Privacy policy
Hearth keeps your data on your own devices. There is no Hearth server, no account with us, and no analytics. The only outside services Hearth talks to are listed below.
What Hearth stores, and where
- Your conversations with Vesta, your settings, the inbox helper's rules and its record of every change it made to your mail live in an encrypted database on your Mac, with a smaller one on your phone. Both are encrypted with SQLCipher, and the keys are kept in the device's Keychain.
- Your Mac and your phone talk only to each other, over your own Tailscale network. Hearth does not listen on your local network and does not accept connections from anywhere else.
- Speech is turned into text on the device: by a local model on the Mac, and by Apple's on-device recogniser on the phone. Vesta's spoken replies are made on the Mac, played once on the phone, and never kept or logged.
Model downloads
On first run the Mac downloads its speech model, its language model and Vesta's voice engine from huggingface.co, and the phone downloads Apple's on-device English speech model from Apple. These downloads carry no audio and no conversation. After that the models load from disk with no network.
Gmail
If you connect a Gmail account, Hearth signs in with Google OAuth on your Mac and from then on talks, for that account only, to accounts.google.com, oauth2.googleapis.com and gmail.googleapis.com. In detail:
- One permission. Hearth asks for
gmail.modify, the narrowest Gmail permission that can archive a message. By Google's design that permission also allows sending; Hearth has no code that sends, drafts or deletes mail, and an automated test refuses any such request. - Headers only. Hearth reads the sender, recipients, subject, date, unsubscribe headers and Gmail's one-line snippet of each message. It never fetches a message body or an attachment.
- Moves, never deletions. Archiving and filing are done by adding and removing Gmail labels. Nothing is deleted or moved to the bin. Every change is recorded on your Mac so it can be undone for 30 days.
- Unsubscribing. After you tap yes on the morning card, Hearth sends one one-click unsubscribe request to a sender's own unsubscribe address, as that sender's mail headers specify. That is the only request Hearth makes to anyone but Google, and it is made once for each sender.
- Sorting on your Mac. Mail is sorted by your rules first and by the language model running on your Mac second. Mail headers are never sent to any other service to be sorted.
- Tokens. Your Google sign-in tokens live in the encrypted database on the Mac, never in a file or a log.
- No logging of mail. Hearth's logs hold counts and error names only, never an address, a subject or a snippet.
Hearth's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
What Hearth never does
- Send email, post or publish anything on your behalf, or upload your files.
- Share, sell or transfer your data to anyone, or use it for advertising.
- Use your data to train or improve any model.
- Collect analytics, crash reports or usage statistics.
Your choices
- Disconnect Gmail at any time from the Hearth menu on your Mac, and revoke Hearth's access at myaccount.google.com/permissions. The labels Hearth created in Gmail stay until you delete them.
- Delete everything Hearth holds by deleting the apps and their data folders. Nothing remains anywhere else, because nothing was ever sent anywhere else.
Changes and contact
This policy changes only when the software does, and the date at the top moves with it. Questions about it can be raised as an issue in the site's public repository.