Effective September 24, 2026. Kuya is published by Hayward Imagination Company LLC (Brandon Hayward, Canton, Michigan). Questions go to privacy@getkuya.com.
The short version
Kuya is an iPhone app for a Hermes Agent server. The app has no accounts and no backend, and we do not receive your messages, attachments, or credentials. Nothing in the app reports to us.
Kuya Cloud is different: it is an optional, invite-only service where Brandon runs a Hermes agent for you on a server he manages. If you use it, the Kuya Cloud section explains exactly what he can and can't see.
The Kuya app
Where your data goes
- Your Hermes server. Messages and attachments you send go to the Hermes server address you enter, or that your pairing code contains. That server forwards them to the model providers and tools configured there. Review those settings before sending anything sensitive.
- Apple. If you use dictation, Apple's speech recognition processes your audio and may send it to Apple. The transcript becomes a draft you review before sending. If you choose "This iPhone" for Improve prompt, Apple Intelligence rewrites the draft on the phone and it never leaves the device. If you choose Hermes for Improve prompt, the draft goes to your server.
- Nowhere else. Kuya has no analytics, no crash reporting service, no advertising, and no tracking. The app's privacy manifest declares no collected data types and no tracking domains. Its App Store privacy label is "Data Not Collected."
What stays on your iPhone
- Saved connections, drafts, attachments, and the transcript cache.
- Connection credentials (access keys and dashboard passwords), stored in the iOS Keychain. Run controls in widgets use a shared Keychain group to reach your server.
- Shared storage in the app group, so the app, its share extension, and its widgets can exchange drafts and widget state.
- Conversation titles and identifiers, handed to iOS for Spotlight, Siri suggestions, and Handoff. Those system features can show that information outside the app.
Provider keys you add in Kuya's model settings are checked with the provider through your Hermes and saved on your Hermes server. Kuya does not keep a copy.
Permissions Kuya asks for
- Camera: to scan a pairing QR code and to take photos you attach.
- Microphone and speech recognition: for dictation.
- Photos: to attach photos you choose, and to save an attachment when you tap Save to Photos.
- Local network: to reach a Hermes server on the same Wi-Fi.
Each one is optional. Declining one turns off that feature only.
Diagnostics
Settings can copy diagnostic information for a problem report. It contains your server address, connection status, app version, and the last four characters of your access key. Nothing is sent until you paste it somewhere yourself, so review it first.
Deleting your data
Delete a connection in Settings to remove its credentials from the Keychain and its cached chats. Deleting the app removes everything else. Your conversations also live on your Hermes server; manage them there.
Kuya Cloud
Kuya Cloud is a small, invite-only test service that Brandon Hayward runs for friends and family. Your agent runs on a server he rents from Hetzner in Germany.
What the admin panel shows
- Your name, your email, and whether your agent is running.
- How much of your monthly AI allowance you've used, in dollars.
- How many messages your agent handled in the last day. That is a count, not the messages.
- How many errors happened, by type, like "Timeout." Never the content that caused them.
- When your agent was last active, and how much server memory it uses.
What it never shows
- Your messages, your agent's replies, attachments, or anything you type.
- Your conversation titles or files.
- Your own API keys, if you add them.
Encryption
Your agent's files (chats, memory, settings, and any keys you add) are encrypted at rest with a key only your phones hold. Kuya creates that key on your iPhone and keeps it in your iCloud Keychain. The server receives it only to open your agent and never writes it to disk.
While your agent is running, the server holds the key in memory, and your files are readable to the running agent so it can work. If the server restarts, your agent stays locked until you next open Kuya.
The demo agent used for App Review is the one exception. It is not encrypted.
To be straight with you
Encryption protects your files on disk and in backups. While your agent is running, someone with full control of the server could technically read them. Brandon has committed not to. The admin panel has no way to show them, and nothing reads them for statistics.
To answer you, your messages are sent to AI model providers through OpenRouter. OpenRouter's privacy policy and the policy of the model provider apply to that. If you switch to your own OpenRouter key, the same is true under your own OpenRouter account.
Your name and email are used to send your invite and, now and then, a note to all Kuya Cloud testers about the service.
Backups and deletion
The server is backed up every night, and each backup is kept for seven days. Backups contain only the encrypted files. Want everything gone? Ask Brandon to remove your agent. Its files are archived on the server for 30 days, then deleted automatically. Copies in the backups roll off within seven days.
This website
getkuya.com sets no cookies and runs no analytics or ads. If you pick light or dark with the theme switch, that choice is saved in your browser's local storage and never leaves your device. Cloudflare hosts the site and processes standard request data, such as your IP address, to serve pages and protect against abuse.
If you ask Kuya Pair to email your setup link, the link and your email address pass through our email provider, Resend, to deliver that one message. We do not store either one. The link carries your Hermes access key, so Kuya Pair only sends it where you ask. Texting the link uses the Messages app on your Mac and does not pass through us at all.
Children, changes, and contact
Kuya is not directed at children under 13.
When this policy changes, we'll update this page and the effective date at the top.
Questions or requests: privacy@getkuya.com.