Legal

Effective Dates

EULA

2026-07-08

Privacy

2026-06-16

View archive

End User License Agreement (EULA)

1. License Grant

HakoSpace grants you a limited, non-exclusive, non-transferable, and revocable license to install and use this software solely for your own purposes, subject to the terms of this Agreement. No other rights are granted.

1.1 Version of This Agreement and Re-Consent

This End-User Licence Agreement is identified by its effective date, shown at the top of the document (current version: EULA effective 2026-07-08). The Privacy Policy is versioned independently, likewise by effective date. HakoSpace may update either document from time to time; a material change will trigger a new effective date.

Your acknowledged version is recorded on your account. When you first connect to a HakoSpace server instance, and whenever the instance's current EULA or Privacy Policy effective date exceeds the effective date last acknowledged by you, the software will require you to review and accept the current version before it permits further use of the service. This check is performed on the server at connection time and cannot be dismissed by the client.

If you decline to accept the current version, the server will refuse to grant you access. You may continue using any server whose published EULA and Privacy Policy effective dates match the versions you have previously accepted.

Historical versions of this Agreement are available at the operator's legal archive URL (typically /legal/archive/<YYYY-MM-DD>/eula). Each time you accept a version, the software stores your account identifier, the effective-date string, and a UTC timestamp as evidence of acceptance.

Nothing in this section grants HakoSpace a unilateral right to impose materially burdensome terms retroactively; your right not to accept (and to cease using the service) is preserved.

2. Permitted Use

This software may be used under the following conditions:

Academic use: Research, study, or educational purposes at accredited institutions.
Personal non-commercial use: Individual or community use. You may accept voluntary donations (e.g., Patreon, Ko-fi) solely to cover the infrastructure and hosting costs of running the software. However, you may not charge mandatory access fees, put the software behind a paywall, or use it to generate profit.
Qualifying non-profits: Organizations holding valid non-profit status, provided the software is not used to generate revenue or provide paid services.

Government agencies at any level are excluded from permitted use and may not use this software without a separate written agreement with HakoSpace.

3. Prohibited Activities

The following are strictly prohibited:

Reverse engineering, decompiling, disassembling, or otherwise attempting to derive the source code of the software.
Extracting, reconstructing, or inferring any portion of the software's source code, algorithms, or internal logic.
Removing, altering, bypassing, or circumventing any license verification mechanism, copyright notice, or protection feature embedded in the software.
Redistributing, reselling, renting, leasing, or sublicensing the software to any third party.
Repackaging or rebranding the software for distribution under any name or as part of any other product.
Using the software to provide commercial hosting, SaaS, or managed services to third parties.

The prohibitions in this Section 3 are subject to Section 14 (Third-Party Open-Source Components).

4. Intellectual Property

All rights, title, and interest in and to the software, including all intellectual property rights, remain exclusively with HakoSpace. This Agreement does not transfer any ownership rights to you. You acquire only the limited right to use the software as described herein.

This Section 4 is subject to Section 14 (Third-Party Open-Source Components); the third-party open-source components included in the software remain the property of their respective authors.

5. Updates

HakoSpace may, at its discretion, provide updates, patches, or new versions of the software. Any such updates are subject to this Agreement unless accompanied by a separate license. Continued use of the software after an update constitutes acceptance of any revised terms.

6. Termination

This license is effective until terminated. It terminates automatically, without notice, if you breach any term of this Agreement. Upon termination, you must immediately cease all use of the software and destroy all copies in your possession or control.

7. DISCLAIMER OF WARRANTY

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. HAKOSPACE DOES NOT WARRANT THAT THE SOFTWARE WILL BE ERROR-FREE OR OPERATE WITHOUT INTERRUPTION.

