Privacy

Last updated 2026-11-11.

1. Who is responsible

The operator named in the imprint is the controller for hiza, and also runs Coredo Account and Crate. Questions about your data: see contact.

2. What hiza keeps, and why

Your account. When you sign in with your Coredo Account, hiza receives your account id, email address, name, username and photo, and keeps them in step with Coredo Account. Your email is never shown to anyone. Your privacy settings, contacts and blocks. To provide the service you signed up for (Art. 6(1)(b) GDPR).

Your devices. One record for each device you sign in on: its browser and system, when it was last used and when its session ends; and, if you turn on notifications, the address your browser's push service gave it. To keep you signed in, show you your devices and let you sign them out (Art. 6(1)(b)).

Messages. Chats in hiza are cloud chats: stored on our servers so that all your devices stay in step. They are not end-to-end encrypted. Messages, reactions, drafts and what you have read are kept until they are deleted. Photos, videos and files are stored encrypted, each with its own key; deleting one destroys its key. A short log of changes, for your devices to catch up, is kept for 30 days. Your browser keeps a copy of your chats for speed, removed when you sign out (Art. 6(1)(b)).

Private chats. If you set up private chats, they are end-to-end encrypted: we store and pass on only data we cannot read. We keep your devices' public keys, your identity key sealed with your recovery code, and an encrypted copy of your private chats' history that only your recovery code opens. We still see who is in each private chat, a private group's name, and when messages are sent. On the web your browser runs the code our site serves, so a private chat there relies on that code being honest. To deliver your private chats to your devices (Art. 6(1)(b)). Deleting a private chat, starting over or deleting your account deletes these.

Reports. When you report something, we keep your report and what you reported, as you saw it. When someone reports you, we keep that report and our decision. A notice from the report page keeps the name and email the sender gave. To keep hiza safe and to meet the Digital Services Act (Art. 6(1)(c) and (f)). Kept 12 months after the decision.

Security. To stop abuse, we count requests per account and, for sign-in and the report page, per network address. We store only a keyed hash of the address, never the address itself, and only for as long as the limit lasts. Server logs carry ids, never message content, names or email addresses, and are kept 14 days (Art. 6(1)(f): our interest in a secure service).

In an organization (Business). When you work in an organization on hiza, its conversations, internal notes and the record of who handles what belong to that organization: it is their controller, and hiza processes them for it under a data processing agreement. They are not part of your own download, and when you leave or are removed you lose access at once; your messages there stay, shown as from a former agent. The organization decides how long they are kept.

Chatting on a website. When you use the chat on an organization's website, the organization is responsible for your conversation and hiza processes it for them. Hiza keeps a random key in the chat (in your browser, for that website only), what you write and send, a name or an email address if you give one, and, if the website signs you in, the id, email and name it sends. Your details are deleted 90 days after your last visit; the organization keeps the conversation as long as it decides. Ask the organization to see or delete your data.

Apps an organization uses. An organization can connect its own software to hiza, such as a client portal. Such an app can start a conversation and add you to it by your Coredo Account; you then see it in your chats with the organization's name, and you can leave it. If you have no hiza account yet, hiza keeps your Coredo Account id (and the email address the organization gave, to send you one invitation) until you sign in, at most 90 days. The organization is responsible for these conversations and what its apps receive: ids of what happened, and the text of messages only in the conversations the app started. If you let an app act for you, it can do only what you allowed, and you end that in Settings → Connected apps.

3. Who else is involved

Hetzner Online GmbH hosts hiza in Germany: servers, storage and backups, under a data processing agreement. Coredo Account and Crate are run by the same operator. If you turn on notifications, your browser's push service (Google, Apple, Mozilla or Microsoft, chosen by your browser) carries them; it sees that a notification is sent to your device, never its text, which is encrypted for your browser. Some of these services are outside the EU; transfers rely on the EU–US Data Privacy Framework or standard contractual clauses. We do not sell your data, show ads or use your messages to train anything.

4. How long

Until you delete it, or your account. Device records go 30 days after their session ends. Database backups are encrypted before they are stored, kept 14 days on our storage and 30 days in a second location; photos and files are not copied there. So something deleted from hiza is gone from every backup within 45 days.

5. Deleting your account

In Settings you can delete your hiza account, or your whole Coredo Account, which deletes your hiza account too. Your profile, devices, contacts, Saved messages, reactions, drafts and the files you never sent go at once. Messages you sent stay in the other person's chat, shown as from a deleted account. Reports and decisions stay for 12 months as said above.

6. Your rights

You can see and download your data at any time (Settings → Your data: everything, files included), correct your profile in Coredo Account, have your data deleted, restrict or object to processing based on our legitimate interest, and take your data elsewhere (the download is machine-readable). You can complain to a data protection authority, for example where you live.

7. Age

Hiza is for people aged 16 and over.

8. Changes

We tell you in hiza before this policy changes in a way that matters to you.