What Hebb keeps, and what it doesn’t

Who we are

Hebb is an independent project. “We” on this page means the people who build and run it. The hosted service is at hebb-site.pages.dev, and this policy covers it: the website, the dashboard, the API, the connector that Claude, ChatGPT, Gemini and other apps sign in to, and the Claude Code hooks.

What we collect

Your account

Your email address and password, when you create an account. The password is stored only as a hash by our database provider’s sign-in service. We use the email address to identify your account and to reply when you write to us. We don’t send marketing email.

Your memories

The facts you or your assistant save. Each one is a short name and a value, with when it was saved and how many times it has been revised. Memories you share with a team also record who shared them. This is the product, so it is kept until you delete it.

Through the memory tools, in Claude, ChatGPT, Gemini, Cursor or any other app, nothing is saved unless the assistant calls remember, share or never_run. There is no background capture and no conversation upload.

What the Claude Code hooks send

The hooks are the one part of Hebb that learns without being asked, from shell commands that fail. So here is precisely what leaves your computer:

• Lessons, not logs. When a command fails and a different one then works, the hooks save one short lesson, such as “pnpm is not installed on your computer’s name, use npx pnpm instead”. A lesson can contain the two commands, cut to 160 characters each, and your computer’s name.
• Never anything that looks like a secret. A command that looks like it contains a password, key or token is never saved.
• Not your prompts. To tell Claude what it already knows, the hooks download your saved memories and match them against your prompt on your own computer. Your prompts and commands are not sent to Hebb for this, and neither is the check against commands you have banned.
• Kept on your computer. A failed command waits in ~/.hebb/state for a few minutes so it can be paired with a fix, and is only uploaded if it becomes a lesson. Your key is kept in ~/.hebb/key, readable only by you.

Every lesson is announced in your session as it is learned, and you can delete it like any other memory.

Keys, connected apps and usage

API keys are stored only as a hash, with their first few characters so you can tell them apart. When you connect an app such as Claude or ChatGPT, we record the app’s name and the address it asked to be sent back to, and create a key for it named after the app. We count requests and saves each month for your plan’s limits, and record when each key was last used.

Technical data

We don’t store IP addresses or browser details in our database. Cloudflare, which serves the website and the API, processes them to deliver each request, under its own privacy policy. We don’t use analytics, advertising or tracking cookies. The dashboard keeps you signed in using your browser’s own storage: for that tab only, unless you choose to stay signed in on the device.

How we use it

Only to run Hebb: to store your memories, return them to the apps you connect, enforce the rules you set, keep to your plan’s limits, keep the service secure, and answer you when you write to us. We don’t sell your data, we don’t share it with advertisers, and we don’t use your memories to train AI models.

Who else handles it

• Supabase hosts our database and sign-in.
• Cloudflare hosts the website and the API.
• The AI apps you connect, such as Claude, ChatGPT and Gemini, receive the memories they save and look up, as part of your conversation with them. What they do with your conversations is covered by their own privacy policies.
• Your team, if you join one, sees the memories you choose to share with it and who shared them. Nothing is shared with a team automatically.

We would give your data to anyone else only if the law required it.

How long we keep it

• Memories: until you delete them or your account.
• Keys: a revoked key stops working at once. The record that it existed stays with your account so the dashboard can show it.
• Sign-in steps: the one-time codes used while an app connects expire within minutes and are then deleted. An app registration nobody ever signs in through is deleted after a week.
• Usage counts: kept by month with your account.
• Backups: deleted data can remain in our database provider’s backups for a limited time before they are overwritten.

Your choices

• See everything: the dashboard lists every memory your account holds.
• Delete a memory: ask your assistant to forget it, or delete it in the dashboard. You get a receipt confirming it is gone.
• Disconnect an app: revoke its key in the dashboard. Keys made by connecting are named after the app.
• Stop the hooks: remove them from Claude Code. Setting HEBB_NO_REWRITE=1 keeps the memory but stops commands being corrected.
• Delete your account: email us from the address on the account, and we delete the account and everything in it within 30 days.

Security

Everything travels over HTTPS. Keys and one-time sign-in codes are stored only as hashes. Apps connect with OAuth, so they never see your password. The database can only be reached by the Hebb service itself. No system is perfectly secure, and if something goes wrong we will tell the people affected.

Children

Hebb is a tool for developers and isn’t directed at children under 13. We don’t knowingly collect their data. If you think we have, email us and we will delete it.

Changes

If this policy changes, this page and the date at the top change with it. If a change affects how data you have already given us is used, we will say so on the site before it takes effect.

Contact

neilgilani@gmail.com