Draft. Needs a lawyer’s review before launch.
Privacy policy draft
Who we are
Hither is run by [COMPANY NAME], [ADDRESS]. Contact us at [CONTACT EMAIL]. We are the controller for your account data. Our vendors process data for us under data processing agreements.
The short version
Nothing stored on our servers: not your screenshots, your voice, your transcripts or your answers. We claim that only for what we control. AI processing is by Microsoft Azure. Azure may hold content it flags for human review. No time limit is published.
[LAWYER: Azure retention wording, flagged content and abuse monitoring, before this goes live]
Your screen may be processed outside the country where you are. Check that this is acceptable for what is on your display before you ask.
What leaves your Mac, and when
Hither captures only while you hold the hotkey. When you do, it sends:
- On most turns, text from your screen: the names, roles and positions of on-screen controls, and the text on them, read through Accessibility. No image goes with these turns, but this is still screen content.
- On some turns, one screenshot of the display under your cursor, as a JPEG at a long edge of 1600 px. Your cursor position goes with it. Hither’s own windows and your guarded apps are left out.
- Your voice while the key is held, relayed to the speech provider to turn it into text.
- Your question as text, or the text you type if you use that option.
Text on your screen is treated as data, never as instructions. The AI has no tools: it can only speak and mark the screen.
What is kept, where, and for how long
| Data | Where | Retention |
|---|---|---|
| Text from your screen | Memory on your Mac, then Microsoft Azure to be processed | Never at rest with us. Azure may hold content it flags for human review. No time limit is published. |
| Screenshot | Memory on your Mac, then Microsoft Azure to be processed | Never at rest with us. Azure may hold content it flags for human review. No time limit is published. |
| Audio | Relayed to the speech provider | Not stored by us. |
| Transcripts and answers | On your Mac, in your session history | Until you delete them. Auto-deleted after 90 days by default. You can change the period in Settings. |
| Account and billing | Our account database, our sign-in provider, Paddle | Life of the account, plus what tax law requires. Deleted within 24 hours of an account deletion, except tax records held by Paddle. |
| Waitlist email | The waitlist service this site posts it to, or our support inbox if you email us | [LAWYER: waitlist email retention] |
| Salted email hash | Our account database | 12 months after deletion, to limit free-tier abuse. |
Analytics and crash reports
The app sends product events and crash reports. Analytics carry no content: an allowlist of properties is enforced, and a test fails the build on anything outside it. Examples are which step of setup you finished, whether a turn completed, and how long it took.
This website counts page views and waitlist sign-ups with PostHog. The count sets no cookie, stores nothing in your browser, ends when you close the tab and never includes your email address. It respects Global Privacy Control. The website uses no external images and keeps one preference, your chosen theme, in your own browser.
The waitlist
If you join the waitlist on this website, we use your email address for one thing: to tell you when an invite is ready. If the form is not connected yet and you email us instead, we use your address only to reply. The website keeps nothing about this in your browser.
[LAWYER: waitlist email, the legal basis, how long it is kept, who processes it, and whether any message besides the invite may be sent to it]
Who processes data for us
| Vendor | Purpose |
|---|---|
| Microsoft (Azure) | Hosts the AI models that write the answers, main and fallback. |
| Deepgram | Speech to text and text to speech. |
| Cloudflare | Hosting for our API and this website, the download and updates, and encrypted backups. |
| Supabase | Sign-in and account database. |
| Resend | Sends 6-digit sign-in codes. |
| Paddle | Payments, as merchant of record. |
| PostHog | Counts website visits and app events. It receives no content or email. |
| Sentry | Crash reports: which part failed and the error type, with no content. |
Permissions
We ask for three macOS permissions, one at a time, and explain each before macOS does.
- Microphone, for hold-to-talk.
- Screen Recording, for the turns that send a screenshot.
- Accessibility, to read control names, text and positions. You can skip this; pointing is then Approximate or None.
We do not request Input Monitoring, Camera, Files or Automation.
Your controls
- Pause. One click refuses capture and the microphone until you resume.
- Sensitive App Guard. Keeps password managers, Keychain Access, and common banking and messaging apps out of captures. You can add or remove apps. Browser tabs are not covered yet, so a password page in a browser is not protected by the Guard.
- History. Delete a session or all history. Deletion is immediate, with 5 seconds to undo.
- Account deletion. Self-serve in Settings. Your rows are removed from the live database within 24 hours, including your analytics and crash records. They can remain in encrypted database backups for up to 30 days, until those backups expire. An active Pass is forfeited, and the confirmation says so.
Other people
Holding a key limits capture, but it does not stop other people’s voices or details on your screen from being captured while you hold it. Check who can be heard and what’s on your display before you ask, and take care on calls.
[LAWYER: third parties on screen, wiretap and voice notices]
Age
Hither is for people 18 and over. You confirm your age at sign-in. We do not knowingly allow anyone younger to use it.
Your rights
[LAWYER: access, correction, deletion and portability rights by region; EU representative; legal bases]
To use a right that isn’t covered by the controls above, write to [CONTACT EMAIL].
Changes
We will post changes here and say what changed. Last updated [DATE].