Privacy Policy

This Privacy Policy covers information related to your use of Hansel, including the macOS desktop app at hansel.so, the Hansel marketing and account website, and related support, billing, authentication, and AI-assisted features.

Because Hansel is local-first, this policy distinguishes between information that remains on your device, information Ahoy Labs collects directly, and information that may be sent to service providers only when you use certain features.

It does not cover third-party products or services that have their own privacy policies, including external websites, payment providers, authentication providers, or model providers that you may access through Hansel.

Hansel's desktop app may process and store the following categories of data locally on your Mac:

• Activity data, such as app names, app paths, active window titles, browser URLs or domains, document names, timestamps, and presence state.
• Audio data, such as microphone, system, or app-audio recordings, recording metadata, and transcripts generated from captured audio.
• Screen and OCR data, such as timelapse files, OCR-derived text, frame metadata, and search indexes when screen rewind or OCR features are enabled.
• Settings and controls, such as excluded apps, privacy preferences, onboarding state, recording configuration, and local feature settings.
• Diagnostic and operational data, such as app version, device or permission status, error logs, and update status information.

By default, this local content stays on your device. Ahoy Labs does not automatically receive your recordings, timeline history, OCR data, or settings simply because you use Hansel. If you enable Cloud Timeline Archive, older timelapse recordings may leave your device as described below.

If you deliberately export data, contact support, or use a feature that relies on an external provider, limited portions of that data may leave your device as described below.

Cloud Timeline Archive is off by default. If you enable it, Hansel uploads completed timelapse recordings older than the retention period you select to private cloud storage operated by Cloudflare. After Hansel verifies an upload, it may remove the local copy to free space and download the encrypted file again when you rewind to that part of your timeline.

Archived files are encrypted before upload and remain encrypted in cloud storage. The encryption key stays in your Mac's Keychain and is not uploaded. Neither Ahoy Labs nor Cloudflare receives the key or can decrypt the archived files. Because recovery requires that key, Cloud Timeline Archive is not an independent disaster-recovery backup: losing the key means the archived files cannot be decrypted.

Ahoy Labs uses Cloudflare to store the encrypted files and process limited archive metadata, such as your account and file identifiers, file sizes, integrity hashes, storage usage, access timestamps, and upload or deletion status. We use this metadata to authenticate requests, enforce storage limits, verify and retrieve files, and complete deletions.

Turning off Cloud Timeline Archive or ending your Hansel Pro subscription stops new uploads but does not automatically delete files already archived. When you delete a recording in Hansel, Hansel requests deletion of its corresponding cloud file and retries transient failures. Deleting your Hansel account triggers deletion of all files in its cloud archive. We retain limited deletion-control records that do not contain recording contents when needed to finish deletion and prevent late or stale uploads from recreating a deleted archive.

When you use Hansel's website, account features, or paid services, Ahoy Labs may collect:

• Account and profile data, such as your email address, user ID, and session or login information.
• Authentication data, such as one-time passcode requests and verification events.
• Billing and subscription data, such as plan selection, subscription status, Polar customer identifiers, renewal dates, and payment-related metadata handled by our billing providers.
• Website usage data, such as request logs, browser information, IP address, and cookie-based session information reasonably necessary to operate the site.
• Communications, such as support requests, legal notices, feedback, and other messages you send to us.

Information related to Hansel comes from a few different places:

• Information you provide to Ahoy Labs directly, such as when you create an account, manage a subscription, contact us, or otherwise send us information.
• Website and account activity, such as when you sign in, manage billing, or access Hansel-related web features.
• Local processing by the Hansel desktop app, when the app processes recordings, activity history, permissions, or settings on-device in order to provide its features.
• Service providers that help operate authentication, billing, email delivery, updates, and AI-assisted features.

Hansel uses local on-device data to provide the desktop app's core functionality. Ahoy Labs uses information under its control to operate the website, accounts, billing, support, security, and related service operations. Depending on the context, information may be used to:

• Provide, operate, maintain, and support Hansel.
• Store, index, search, and display your local activity history and recordings.
• Generate summaries, labels, and other AI-assisted outputs.
• Authenticate users, manage accounts, process subscriptions, and send transactional communications.
• Improve reliability, security, fraud prevention, and debugging.
• Understand product performance and usage patterns, including through anonymized or de-identified information where permitted by law.
• Comply with legal obligations and enforce our Terms of Service.

For clarity, the fact that Hansel uses local desktop-app data does not mean Ahoy Labs receives that data.

Some Hansel AI features currently rely on external processing. Hansel may process selected activity context, transcript snippets, or other feature-related inputs using AI systems operated by Ahoy Labs and/or third-party AI service providers to generate summaries, labels, transcripts, or related outputs.

This may include limited text-based context, such as app names, titles, domains, timestamps, and short microphone transcript snippets that are relevant to the requested output. Cloud Timeline Archive, described above, is separate from this AI processing. We do not send your raw recordings or full local history to AI providers for cloud storage or backup.

