Privacy is central to Hemmingway. We do not train our models on information from your chats, memory or People, nor do we sell that data. This policy explains what stays on your device, what reaches our systems and what we keep when you use our website, desktop, web and Android apps, API, Autopilot and Hemmingway Unlocked.
Who is responsible
The operator and data controller (the responsible party, under South African law) is Hemmingway AI (Pty) Ltd, a company registered in South Africa. It is responsible for all services described in this policy.
Send privacy questions and requests to team@hemmingway.io. We follow South Africa’s Protection of Personal Information Act (POPIA) and other privacy laws that apply to our processing.
Your account and saved information
When you create a standard Hemmingway account, our server keeps your email address and name; your Google profile picture if you use Google sign-in; and Google's sign-in token, which gives access only to your name, email address and picture. If you set a password, we keep its hash, never the password itself.
We also record sign-ins, including the device's IP address and app or browser, and your usage in each five-hour period. Account details remain while your account exists. Sign-in records are kept for up to 90 days after last use, and usage counts for 90 days.
Outside the device-only modes described below, your signed-in chats, memory, People, name and appearance settings are saved to your account so they are available across devices. They remain until you delete them, subject to the deletion arrangements below. They are stored to provide the service, not to train models.
What stays on your device
The desktop app keeps chats, People and memory in files on your computer. Its sign-in token is stored separately in your operating system's secure keychain. Local files do not prevent account synchronisation: when you are signed in, account-saved information is also held on our server.
On the web and in the Android app, you can choose “Chats only on this device” when starting or under Settings → Account. Chats started and memories created while this is on stay in that browser or app. They are not saved to our server or available on other devices. Clearing the browser's or app's data deletes them.
Hemmingway Unlocked keeps chat history on your device and does not synchronise it to your Hemmingway account. Use the deletion controls in Settings to remove it. Your device or browser backups may keep copies; we cannot restore history we do not hold.
In every mode, requesting an answer sends the prompt and relevant conversation context to the model. Local history does not mean the model runs offline or on your device.
Requests to the model and the API
For Hemmingway services other than Hemmingway Unlocked, requests pass through our server to the machine running our model. Our server does not retain the request itself. It records token counts, processing time and success or failure, without message content. Account chat storage, where enabled, is separate from these processing records. Hemmingway Unlocked's processing is described separately below.
API requests, whether made directly or through a partner, are not used for training. Their prompts and replies are not stored or logged by our processing systems. Our server records an API key identifier, token counts, cost, time and success or failure for billing; these records remain while the account exists. Requests go to the machine running our model, not another company’s AI model. A partner through which you access the API may separately handle information under its own policy.
Hemmingway API keys are transmitted over encrypted connections. We store a one-way hash rather than the full key; the full key is shown only when it is created. This describes Hemmingway API keys, not the credentials needed to access accounts connected to Autopilot.
Unlocked processes prompts and necessary conversation context, including earlier messages, on GPU infrastructure rented through Vast.ai. The answer returns to your device.
we do not retain prompts, conversation context or replies after the request is completed, including in application logs, error reports, temporary files or backups.
We do not use Unlocked prompts, context or replies to train or improve models. Local history and request processing are separate: a copy that you choose to send to support is handled under the support section below.
Account, payment and usage records are separate from the text sent for generation. The sections below explain those records and any information you choose to send to support.
Autopilot
Autopilot is off until you enable it. It reads incoming mail or messages from connected accounts and uses your rules to draft or send replies. This involves message content, sender and recipient information, your instructions and the permissions needed to access the connected service. Replies sent under your rules go to their recipients through that service.
Autopilot processes incoming messages and your instructions on our servers using the Hemmingway API. Autopilot stores each connected account's mail app password or Google/Microsoft/GitHub token only on the device (macOS Keychain, or the Android Keystore), never on the server, and deletes it when you remove that account. Message content, task records and sent replies are available through the service’s data or chat controls. Autopilot keeps everything on the Mac or phone that runs it (messages for 60 days or the newest 1,500 per account) and isn't in Unlocked, whose chats stay only in that browser. You can turn Autopilot off or remove an account under Settings → Connected accounts. The connected service may retain its own copies under its policy.
Payments and age checks
Stripe handles payments for Hemmingway services sold through Stripe and receives your card details. Our server does not receive your full card number. It keeps your plan, Stripe customer identifier, and API credit purchases and usage.
Patreon handles Unlocked memberships under its privacy policy. To provide access, we receive and retain your email address, Hemmingway account identifier, Patreon member identifier, membership tier, payment status and usage totals. We keep membership information while needed to provide access and close the account, and usage totals for 90 days. Financial records may remain for periods required by applicable accounting or tax rules.
Hemmingway Unlocked is for adults aged 18 or over, or any higher minimum age required where they live. At sign-up, we ask you to confirm that you meet this requirement. We record the confirmation and its date with your account until account deletion. Patreon handles any checks it requires under its own policy. If another age-assurance method is required for access in a particular location, we will explain the method, information handled and retention before collecting it; access may be restricted where we cannot meet the applicable requirements.
Deleting a Hemmingway account does not itself cancel a Patreon membership. Cancel that membership through Patreon to stop future charges.