8. LIMITATION OF LIABILITY

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, HAKOSPACE SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES ARISING OUT OF OR RELATED TO YOUR USE OF OR INABILITY TO USE THE SOFTWARE, EVEN IF HAKOSPACE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO EVENT SHALL HAKOSPACE'S TOTAL LIABILITY TO YOU FOR ALL DAMAGES EXCEED THE AMOUNT OF FIVE US DOLLARS ($5.00).

9. Changes to This Agreement

HakoSpace reserves the right to modify this Agreement at any time. The updated Agreement will be made available through the software or its official channels. Continued use of the software after changes are posted constitutes your acceptance of the revised Agreement.

10. Governing Law and Jurisdiction

This Agreement shall be governed by and construed in accordance with the laws of Taiwan. Any disputes arising from or relating to this Agreement shall be subject to the exclusive jurisdiction of the Taipei District Court, Taiwan.

11. User-Generated Content, Communications, and Real-Time Media

Your acceptance of this §11 and the accompanying Privacy Policy's media-data-flow disclosure is recorded under the version-and-re-consent mechanism in §1.1 (EULA effective 2026-07-08).

11.1 Definition of User-Generated Content

For purposes of this Agreement, "User-Generated Content" ("UGC") includes all data, content, and communications that any user transmits, stores, processes, or makes available through the software, including without limitation:

Text messages, files, images, and other attachments;
Real-time audio streams transmitted via the software's voice chat or direct-message call features;
Real-time video streams transmitted via the software's camera-sharing, screen-sharing, or direct-message video call features, whether captured from a device camera, a virtual camera driver, a screen capture source, or any other media source; and
Any metadata associated with the foregoing (timestamps, participant identifiers, device fingerprints where configured by the operator, etc.).

11.2 Transient Nature of Real-Time Media; No Recording Capability

The software is architected such that real-time audio and video streams are relayed, not recorded. Neither the software nor HakoSpace retains any copy, frame, sample, or derivative of any audio or video stream after the transmission has ended. Streams pass through the server instance's media relay (SFU) and are not written to disk by the unmodified software.

No in-product recording capability exists, and no such capability will be introduced in any version within the current major release line. Any subsequent major release line that introduces a recording feature will be published as a new effective date of this Agreement under §1.1 and will require your fresh acceptance before the feature applies to you.

The server operator is solely responsible for any modification, plug-in, or external tool (e.g., third-party screen-capture software running outside HakoSpace) that causes real-time media to be retained. If a server operator deploys any such external recording mechanism, the operator must obtain all consents required by applicable law from every participant prior to recording; HakoSpace disclaims any responsibility for operator-side out-of-product recording.

11.3 Licence You Grant to the Server Operator

When you (as an end user of a HakoSpace instance) transmit UGC through the software, you grant the server operator of that instance the limited, non-exclusive, worldwide, royalty-free licence to relay, cache (for the strict duration required for transmission), process, and display your UGC solely to the extent necessary to operate the service you are using. This licence is sublicensable solely to service providers acting on the operator's behalf for the purpose of delivering the Service (e.g., transit CDNs, relay infrastructure, hosting providers under written data-processing agreements). No other sublicence is granted. This licence is transmission-bounded: for real-time media, it terminates automatically at the end of the session; for stored content (text, attachments), it terminates when you or the operator deletes the content or when the operator's retention policy expires it, whichever is earlier.

You grant no licence to HakoSpace (the software vendor). Because HakoSpace does not operate any instance, HakoSpace neither receives, stores, nor acquires rights to any UGC.

11.4 Your Responsibilities as a Broadcaster

By enabling your camera, microphone, or screen share, you represent and warrant that:

You have the right to transmit the content captured (including the right to record any person whose voice or image you capture, where applicable law requires such consent);
You are not knowingly transmitting content depicting a minor in a sexualised manner, non-consensual intimate imagery, content that incites violence or hatred, or any other content prohibited by the applicable law of your jurisdiction or the jurisdiction of any other participant reasonably known to you;
You have verified, to a reasonable degree, that minors whose likeness you transmit are doing so with verifiable consent of a parent or legal guardian where required by applicable law (including COPPA, GDPR-K, and equivalents); and
You will not use the software's real-time media features to harass, stalk, threaten, or defame any person.

