Google Sign-In data

When you choose Google Sign-In, Google makes a stable Google account identifier, your verified email address, and basic profile information such as your name available to HCO Net under the openid, email, and profile scopes.

HCO Net uses this information only to authenticate you, create an account or explicitly link a Google security method, fill its initial display name, and protect the sign-in flow. Matching email addresses do not automatically link accounts; the Google email label is separate from any mailbox method you enroll and verify. It is not used for advertising or user profiling.

HCO Net never receives or stores your Google password. Google authorization codes and ID, access, or refresh tokens are used only to complete the current sign-in and are not persisted by HCO Net.

When the HCO Net App completes browser sign-in, its callback carries only a random two-minute handoff code. HCO Net stores only the code hash, consumes it once over HTTPS, and never puts a Google token or HCO Net Session token in the callback URL.

Sign in with Apple data

When you choose Sign in with Apple, Apple supplies HCO Net with a stable Apple account identifier, an Apple-verified email label, whether that label is a private relay address, and your name only on the first authorization if you choose to share it.

The Apple identifier is an internal authentication identity and is never returned by HCO Net's public profile or security-method APIs. Public account settings show only the email label and private-relay indicator. Authorization codes, identity tokens, nonces, callback state, and challenge hashes are short-lived verification material and are not retained as profile data.

A returning Apple identifier always signs in to its linked active account. If a new Apple identifier's verified address exactly matches an existing, already verified formal HCO Net email method, HCO Net associates Apple with that active account and signs it in; unverified email claims and matching Google or Apple display labels alone do not link accounts. If neither identifier nor formal email has an owner, HCO Net creates a separate account and records Apple's verified address as a verified HCO Net email method, including a private relay address when you choose one. HCO Net never moves an Apple identifier between accounts or replaces another Apple method, and first-login name data never overwrites an existing Profile.

Information HCO Net processes or stores

• Account information you provide, such as email, username, display name, full name, optional phone number, avatar, and language preference.
• A stable Google account identifier, verified email, name used at account creation, and the time of the most recent Google login when you use Google Sign-In.
• A stable Apple account identifier, verified email address and email method, private-relay indicator, first-authorization name when supplied, and the time of the most recent Apple verification when you use Sign in with Apple.
• Drive file and folder metadata on HCO Net servers, plus the file content you upload to HCO Net's private Backblaze B2 storage.
• Study content, support messages, and other content you intentionally submit.
• Chat friend requests, group and Beside-conversation membership, message content, sender public identifier, read position, and message timestamps.
• Beside relationship and membership information, including pairing-invite lifecycle, relationship status, sharing choices, and related entitlement or transaction records.
• Beside device and presence information you choose to share, which can include device type and name, battery and charging state, a supported signal level, current app and elapsed use reported through a user-configured automation, precise phone location, and observation timestamps.
• Session, request, IP, device, quota, and security-event information needed to operate the service, enforce limits, diagnose failures, and prevent abuse.

Beside mobile app and partner sharing

You can explore Beside as a guest without signing in; guest mode makes no authenticated request and does not collect partner presence or personal history. After you sign in and pair with another HCO Net user, device presence, phone location, battery, charging state, and current-app sharing remain off until you enable each category separately.

When phone-location sharing is enabled, Beside can continue collecting precise location while you leave the app or lock the screen so the paired partner receives updates. Android shows a persistent location-sharing notification, and iOS shows the system background-location indicator when applicable. Beside does not use this information for advertising or tracking.

Current device state is available only to the active paired partner and is not made public. Active VIP membership may retain and expose shared phone-location samples for up to 30 days. Unpairing or account deletion ends the active relationship and purges its current device snapshots, location history, sharing policies, watch leases, and scoped current-app reporter credentials. Limited relationship, membership, payment, security, and legal audit records may be retained as reasonably required.

Passwords and verification secrets

HCO Net never stores plaintext passwords. If you create an HCO Net password, only a salted one-way password hash is stored. Email verification codes, password-reset tokens, OAuth state, and session credentials are also stored as hashes or short-lived protected values where the service design permits. HCO Net cannot retrieve your original password from its database.

How information is used

• Create, authenticate, maintain, and secure your account.
• Provide Drive, Study, Chat, sharing, profile, email-verification, password-reset, and support features.
• Provide Beside pairing, membership, owner-selected device and location sharing, and the paired-partner dashboard.
• Measure storage and download usage, enforce account and platform limits, investigate failures, and prevent fraud or abuse.
• Comply with applicable law and protect users, HCO Net, and the public.

Service providers and disclosure

HCO Net does not sell or rent personal information and does not share it with third-party advertisers or data brokers.

Information is disclosed only as needed to operate HCO Net: Google and Apple process the sign-in you request; Backblaze B2 stores Drive file content; Apple also supplies the iOS MapKit map service; and email, hosting, database, and network providers process the minimum information needed to deliver those services. HCO Net may also disclose information when legally required or when you explicitly send content to Chat members or share Beside data with your paired partner.

When you authorize the HyChat OpenAI plugin, OpenAI can read conversations and attachments you can access and send messages on your behalf within the granted scopes. HCO Net issues separate revocable credentials, keeps only credential hashes, and records the plugin source of each sent message even when its optional agent label is hidden. You can revoke future access in account security settings; revocation does not recall content already delivered to OpenAI or chat recipients.

Private Drive transfers use authenticated or time-limited access. A service provider's own processing is governed by its terms and privacy notice.

Cookies and browser storage

HCO Net uses essential HttpOnly session Cookies to keep you signed in and short-lived HttpOnly binding Cookies to secure Google and Apple OAuth callbacks. Product JavaScript cannot read these credentials. Browser storage may hold non-secret interface preferences and temporary signup, reset, or proof state; HCO Net does not put provider tokens or the active Web Session token in readable browser storage.

Retention, access, correction, and deletion

HCO Net keeps account and content data while your account is active and for only as long as reasonably needed to provide the service, enforce security, resolve disputes, or meet legal obligations. Expired verification and OAuth challenges are not valid credentials. Deleted data may remain in restricted backups until normal backup rotation completes.

You can update profile information, remove Drive content, revoke HCO Net in your Google Account, or delete your HCO Net account through Account settings. Depending on applicable law, you may also request access, correction, export, restriction, or deletion by contacting HCO Net.

Security

HCO Net uses transport encryption in production, access controls, hashed credentials, short-lived signed storage access, and other safeguards appropriate to the service. No Internet service can guarantee absolute security, so report suspected account compromise promptly.

Contact and policy changes

Questions, privacy requests, or security concerns can be sent to admin@hconet.com. Material changes will be reflected on this page by updating the effective date and, when required, by providing additional notice.