Last updated: 24 October 2026

This page explains what Zen Labs Corporation (Australia), which runs hatamoto.dev, collects when you use this website, its documentation, the Hatamoto update service, the package registry and the hatamoto.dev/sdk Go import path. It does not cover websites that people build and run with Hatamoto: those are run by their own owners.

Questions or requests: [email protected]

A Hatamoto install that checks for updates fetches the signed manifest for its update channel from hatamoto.dev, and the release files when an update is applied. These requests carry no cookie, no query string and no identifier of your install; the only headers are the ones Go's HTTP client adds on its own (a default User-Agent and Accept-Encoding). Hatamoto sends no other telemetry.

The admin's plugin browser fetches the public registry index (/registry.json) when someone opens it, and a package's archive when one is installed. Both can be turned off (HATAMOTO_UPDATES=off, HATAMOTO_REGISTRY_URL=off); the full list of outbound connections is in the documentation under Outbound connections.

Our application logs each request it serves: the time, method, requested path, response status and size, how long it took, and the browser's User-Agent. We do not record visitors' IP addresses: our server only sees requests forwarded by Cloudflare (below). We use these logs to keep the service running, to count how often releases are downloaded, and to investigate faults and abuse. Logs are deleted within 90 days. We do not sell them, share them for advertising, or use them to build profiles.

The public website sets no cookies and uses no analytics or advertising tools, and it loads no scripts, fonts or images from other companies. Signed-in editors of this site get a session cookie that is needed to sign in. If we ever add analytics, we will update this page first.

• Cloudflare, Inc. sits in front of hatamoto.dev: it provides TLS and caching and protects the site from attacks. To do this it processes request data, including your IP address, under its own privacy policy and data processing terms.
• The Constant Company, LLC (Vultr) hosts our server in Melbourne, Australia.
• Google (Google Workspace) hosts the @hatamoto.dev mailboxes, so it processes any email you send us.

We share data with no one else, unless the law requires it.

If you write to us (for example to security@, conduct@ or [email protected]), we use your message and address only to deal with it, and keep them for as long as that takes. Security and conduct reports are read only by the maintainers and are shared outside the project only with your agreement or where the law requires it.

Under the Australian Privacy Act 1988 and, if you are in the European Union or the United Kingdom, the GDPR, you can ask what personal information we hold about you, and ask us to correct or delete it. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in the EU and UK, to your local data protection authority. Write to [email protected]; we answer within 30 days. Because our logs do not record IP addresses or accounts, we usually hold nothing that identifies a visitor.

When this page changes, we update the date at the top.