11.5 Incident Response and Takedown (Pass-Through)

HakoSpace (the vendor) has no technical ability to access, moderate, or remove UGC on any server instance and therefore cannot directly process DMCA, GDPR Article 17 ("right to erasure"), or equivalent takedown requests addressed to content on a specific instance. Such requests must be directed to the operator of the instance where the content resides.

Each server operator must establish, publish, and honour a reasonable process for:

Receiving and acting on reports of abuse (harassment, non-consensual recording, minors in sexualised content, etc.);
Preserving evidence (logs, metadata) for law-enforcement cooperation to the extent required by applicable law;
Terminating access of users who violate §11.4 or applicable law.

Where HakoSpace receives a credible notice that a specific instance is being used predominantly for unlawful activity, HakoSpace reserves the right to revoke any licence key or other commercial entitlement associated with that instance, without refund.

11.6 HakoSpace's Continued Non-Liability for UGC

Nothing in §11.1–§11.5 shall be construed to impose on HakoSpace any obligation to monitor, review, or moderate UGC on any instance. HakoSpace does not host, monitor, or control your instances, has no access to your user-generated content or communications, and assumes no liability for any user-generated content or any illegal activities conducted through your use of the software.

12. Privacy and Telemetry

By default, the software operates locally and does not transmit data to HakoSpace. However, with your explicit opt-in consent, the software may collect and transmit anonymous usage and diagnostic data (telemetry) to help improve the software. This data does not include personal information or user-generated content. For more details on data collection and usage, please refer to our Privacy Policy.

13. Language Prevailing Clause

In the event of any discrepancy or inconsistency between the English version and the Traditional Chinese version of this Agreement, the Traditional Chinese version shall prevail.

14. Third-Party Open-Source Components

14.1 The software incorporates certain third-party open-source components, each of which is provided to you under its own applicable open-source licence (including, for example, the GNU Lesser General Public License ("LGPL"), the BSD licences, the Apache License 2.0, and the MIT License). A list of these components together with their respective licences and attributions is provided in the THIRD_PARTY_NOTICES file distributed with the software.

14.2 Notwithstanding Section 3 (Prohibited Activities), Section 4 (Intellectual Property), or any other provision of this Agreement, nothing in this Agreement limits, restricts, or overrides any right granted to you under the licence of any such third-party open-source component. To the extent of any conflict between this Agreement and the licence of a third-party open-source component with respect to that component, the terms of that component's own licence prevail.

14.3 In particular, where an included component is licensed under the LGPL, you retain the rights that licence grants you, including the right to reverse engineer that component solely to the extent necessary to debug modifications you make to it, and the right to run a modified version of that component by replacing it within the software, in each case as and to the extent permitted by the applicable version of the LGPL.

14.4 The prohibitions in Section 3 and the ownership statement in Section 4 apply only to the HakoSpace-authored portions of the software; they do not extend to the third-party open-source components, which remain the property of their respective authors and are governed solely by their respective licences.

HakoSpace Privacy Policy

1. Introduction

HakoSpace is self-hosted software. This Privacy Policy describes how the HakoSpace software itself handles data. It does not govern any specific hosted instance, because we don't run one.

When you deploy HakoSpace, you are the one in control. The HakoSpace development team has no visibility into your server, your users, or your data.

2. Self-Hosted Architecture

This is the most important thing to understand about HakoSpace:

We cannot access your data. Not because of policy, but because of architecture.

HakoSpace runs entirely on infrastructure you control
The HakoSpace development team has no access to any data stored on self-hosted instances
We cannot read, monitor, or retrieve messages, files, user accounts, or any other data from your server
Each server instance is fully independent and isolated from every other instance
There is no central HakoSpace cloud, no shared database, no telemetry pipeline

Your server is yours. We have no way in.

