Privacy Policy
Human.01 VM gives you a small computer in the cloud with an AI agent, from your browser or over SSH, without an account. This policy says what we collect while you use it, why, how long we keep it, and what you can do about it. We keep it short and literal: if something is not listed here, we do not collect it.
1. Who we are
The service is run by Human.01 ("we"), reachable at vm@human01.xyz. The computers that run your box and the AI models are our own servers; the public website is served through Cloudflare.
2. What we collect, and why
| Data | When | Why |
|---|---|---|
| A random identifier your browser keeps (we store only its hash), or the fingerprint of the SSH public key you connect with | Every connection | To give the same browser or key the same box. It is the only "login" a free box has. |
| Your IP address, the time of the connection, and the language your browser asks for | Every connection | To limit how many boxes one connection can create, to stop abuse, and to show the site in your language. The country of your IP is looked up on our own server (DB-IP database); the IP is not sent to anyone for that. |
| Your email address | Only if you claim a box | To send the one-time confirmation link and to know which box is yours. It is not used for marketing. |
| Files, code and settings inside your box | While your box exists | That is your computer. We do not read it except to operate the service (for example when something breaks) or when the law requires it. |
| Requests to the AI (your prompts, the files the agent reads, the model's answers), with token counts and timings | When you or the agent use Human.01 AI | To run the models and to show you your usage. Requests and answers are logged on our own servers for operating and improving the service (see section 5). They are not used to train models. |
| Your voice, when you press the microphone to dictate | Only while you hold or press the mic (at most a minute at a time) | To turn what you said into text, which appears in the box for you to edit before sending. The recording goes from your browser to our own servers only, is turned into text by our own speech model and is not stored, logged or sent to anyone else. Its length is counted in your AI usage. |
| Images, video or 3D you ask the AI to generate, and the prompt | When you use those tools | To make them and to apply the daily limits. |
| An invite code, the rewards you earned, which platforms you told us you shared on, and the IP at that time | Only if you use the rewards page | To credit tokens and to stop the same reward being claimed twice. |
| A wallet address | Only if you connect a wallet | To let you sign in to your profile with it. We never ask for, see or move any funds. The signed message proves you hold the address and nothing else. |
| Your Google account email | Only if you sign in with Google (when offered) | To match you to the box you claimed. We ask Google for your email only, nothing else. |
| Service events: a box was created, claimed, stopped, deleted; an AI call was refused; an error happened | As they happen | To keep the service running and to find abuse. Events carry the box id and the IP, not the content of what you did. |
3. What your box can reach, and who else sees data
- Messaging accounts. If you let the Bot answer WhatsApp, Telegram, LINE, Messenger or WeChat, those apps run inside your box and sign in there. Your conversations stay in your box; we do not copy them out. The AI agent inside the box sees the messages it is asked to answer, which means they are sent to the AI models you chose.
- GitHub. If you connect GitHub, the sign-in happens between your box and GitHub, and the token lives in your box for
gitandghto use. On a claimed box we also keep that token, encrypted, on our servers, so your other boxes and any new box of yours are connected without signing in again; pressing Disconnect GitHub in any box removes it. On an unclaimed box the token stays in that box only. Auto-save sends your project to a private repository on your GitHub. - Free third-party models. Besides Human.01 AI on our GPUs, the agent can use free models from OpenCode, Kilo Code and OVHcloud. When you pick one of those, your prompt goes to that provider under its own privacy terms. The default, Human.01 AI, stays on our servers.
- Providers we use to run the service. Cloudflare (website delivery, the "are you human" check when you launch your first box), Resend (sending the claim email), DigitalOcean (the public front server), Google Fonts (the website typeface), and, if you choose them, GitHub, Google and the third-party model providers above. Each sees only what it needs for its job.
We do not sell data, do not show advertising, and do not use analytics trackers on the site.
4. Cookies and storage in your browser
- A random identifier in your browser's local storage, which is how your browser finds its box again. Clearing it means that browser can no longer reach that box.
h01_ref: the invite code you arrived with, kept for 30 days, so your friend can be credited.h01s: your profile sign-in session, kept for 30 days, only if you sign in to the profile.- Your language choice, if you pick one.
Cloudflare may set its own technical cookie for the human check. There are no advertising or tracking cookies.
5. How long we keep things
- Unclaimed free boxes run for 60 minutes and are deleted 24 hours after that, with everything inside.
- Claimed boxes sleep after 24 hours without a login and are deleted after 7 days without a login (paid plans differ, as their terms say). You can delete a box yourself at any time (
ssh vm.human01.xyz destroy --yes). - Box contents are not backed up by us. If you want to keep your work, turn on auto-save to GitHub or download your files.
- AI request logs are kept for up to 30 days, then deleted.
- Service events and connection logs are kept for up to 90 days.
- Your email, invite code, rewards ledger and wallet address are kept while you have a claimed box and for 90 days after your last box is deleted, then removed.
6. Your choices
- Use the service without any account: launch a box, work for an hour, let it expire. Nothing identifies you beyond the technical data above.
- Delete your box at any time; everything inside goes with it.
- Disconnect a wallet or sign out on your profile page.
- Ask us at vm@human01.xyz for a copy of the data we hold about you, to correct it, or to delete it. We answer within 30 days. If you are in the EEA or the UK you have the rights the GDPR gives you, including the right to complain to your data protection authority.
7. Security
Each box is its own virtual machine with its own kernel, separated from other boxes and from our servers. Connections are encrypted (HTTPS, SSH). Secrets such as the key the boxes use to reach the AI never leave our servers. No system is perfectly secure; if we learn of a breach that affects you, we tell you at the email you gave us, if any.
8. Children
The service is not meant for children under 16, and we do not knowingly collect their data.
9. Changes
When this policy changes, the date at the top changes and the new text is published here. Material changes are also announced on the landing page.