See Text Recognition below for the one component that reports to Google
• No crash reporting
• No advertising frameworks or third-party tracking SDKs
• No location data, no contacts, no advertising identifier
• No account. Hugo has no sign-up, no login, and no profile
• No data sent to Static Hum Studio. There is no Hugo server to send it to
• No training. Nothing you say to Hugo is used to train any model by us

Document text recognition and the AI model both run on your phone. Neither one needs a network connection.

Permissions Hugo Asks For

• Notifications: to show reminders. Without it, reminders fire silently and you will miss them
• Alarms and reminders: so a reminder set for 3:00 arrives at 3:00 rather than whenever the system feels like it
• Microphone: only while you are talking to Hugo
• Camera: only when you take a photo to show him
• Start on boot: to re-register your reminders after a restart, so they survive one
• Internet: for the paths listed above, and nothing else

Your Control

• The skills that reach the network are switches in Settings or Skills, and they ship off. Turning one off stops that path immediately. The voice and setup paths differ, and each heading above says how
• Delete any task, chat, note, or imported document from inside the app
• Remove an API key at any time in Settings
• Avoid voice input when you do not want your phone’s speech service to receive audio
• Clear the app’s data or uninstall it to remove everything Hugo owns. See below for the network request caveat

Children’s Privacy

Hugo is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13.

To be exact rather than reassuring: we run no account system and receive no app content from anyone, of any age. Model setup does make standard web requests that disclose the request IP and request metadata to Cloudflare, without a name, account, or anything from inside Hugo. If you believe a child under 13 has provided personal information through the app, contact us at Static@StaticHum.Studio and we will take appropriate steps.

Third Parties

Each one’s own privacy policy governs what it does with what it receives. Some are reached only when you turn a feature on; others apply by default or have no switch at all. Each entry below says which it is, so you do not have to hold a list in your head. Sites you hand Hugo a link to, and hosts an image in a reply points at, are not on this list at all ... those are whatever address was involved, and both are covered above.

Contact

• Static@StaticHum.Studio
• github.com/StaticHumStudio

Changes to This Policy

If this policy is updated, the revised version will be posted here with a new effective date. That is the only place it will be announced.