3. Data Stored by the Software

HakoSpace stores the following data locally on the server operator's infrastructure:

User accounts: username, display name, password hash (bcrypt), avatar image
Messages and attachments: all chat messages and uploaded files sent by users
Voice/video metadata: call records (who called whom, when, and for how long) stored in the local database. This metadata includes participant user IDs, session start/end timestamps, and channel identifiers — it does not include any audio, video, or screen-share content.
Server configuration: settings, roles, permissions, channel structure
Audit logs: moderation actions and administrative events

3.1 Real-Time Media Data Flow (Camera, Microphone, Screen Share)

When a user activates their camera, microphone, or screen share, the corresponding media stream follows a relay-only path through the server:

Capture: The browser or desktop client captures frames from the device (via getUserMedia or getDisplayMedia). Capture occurs entirely on the participant's device; no frames leave the device until transmission begins.
Encoding & Transmission: Frames are encoded (VP8 / VP9 / H.264) and transmitted over an encrypted WebRTC connection (DTLS-SRTP) to the HakoSpace server instance.
Relay (SFU): The server acts as a Selective Forwarding Unit. Incoming media packets are forwarded to other participants who have subscribed to the stream. The server does not decode, transcode, inspect the contents of, or persist media packets. Packets reside in in-memory buffers only for the milliseconds required to forward them.
Playback: Receiving participants decode the stream client-side and render it for display.
Termination: When the broadcaster toggles off the camera/microphone/screen, the underlying media track is explicitly stopped (track.stop()), which releases the hardware and extinguishes the operating-system camera / microphone indicator. No frames captured during the session are retained by the software.

The unmodified HakoSpace software writes zero camera, microphone, or screen-share frames to disk. The SFU is a stateless relay with respect to media content.

What is persisted: call metadata (who joined, when, duration) and privacy-chip signal logs for abuse-response purposes; these contain no media frames. What is not persisted: audio samples, video frames, screen-share content, or any derivative (thumbnail, still, transcript) of them.

Device-level permission: The software respects the operating system and browser permission model. Camera and microphone access require an explicit user grant (browser prompt, or OS-level TCC on macOS, or Windows Privacy Settings). Denying or revoking permission at the OS or browser level disables the corresponding feature in the software; no workaround is present in the software.

HakoSpace does not and will not introduce in-product recording capabilities within the current major release line. This commitment mirrors EULA §11.2 and reflects HakoSpace's architectural and product intent: the software exists as a relay for ephemeral communication, not as a retention platform for user media.

Operator-enabled recording, if any: A server operator may, at their own legal risk and responsibility, install or configure external recording infrastructure that captures relayed media outside the unmodified HakoSpace software. Such recording is not part of the software, requires affirmative operator configuration of third-party tooling, and obligates the operator (not HakoSpace) to comply with applicable recording-consent laws for every participant. See the EULA §11.2 for the corresponding licence terms.

All of this data lives in a local SQLite database file and local file storage on the operator's machine. None of it is transmitted to HakoSpace.

4. Telemetry & Data Collection

By default, HakoSpace does not phone home. No data leaves your server unless you explicitly opt in.

On first launch, the server administrator is presented with a one-time prompt asking whether to participate in the HakoSpace Improvement Program. This is entirely voluntary.

If you decline (or dismiss the prompt): zero outbound telemetry. The software behaves as a fully offline, self-contained system.
If you opt in: the server periodically sends anonymized usage statistics and a randomly-generated Instance ID to HakoSpace. You may opt out at any time from the server settings panel.

What is collected (opt-in only)

Collected	NOT Collected
Total registered user count	Usernames, emails, passwords
Total channel count	Channel names or content
Message volume (daily / total count)	Message text or attachments
Peak concurrent voice users	IP addresses or geolocation
Server version, edition, OS, architecture	Hostnames or domain names
Server uptime (days since first launch)	Environment variables or secrets

All collected data is numeric or categorical. No personally identifiable information (PII) is ever transmitted.

