Privacy

No accounts, no profiles

Hama is a temporary space for shared text and group chat. There is no sign-up, no email address, and no password for you as a person. One tap on Share Text or Start Chat creates a space and gives you a short link such as hama.top/r/7Kp2mQa, plus a QR code and share sheet.

Inside a space you pick a nickname or receive an automatic one (Guest 1, Guest 2, and so on). That nickname belongs to that space only. It is not linked to you across spaces, it is not used to build a profile, and it is not used for advertising. Hama does not sell data, does not run advertising, and does not operate an advertising or analytics tracking network.

The three access modes

Every space is in exactly one of three modes, and the mode decides what the server can see.

• Public - open and stored in plain text. Public spaces may appear in Hama search, including their content.
• Private + Open - Zero-Knowledge. The encryption key lives in the URL fragment (#k=...), which browsers never send to any server. Anyone with the full link can read the space.
• Private + Password - Zero-Knowledge. The key is derived in your browser from the password using Argon2id. The password never leaves your device.

Turning on a password automatically makes a space Private. There is no combination of public plus password.

What Hama stores

• Space metadata - the short link, access mode, creation time, last activity time, and the size and count of stored objects. For public spaces this also includes the title, description, and tags you enter.
• Content - for private spaces, only ciphertext produced by your browser. For public spaces, the chat messages and shared text as you typed them, in plain text, because a public space is meant to be readable and searchable.
• Presence records - a temporary row per participant containing a random identifier generated for that space, the nickname shown in the space, and a last-seen timestamp. These records exist to show who is currently in the space and to count against the 100-person limit. They disappear when you leave.
• Files - uploaded files are held in object storage. Files in private spaces are encrypted in your browser before upload, and their names are stored encrypted too.
• Support messages - encrypted in your browser with the admin public key. Support is one-way: admins can read what you send, and there is no reply channel inside Hama.
• Operational error logs - sanitized records of technical failures, used to keep the service working. Kept at most 30 days.
• Admin audit logs - a record of administrative actions taken in the admin panel. Kept at most 90 days.
• Daily aggregate counts - numbers such as how many spaces were created or deleted on a given day. These contain no content and no identifiers.

What is never stored or logged

The following never reach Hama servers in a readable form, and are never written to any log:

• Message and shared-text content of private spaces in readable form
• Passwords
• Encryption keys
• URL fragments, including the #k=... key of a Private + Open space
• Creator capabilities (only a hash of the capability is kept)
• Plain-text file names of private spaces
• Authorization headers and cookies
• Raw IP addresses in long-term storage

Deletion

Inactive spaces are permanently deleted every day at 00:00 UTC. A scheduled job removes every space that has no active participants at that moment. A space with someone still in it survives to the next day's run, so the time between a space emptying and its removal is not fixed - it can be seconds, or up to about 24 hours.

The creator can delete a space instantly at any time. That removes everyone from the space and erases its content. In both cases the deletion is permanent:

• Deleted spaces leave Hama search immediately.
• Stored file objects are removed before the database records that point at them.
• The short link stops resolving and its content cannot be restored.

The Conversations list in your browser

Your device keeps a local list of spaces you have opened, stored in the browser's IndexedDB. It exists so you can find a space again on the same device. It never syncs to a server, and Hama has no copy of it. Clearing site data for hama.top in your browser removes it.

Cookies

Hama sets no advertising cookies and no analytics cookies. Only storage that is strictly required for the service to function is used, such as remembering your theme choice. Administrator sign-in creates a session that applies to the admin panel only; it has nothing to do with visiting or using a space.

Service providers

Hama runs on infrastructure operated by other companies, which act only as processors on Hama's behalf and are not permitted to use the data for their own purposes:

• Vercel - hosting and delivery of the web application.
• Supabase - database, file storage, and realtime sync.
• Error monitoring - optional, with content, keys, headers, and URL fragments scrubbed before anything is sent.

Because private content is encrypted in your browser, these providers store ciphertext for private spaces, exactly as Hama does.

Children

Hama is not directed at children under 13 and is not intended for their use. Hama does not knowingly collect information from children under 13. Because there are no accounts, Hama cannot verify anyone's age.

Your rights, and their real limits

Since there are no accounts, Hama usually cannot tell which data belongs to which person. A nickname is temporary and unverified, and private content is unreadable to the server. That means a request to identify, export, or delete "your" data generally cannot be matched to anything specific.

The practical controls available to you are:

• Delete the space yourself if you created it - this is instant and permanent.
• Leave the space and let the daily 00:00 UTC purge remove it once it is empty.
• Delete your own messages inside a chat.
• Clear site data in your browser to remove the local Conversations list.

Once content is deleted, or a private password is lost, it cannot be recovered by you, by another participant, or by Hama.

Limits worth knowing

• Up to 100 people can be in one space at the same time.
• Maximum file size is 49 MB.
• Voice messages can be up to 10 minutes long.
• File names and voice messages are never indexed by search.

Contact

Questions about this policy can be sent through the support page. The message is encrypted in your browser with the admin public key before it is sent. Support is one-way, so include any address you want a reply sent to - there is no reply channel inside Hama.