Hublot

Nothing collected, nothing sent

Hublot collects no data and sends none anywhere. The program makes no outbound network connection of its own: no telemetry, no usage statistics, no update check. Everything it keeps stays on your machine, in the places listed below.

Three things can still carry data further, and none of them is Hublot's own code: the browser it drives and the sites you open in it, the AI agent that calls it, and the optional remote web view, which is off by default. Each is described below.

Describes Hublot 0.1.13. This page covers the program, not this website. Last updated: 2026-10-08.

What Hublot stores, and where

Hublot keeps its files in one folder: %LOCALAPPDATA%\hublot on Windows. On Linux it is $XDG_CONFIG_HOME/hublot, usually ~/.config/hublot (versions before 0.1.13 used ~/AppData/Local/hublot; the first run of a newer version moves that folder, profile included, to the new place). Screenshots go to the system temporary folder.

PROFILE

profile\: the persistent profile of the browser Hublot drives. Cookies, saved passwords, history, local storage and cache, all written by Chrome or Edge themselves. This is what lets a login survive a restart. Hublot does not read these files, the browser does, and it sets their permissions, not Hublot.

TOKEN

token: a random 256-bit token (64 hexadecimal characters), created the first time the broker starts. Every command must present it to reach the broker, which listens on 127.0.0.1:47563 only. It is written with owner-only permissions (0600) on Linux. On Windows it relies on the permissions your profile folder already has: your account, SYSTEM and administrators. It is never rotated, and hublot stop does not delete it.

TABS

tabs.json: the label, id and current URL of each open tab, so the tabs can come back after a crash or a reboot. URLs can carry sensitive parameters. Closing a tab removes its entry. No permissions are set on this file.

REMOTE

remote.json: the settings of the remote web view: whether it is on, the address it listens on, and its token. Written by hublot web on, and again by hublot web off, which turns it off and erases the token. It is written with owner-only permissions (0600) on Linux, and an older file is tightened the next time it is written. Before 0.1.13 no permissions were set, so other local accounts could read it depending on your umask. On Windows it relies on the permissions of your profile folder.

LOG

broker.log: the diagnostic messages the broker prints, such as which browser it found or why it failed to start. It is not a browsing log. It is appended to, and once it passes 1 MiB it is set aside as broker.log.1 (one previous copy kept), so it stays under about 2 MiB. You can delete both at any time.

SCREENSHOTS

hublot-screenshots\ in the system temporary folder: one image for each hublot screenshot, named <tab label>-<timestamp>.png. It shows whatever the page showed, including pages you are logged in to. Hublot never deletes these files.

Kept in memory only: the console messages and the network requests (method, URL, status) of each tab, capped at 500 entries each and gone when the broker stops. Page text, accessibility snapshots and screenshots are handed to whoever ran the command and are not stored, apart from the screenshot files above.

The optional remote web view

Off by default. hublot web on --bind <address> starts a small web page, meant for a phone, that lists your open tabs (label and URL) and shows a live screenshot of the one you pick. It is read-only.

PLAIN HTTP

There is no TLS. Everything, including the token, crosses the network unencrypted. Use a private address such as a Tailscale one, never 0.0.0.0 on a network you do not trust.

TOKEN IN THE URL

The token travels in the address (?token=...), so it can end up in browser history and in server logs. A new token is generated each time you run hublot web on.

NO TOKEN

--no-token opens the page to anyone who can reach the address. Screenshots can show pages you are logged in to.

COMES BACK

If it was on when the broker stopped, it starts again with the broker, on the same address and with the same token. hublot web off stops it and erases the token. The default address is 127.0.0.1:9871.

Third parties

  1. The browser. Hublot drives your installed Chrome, or Edge if Chrome is missing. What those browsers send to Google or Microsoft (sync, safe browsing, updates) is governed by their own privacy policies, and Hublot does not control it. If neither is installed, Hublot falls back to the Chromium that Playwright can install (npx playwright install chromium, which you run yourself and which downloads from Microsoft's Playwright servers).
  2. The sites you open. They see the traffic the way they would from any browser.
  3. The AI agent that calls Hublot. It receives the text, accessibility snapshots, screenshots and network logs it asks for, and what happens to them next depends on that agent and its provider. An agent can also have Hublot run JavaScript in a page (evaluate), run code with full Node.js rights (run-code-unsafe) or send a local file to a web page (upload): what those do is up to the code or the file it gives them.
  4. No one else. No analytics, advertising or telemetry service receives anything from Hublot.

Removing your data

  1. hublot web off turns the remote view off and erases its token.
  2. hublot stop closes the browser and the broker.
  3. Delete the hublot folder (%LOCALAPPDATA%\hublot, or ~/.config/hublot on Linux): that removes the profile, the token, the open-tab list, the remote settings and the log. Delete hublot-screenshots in the temporary folder as well. A new token is created the next time the broker starts.
  4. Uninstalling Hublot does not delete any of this. The Windows uninstaller removes the program, and its entry in your user PATH if you added one, and nothing else.

Questions about this policy: open an issue on GitHub or write to hublot@breizhzion.com.