Random Instance ID: When telemetry is enabled, the software generates a random UUID (e.g., 123e4567-...) to uniquely identify the installation. This is used strictly to deduplicate metrics (e.g., counting active servers) and track version adoption over time. This ID is mathematically random, contains no hardware signatures, and is not linked to your identity, IP address, or domain name.

Network Logs: While the HakoSpace software does not collect end-user IP addresses, when your server instance communicates with our infrastructure (for opt-in telemetry or license verification), our standard web servers and CDN providers (e.g., Cloudflare) will temporarily log the public IP address of your server for security, DDoS protection, and rate-limiting purposes. We do not correlate these server IP addresses with personal identity.

Other outbound connections

ACME / Let's Encrypt — to obtain TLS certificates, if the operator enables this feature
AI provider APIs (Anthropic, OpenAI, Google, etc.) — only if the operator enables AI features and supplies their own API keys. These connections go directly from your server to the AI provider; HakoSpace is not in the middle.
License verification (commercial editions only) — periodic key validation with the HakoSpace license server. This transmits only the license key itself and a hashed, anonymous instance ID to prevent license abuse. No user data, metadata, or PII is transmitted during this process.

Data Retention: While you can stop sending future telemetry at any time by opting out, we cannot delete previously collected anonymized aggregate data as it is impossible to isolate individual contributions from the aggregate dataset.

5. Server Operator Responsibility

If you run a HakoSpace instance, you are the data controller for all user data on that instance.

You are responsible for your own data protection obligations under applicable law
You should inform your users about what data you collect and how you handle it
You are responsible for backups, security, and access controls on your server
HakoSpace provides the software; compliance is your responsibility
Where your instance is likely to be used by minors, you must assess your obligations under child-privacy laws applicable to your users' jurisdictions (e.g., COPPA in the United States, GDPR Article 8 in the European Union, PIPL Article 31 in the People's Republic of China, the Personal Data Protection Act in Taiwan). HakoSpace provides the software; legal-age determination and parental-consent mechanisms, where required, are your responsibility as operator.
The software displays, on first camera activation by any user, a one-time in-app notice disclosing (a) that a live camera stream will be transmitted to other participants, (b) that the stream is not recorded by the unmodified software, and (c) that the user remains responsible for the content they broadcast. This notice is intended to reduce surprise; it is not, by itself, sufficient to constitute verifiable parental consent where such consent is legally required.

5.5 Minor Users

The software is general-purpose communication infrastructure and is not specifically directed to children. Nevertheless, because individual server instances may be used by users of any age, each operator must assess obligations under applicable child-privacy laws (COPPA in the US, GDPR Article 8 in the EU, PIPL Article 31 in PRC, Personal Data Protection Act in Taiwan, etc.) for their user population.

By accepting this Privacy Policy, you represent that you are at or above the age of digital consent in your jurisdiction (commonly 13–16), or that a parent or legal guardian with lawful authority has reviewed and accepted on your behalf. Server operators whose instances are used by minors in jurisdictions requiring verifiable parental consent must implement additional operator-level controls (e.g., age gating at registration, operator-initiated parental consent workflow); the software does not substitute for these.

If you are a parent or guardian and believe a minor under your care has accepted this Privacy Policy without your authorisation, please contact the server operator to request deletion of the minor's account data under §7.

Protection against recording: As stated in §3.1 and EULA §11.2, HakoSpace does not and will not introduce in-product recording capabilities within the current major release line. This reduces the privacy exposure surface for all users, and is particularly relevant for minor users whose transmitted likeness must not be retained by the platform.

A. Legal Consent Enforcement

HakoSpace uses a server-side legal consent gate to ensure that every user of a HakoSpace server instance has actively accepted the current version of the EULA and this Privacy Policy before using any feature that processes personal data.

