Sourcehut
- The documents do not say whether your data trains AI.
- The documents do not say whether your data is used for ads.
- Data is shared only with the providers who run the service.
- The documents do not say who can read your content.
They collect little, do not sell data, can close you anytime, and keep billing records for years.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Email, username, password, optional public profile, keys, IPs, and the content you upload.
Read the exact line
Privacy policy
“The only data we require of your account is your email address; a username of your choosing, which must be unique among all users; and a password.”
Training
They use it to run the site, bill you if you pay, and watch for unknown account activity.
Read the exact line
Privacy policy
“The purpose of this data collection is to inform both you and SourceHut of any unknown activity on your account.”
Sharing
They say they do not share private data except Stripe for payments and court orders.
Read the exact line
Privacy policy
“Aside from information you choose to make public in the course of your use of SourceHut and information you explicitly choose to share with specific third parties, none of your information is shared with third parties.”
Kept
Activity logs last 30 days; billing records can be kept 7 years after you leave.
Read the exact line
Privacy policy
“We will also retain a copy of your billing records (e.g. invoices) for up to 7 years, even if you delete your account, in compliance with European law.”
Controls
Email support to get a copy of your data or ask them to remove it.
Read the exact line
Privacy policy
“You may submit a request via email to support to request an archive of the information we've collected about you, or to request that we remove any information we've collected about you.”
Fine print
They can shut your account anytime with no notice; paid time is not refunded.
Read the exact line
Terms of service
“Your account may be disabled without notice at any time, temporarily or permanently, for any reason.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Email support for a data archive or deletion
Email support (privacy policy: request via email to support); DPO Drew DeVault drew@ddevault.org
Request an archive of all your content
Email sr.ht-support and allow up to 2 weeks
Delete SSH, PGP, and 2FA keys in account details
Account details page
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They can lock or delete your account whenever they want, without warning and without saying why.
Read the exact line
Terms of service
“Your account may be disabled without notice at any time, temporarily or permanently, for any reason.”
For example, you could lose access to your git repos overnight with no email first.
If you cancel or downgrade mid-term, you do not get money back for unused time.
Read the exact line
Terms of service
“No refunds are given for partial service or when you request your services are downgraded.”
For example, if you pay for a year and quit after a month, they keep the rest.
Deleting your account does not wipe invoices. They keep billing papers for years.
Read the exact line
Privacy policy
“We will also retain a copy of your billing records (e.g. invoices) for up to 7 years, even if you delete your account, in compliance with European law.”
For example, invoices with your name could still sit in their files long after you leave.
They do not promise the service will work, and they try not to pay if it breaks.
Read the exact line
Terms of service
“This software is provided by the copyright holders and contributors "as is" and any express or , including, but not limited to, the of and are disclaimed.”
For example, if a outage wipes a repo, this text says they are not on the hook.
IP and activity logs for 30 days cannot be deleted by you, even from your account page.
Read the exact line
Privacy policy
“You are not able to delete this information. The purpose of this data collection is to inform both you and SourceHut of any unknown activity on your account.”
For example, you cannot erase the record of when you logged in last week.
They only take the rights they need to show and host your stuff, not a forever resale license.
Read the exact line
Terms of service
“You grant SourceHut sufficient rights for the operation of the services in relation to your content, such as the right to display the content on the website.”
For example, they can show your repo on the site, but those rights end when you remove the content.
They say they do not pass private account data to other companies, except what you make public.
Read the exact line
Privacy policy
“Aside from information you choose to make public in the course of your use of SourceHut and information you explicitly choose to share with specific third parties, none of your information is shared with third parties.”
For example, your email is not sold to marketers, though a public bio is visible to anyone.
Other people are not allowed to scrape SourceHut to train AI models.
Read the exact line
Terms of service
“You may not use automated tools to collect SourceHut data for solicitation, profit, or the training of a machine learning model.”
For example, a company cannot legally crawl public tickets to train a coding chatbot.
You must be at least 13, but they only ask you to say so; there is no extra age check described.
Read the exact line
Terms of service
“Accounts are only available to users who are 13 years of age or older, or the minimum age for accessing internet services in their country, whichever is older.”
For example, a 12-year-old could still type that they are 13 and open an account.
If the privacy rules change, they say they will email you at least two weeks ahead.
Read the exact line
Privacy policy
“We may make changes to this document with no less than 2 weeks notice. Notice of these changes will be sent to the email on file for your account.”
For example, they should not silently start sharing more data without an email first.
Words to know
Legal words from the lines above, in plain English.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- as is
- You get the service in whatever state it is in, with no promise that it works or will keep working. For example, if the app deletes your photos by mistake, it is not promising to fix that or pay you back.
- warranty
- A promise that a product will work as described; most apps say they make no such promise at all. For example, if a paid feature never works on your phone, a no-warranty clause says that is your problem.
- model training
- Using your content and conversations as examples to teach an AI system, which can then echo them in future answers. For example, a story you write in a chatbot may be studied by the company to make the next version of the bot.
How we got here · grade C · score 41/100 · 13 of 15 policy answers backed by a verified quote · 3 not stated
What does the app collect beyond what it needs to work?
They need email, username, and password, plus optional public profile fields and keys. They also store IP address and what you did on the site for up to 30 days.
Does it record your voice, face or body, and what happens to that?
The documents do not describe collecting voice, face, or body data.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
Not stated in the documents.
Do they sell or share your data, and can you opt out?
They say they do not share private info except what you make public, Stripe for paid billing, and lawful court orders.
What rights do they take over what you type and what the AI makes?
You grant only the rights needed to run the site, and those rights end when you remove the content. Backups may linger up to six weeks.
How long do they keep your data after you delete it, and can you delete it in the app?
You email support to ask for deletion or an archive. Activity logs cannot be deleted by you. Billing records can last 7 years.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
This is not an AI companion; the documents do not describe a lasting personal memory of you beyond account and logs.
Do they commit to basic security, and have they leaked data?
They describe bcrypt for passwords, EU servers, and encrypted off-site backups in the United States.
Is there a real age gate, and are teens protected?
You must be 13 or the local internet age, whichever is older. No extra age check is described.
Will they tell you when the rules change, and is the policy specific?
They promise two weeks’ email notice before changes, but the policies themselves have no last-updated date in the text.
Can they close your account without warning, and can you get your data out first?
They can disable your account at any time, for any reason, without notice. You can email for an archive of content.
If something goes wrong, who pays?
The service is offered as-is with warranties disclaimed and a broad limit on damages.
Do subscriptions renew on their own, and can you get a refund?
If you allow auto-renew they bill the term; they notify a week ahead if the price changed. No refunds for unused time.
The privacy policy is 1,013 words at a fairly hard level (Flesch reading ease 58.6); the terms are 1,225 words at a fairly hard level.