If you use features that rely on third-party transcription or speech-processing providers, Hansel may send audio files or portions of audio to those providers to generate transcripts or related outputs. Ahoy Labs does not retain server-side copies of audio files sent for third-party transcription longer than needed to complete transcription and related transient processing.

If you enable optional anonymized usage sharing, Ahoy Labs may use de-identified or anonymized information to analyze, secure, and improve Hansel, including its AI-assisted features, product quality, and model performance. When onboarding asks whether you want to allow anonymized usage data, that preference governs optional product-improvement sharing where applicable.

We do not state that third-party AI providers may use your personal data to train their general models for their own independent purposes, but their handling of data remains subject to their own terms, privacy commitments, and applicable law.

We may share or disclose information that is under our control, or that you instruct Hansel to send, in the following circumstances:

• Service providers that help us operate Hansel, including providers for authentication, billing, email delivery, hosting, software updates, and AI processing.
• Business transfers involving information under Ahoy Labs' control, such as account, billing, support, and related service records, if Ahoy Labs, Inc. is involved in a merger, acquisition, financing, bankruptcy, or asset sale.
• Legal and safety reasons when reasonably necessary to comply with law or protect the rights, safety, and security of Ahoy Labs, Inc., our users, or others.
• With your direction if you intentionally use a feature that exports or shares information.

Hansel's website uses cookies and similar technologies for essential site functionality, authentication, session management, and related operational needs. We may also use limited website analytics or infrastructure logs that help us understand how the site is used and how to keep it functioning.

You can manage cookies through your browser settings, but some account or login features may not work correctly if you disable essential cookies.

Hansel is designed with strong local security controls. The app stores captured recordings and timeline data locally on your Mac by default, and the local Hansel database is encrypted. Captured audio files are encrypted at rest, and screen recordings are stored in encrypted timelapse files rather than as plain video files on disk.

Hansel's encryption keys and other sensitive secrets are stored using platform security mechanisms such as the macOS Keychain. We also use encryption and access controls where appropriate for website, account, and service-provider data flows.

No method of storage or transmission is perfectly secure, and we cannot guarantee absolute security.

Because Hansel is local-first, much of your captured app data remains on your device until you delete the app, remove files, or clear local history. We retain website, account, subscription, and operational records for as long as reasonably necessary to provide the service, comply with law, resolve disputes, enforce agreements, and maintain security.

We may retain de-identified or aggregated information for longer periods. Local content that you delete from your own device may not remain available to us if we never received it in the first place.

You may have choices about how Hansel handles your data, including:

• Granting or revoking macOS permissions such as microphone or screen recording.
• Pausing tracking or excluding apps from capture.
• Changing AI or privacy-related settings in the app as they become available.
• Turning optional anonymized usage sharing on or off during onboarding or later.
• Enabling or disabling Cloud Timeline Archive and choosing how long timelapse recordings stay on your Mac before they become eligible for archiving.
• Requesting access, correction, deletion, or portability for website/account data, and for any personal data Ahoy Labs actually controls, by contacting us.
• Managing local desktop-app data directly on your Mac by deleting recordings, local databases, exports, or the app itself. Deleting a recording also requests deletion of its corresponding cloud archive file, if one exists.

Some requests may require us to verify your identity and may be limited by legal, security, or technical constraints.

Residents of certain U.S. states may have rights to request access to, deletion of, or correction of personal information, and to appeal certain privacy decisions, subject to applicable exceptions. You may also have rights relating to the use of de-identified data, targeted advertising, or sale/sharing concepts defined under local law.

Those rights apply to personal data Ahoy Labs controls. They do not turn Ahoy Labs into the custodian of your full local Hansel database when that data remains only on your device.

To submit a privacy request, email us at privacy@hansel.so. We may need to verify your identity before completing a request.

If you are located in the European Economic Area, United Kingdom, or Switzerland, you may have rights to access, correct, delete, restrict, object to, or port certain personal data, and to withdraw consent where processing is based on consent.

Ahoy Labs, Inc. is generally the controller for personal data it actually receives and controls under this Privacy Policy, unless we expressly state otherwise. Our lawful bases may include contractual necessity, legitimate interests, consent, and compliance with legal obligations.

You may also have the right to lodge a complaint with your local supervisory authority.

Hansel is not directed to people under 18, and we do not knowingly collect personal data from people under 18. If you believe a person under 18 has provided us personal data, contact us and we will take appropriate steps.

Hansel's website and service-provider infrastructure may operate in the United States and other countries where we or our providers do business. If you use Hansel from outside the United States, you understand that relevant account, billing, support, or AI-related data may be processed in those jurisdictions.

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated policy here, update the effective date above, and take other steps if required by applicable law.

If you have questions about this Privacy Policy or want to submit a privacy request, contact: privacy@hansel.so