A.1 Versioning

Each of the EULA and this Privacy Policy is identified by an independent effective date in ISO format (YYYY-MM-DD), displayed in the document header (e.g., Privacy Policy effective 2026-06-16). A new effective date is issued upon any material change: expansion of collected data categories, change of retention period, introduction of new third-party processors, new feature categories (noting that, per §3.1 and EULA §11.2, HakoSpace commits not to introduce in-product recording within the current major release line), or any other change that would, in HakoSpace's good-faith assessment, affect a reasonable user's decision to use the service.

Editorial changes (typo fix, phrasing cleanup, link corrections) do not trigger a new effective date; they are applied in-place and the commit history of the published document serves as audit trail. In the rare event that a critical correction must be issued on the same day as an effective-date release, a suffix (e.g., 2026-06-16-a) may be used; HakoSpace prefers bumping to the next day where circumstances permit.

A.2 Account-Level Acceptance Record

Your account on a given server instance stores four values: the EULA version you last accepted, the Privacy Policy version you last accepted, and the UTC timestamps of each acceptance. These values constitute personal data and are processed solely for the purpose of operating the consent gate and providing evidence of your acceptance.

A.3 Server-Side Gate

At each session start (HTTP API request or WebSocket HELLO), the server compares your recorded acceptance versions against the server's current versions. If either recorded version is lower than the current version, or is empty, the server refuses the request with an error (LEGAL_CONSENT_REQUIRED) and returns the list of documents requiring re-acceptance together with the current version strings.

The client, upon receiving this error, must display a blocking modal containing the full text of each document requiring re-acceptance. The modal has no dismissal path other than accepting or leaving the service. Scrolling through the full text is recommended but not strictly enforced; two independent checkboxes ("I have read and agree to the EULA" / "I have read and agree to the Privacy Policy") must be checked before the Accept button is enabled. Upon acceptance, the client POSTs the accepted version strings to the server, which updates the four account fields and grants access.

A.4 Applies to All Users, Not Only New Ones

On the release day that introduces a new EULA or Privacy Policy version, all existing users (not only newly-registered ones) will see their next connection intercepted by the re-consent modal. This design reflects that (i) a material change in collected data categories or processing purposes affects existing users equally, and (ii) GDPR and equivalent frameworks require affirmative, informed consent for the new purpose — passive continuation of use does not constitute such consent.

Server operators migrating to a new version therefore must expect temporary access friction for their users on release day; this is a feature of the consent framework, not a bug.

A.5 Decline Consequences

If you decline the new version, you will be unable to use that server instance until you accept. Your existing account data is not deleted by the decline; you may return and accept at any later time. You retain the right to request deletion of your personal data under §7 / §8 below, independently of the consent decision.

A.6 Historical Versions

Each published version of this Privacy Policy and the EULA remains accessible at a stable archive URL (typically /legal/archive/<YYYY-MM-DD>/privacy and /legal/archive/<YYYY-MM-DD>/eula), so that you may always review the exact text you accepted. See the legal archive index.

6. Desktop Application

The HakoSpace desktop application (Electron) connects only to server addresses you configure.

Authentication tokens are stored locally using platform-native encryption (safeStorage API)
No data is sent to HakoSpace servers
The app has no built-in telemetry or crash reporting

7. Contact

For questions about this policy: legal@hakospace.com

For questions about data on a specific HakoSpace instance, contact the operator of that instance.

8. Website and Communications

When you visit hakospace.com to download our software or read documentation, we may collect standard web server logs and use essential cookies necessary for website functionality. If you contact us via email (e.g., support requests), we will retain your email address and the content of your message solely for the purpose of resolving your inquiry. We do not sell or share this information with third parties.

9. Language Versions

This Privacy Policy is published in English and Traditional Chinese. In the event of any discrepancy or inconsistency between the English version and the Traditional Chinese version of this Policy, the Traditional Chinese version shall prevail.