Website and product analytics
We measure visits to hemmingway.io ourselves, without an outside analytics service or analytics cookies. Measuring our ads is separate; see Advertising below. We record the page, referring site or link, country inferred from the IP address, and device, operating system and browser type. We do not retain the IP address in these website analytics records.
A random identifier in your browser's local storage helps recognise returning visits and their original source. Where the law requires it, we ask permission before storing it. If you decline, or send Global Privacy Control or Do Not Track, we do not store that identifier. Without it, visits are counted using a code derived from the IP address that changes daily. When you sign in, visits from that browser, including earlier visits, are associated with your account. These records are therefore not necessarily anonymous. Clearing site data removes the browser identifier. Analytics records are kept for about 13 months.
For signed-in web and Android use, we also record onboarding progress, message events and thinking level, feature use, reply failures, plan or checkout visits and page errors. These records contain no prompt or reply text. After account deletion, analytics records remain for their remaining retention period without their account association.
Hemmingway Unlocked uses essential storage for sign-in and access, but does not use the optional analytics described above, advertising trackers or other optional analytics.
Advertising
We advertise Hemmingway on Facebook and Instagram and use Meta's tools to measure those ads. hemmingway.io stores two Meta cookies in your browser: _fbc, which records the ad you clicked if you came from one, and _fbp, a random browser identifier. The hemmingway.io home page also loads Meta's pixel, which tells Meta that the page was viewed and its address. The app does not load it.
When you create an account, and when you first pay for a plan, our server tells Meta your email address and account identifier in hashed form, your IP address and browser type, those two cookies, and for a plan its price and currency. Meta uses this to measure and improve our ads under its privacy policy. We never send your chats, memory, People or anything you write. We keep the cookies, IP address and browser type sent at sign-up for 30 days, to send with a first payment in that time.
We do none of this if your browser sends Global Privacy Control or Do Not Track, in the desktop app or in Hemmingway Unlocked. You can also block or clear the cookies in your browser.
Technical records and support
Crash reports are optional. They can include app version, operating system, crash location, error message and function names. We remove apparent folder paths and email addresses before retaining a report. Reports contain no messages, prompts or names, are not linked to your account, and are kept for 90 days.
Hemmingway Unlocked is designed to refuse requests that breach our content rules. We do not retain conversations for routine human review. Contact support if you wish to challenge an access restriction and request human review.
If you contact support or submit a report, we receive what you choose to send and our correspondence. Send only the context needed to understand the issue. You may include a short relevant text excerpt unless you believe the excerpt itself is illegal to share. Do not forward suspected illegal images, videos or attachments; describe the concern first. A report does not give us access to your other device-only chats.
We use these records to respond, investigate problems and resolve abuse or disputes. Access is limited to people who need them for those purposes. We retain them while the issue and necessary follow-up remain open, or as required for a relevant dispute or legal obligation, then delete or anonymise them. Where necessary and lawful, we may share the minimum relevant information with payment providers or public authorities to address an incident, dispute or legal requirement.
Service providers and international processing
Our services use Vercel for hosting, Neon for databases, Resend for sign-in emails, Stripe for payments, Google for optional sign-in and Meta for measuring our ads. Rented computing infrastructure runs our model. Unlocked uses GPU infrastructure rented through the Vast.ai marketplace and Patreon for memberships. These arrangements do not authorise providers to train models on your private chats.
Our service providers operate internationally, so your information may be processed outside the country where you live. For Hemmingway Unlocked, processing locations depend on the GPU hosts we rent through Vast.ai and may change when we change hosts.
We take appropriate measures to protect information against unauthorised access, loss and misuse. No system guarantees absolute security. Protect access to your devices and accounts, particularly where chat history is stored locally.
Your privacy rights
Settings let you download information our server holds for your account, delete account-saved chats, memory and People while keeping the account, or delete the account itself. Device-only information must be deleted on the device. Account deletion removes active account information and saved content. Sign-in and usage records are otherwise subject to the 90-day limits above; unlinked optional crash reports expire after 90 days. Analytics remain without their account association for the remainder of their approximately 13-month period. Relevant billing records may remain for mandatory accounting or tax periods, and limited information may remain where necessary for an existing dispute or legal obligation.
Deleted account information and saved content are not retained in backups.
Where a legal basis is required, we process information to perform our contract with you, meet legal obligations, pursue proportionate legitimate interests in security and service support, or with consent where required. You may withdraw consent without affecting earlier lawful processing.
Depending on applicable law, you may request access, correction, deletion, restriction, objection or a portable copy of your information. Contact team@hemmingway.io. You can complain to South Africa’s Information Regulator or your relevant local supervisory authority.
Changes of operator and policy updates
Operation may in future transfer to another legal entity. No transfer is required or scheduled by this policy. Before a change of controller, we will identify the new entity, country, contacts and effective date, and explain any changed processing or international safeguards. Only records needed to continue the service or meet existing obligations will transfer lawfully, with consent where required. A transfer gives no access to device-only history and no permission to train models on your private writing.
We will update this policy when our practices change, and provide notice or obtain consent where required.