Privacy policy

Hime is made by Hime Group, LLC, a US company (“Hime,” “we,” “us”). This policy covers the Hime iOS app, the web app at app.hime.ai, and the Hime CLI. It does not cover other companies’ apps, including AI agents you choose to connect.

Questions, requests, complaints: support@hime.ai. That is also the address for every right described below — access, deletion, correction, opt-outs, everything.

Hime is iPhone only at launch. It is not directed at children under 13, and we do not knowingly collect information from anyone under 13.

What Hime is

Hime is a personal planner: tasks, events, notes, bookmarks and files, organized in a Backlog, a Today view, and a Library. You can also connect your own AI agents (Claude Code, Codex, and similar tools) to read and act on that same workspace through the Hime CLI.

Where your data lives

Your tasks, events, notes, bookmarks and files are stored in one SpacetimeDB database that we run ourselves, on our own server at db.hime.ai. This is not a third-party cloud storage service; it is infrastructure we operate. The app talks to it directly over a WebSocket connection.

Account and sign-in

To create or sign in to an account, you give us your email address. We send a 6-digit code to that address to verify it, using Resend (see “Email delivery” below), and we store the address on your account so you can sign in again from a new device.

Some accounts still use our earlier 12-word recovery-phrase system. Those phrases are never sent to us and cannot be recovered by us if lost.

You can also link a second device to your account. Doing so gives that device access to your workspace, and you can remove a linked device at any time from the Devices screen.

Before you have an account

While you’re on the welcome and sign-up screens, the app sends us a record of which of those screens your install reached — for example, that it reached the email step, or the sign-in step. This is anonymous: it’s tied to a random id generated on your device, not to your email address or account, and we can’t connect it back to you once you do create an account. It’s how we see where people get stuck in sign-up, not how we watch what a signed-in user does.

Your content

Tasks, events, notes, bookmarks, and files you create are stored on db.hime.ai in plain, non-end-to-end-encrypted form, because our server has to be able to serve them back to your devices. We do not sell this content, and we do not use it to train AI models. We look at it only to operate the service, investigate abuse, or respond to a legal request.

The credential vault

Hime includes a vault for storing secrets, such as API keys, that your agents may need. The vault is end-to-end encrypted: the key that unlocks it is derived on your device, and we never have access to that key or to the decrypted contents. We store only encrypted ciphertext.

This has a real consequence. If you lose every device signed in to your account and lose your recovery phrase, the contents of your vault are permanently unrecoverable. There is no reset, no support-ticket workaround, and no way for us to decrypt it. That is a deliberate trade-off for genuine end-to-end encryption, not a bug.

Calendar

If you grant calendar permission, Hime creates a dedicated “Hime” calendar on your device and keeps it in sync with your Hime events. Hime does not read or write any other calendar on your device, and does not touch Reminders. Event details you create in Hime — titles, times, notes — sync to our server the same way tasks and notes do.

Microphone, dictation, and voice

Dictation. When you use push-to-talk to dictate a message, speech-to-text runs entirely on your iPhone using Apple’s on-device speech recognition. Your voice audio never leaves your phone for this. If your device or language doesn’t support on-device recognition, dictation is disabled rather than silently sending audio to a server.

Live voice calls (Pro). Pro lets you have a live, spoken conversation through your connected ChatGPT account. During a call, your microphone audio is sent over a direct WebRTC connection to OpenAI’s real-time voice model, and OpenAI’s spoken reply is streamed back to your phone. This is the one place where raw audio leaves your device.

Connected agents: the most important thing to understand

Hime lets you connect your own AI agent — Claude Code, Codex, or a similar tool — to your workspace using the Hime CLI, on a machine you control.

Hime supplies no AI model in this path. Your agent is software you chose and configured, running under an account you hold with its own provider. That agent reads and writes your Hime workspace the same way you do, using your credentials. Whatever that agent does with your data — what it sends to its own model provider, what it logs, what it stores — is governed entirely by that agent’s own privacy policy and terms, not by ours. We have no visibility into what a connected agent does once it has read your data, and no ability to control it.

If you want to know what happens to your data once your agent reads it, read that agent’s privacy policy.

Hosted agent (Pro)

Pro includes a hosted agent running in a sandbox we operate. You connect your own model provider account, and the agent sends relevant conversation and workspace content to that provider to carry out your requests. Live call audio goes to OpenAI, as described above. Your provider’s terms and privacy policy apply to its processing.

API keys and login codes entered in Hime are encrypted to your sandbox before being relayed through our database. The sandbox decrypts and stores credentials so it can use your provider account. We operate the host infrastructure; this is separate from the end-to-end encrypted credential vault described above.

After Pro access ends, the sandbox stops and its data is retained for 30 days before permanent deletion. See the Subscription Terms.

Staff access and billing records

Our admin console shows account metadata, plan, usage counts, payment history, and sandbox status. It does not expose task, note, file, or chat contents or allow staff to impersonate you. Administrative account inspections and changes are logged.

We retain subscription events and payment records for billing, reconciliation, fraud prevention, and accounting, including after account deletion where required. These records include the payment provider, amounts, currency, taxes, fees, and transaction identifiers. We do not store full card numbers.

Crash and diagnostic reporting

We use Sentry to catch crashes and errors, and only in preview and production builds. Development builds never send anything. Before anything is sent, the app strips:

• console log breadcrumbs entirely
• query strings and hashes from any URL
• request bodies, cookies, and headers
• any attached user or “extra” data

We do this deliberately, because request bodies can contain your notes, tasks, tokens, or recovery words, and none of that is allowed to reach Sentry. Screenshots and view-hierarchy captures are also disabled.

Analytics

On hime.ai we use PostHog, hosted in the United States, to see which pages people visit and how they found us. We collect page views, referrer, approximate location from the IP address, device and browser type, and the actions you take on the site, such as joining the waitlist. We record how pages are used, such as clicks, scrolling and moving between pages, to find confusing spots. Anything you type into a form is hidden from these recordings. In the EU, EEA, UK and Switzerland we only set cookies if you accept them; if you decline, we count visits without cookies or any stored identifier. Elsewhere we set a first-party cookie that is shared with app.hime.ai, so a visit to the site can be linked to your account once you sign in. We don’t use this data for advertising and we never sell it.

We also record how the web app is used, such as which screens you open and where you click, to fix bugs and confusing screens. All text, form inputs, images and files are masked in your browser before anything is sent, so a recording never shows your notes, tasks, files or chats.

Payments

Stripe processes subscriptions bought on the web and through the US iPhone storefront’s external checkout. Apple processes in-app purchases in other storefronts. Payment details go directly to the selected processor. We receive transaction and subscription records needed to provide access and maintain billing records. Stripe may collect billing location information to calculate applicable tax.

Email delivery

Transactional email, including sign-in codes, billing notices, and sandbox deletion warnings, is sent through Resend. Resend processes your email address and message content only to deliver that email on our behalf.

Third parties, summarized

We do not run advertising, we do not sell your data, and we do not share it for cross-app tracking. Our iOS privacy manifest declares NSPrivacyTracking: false.

Account deletion

You can delete your account at any time from the Manage Account screen, or from our delete account page.

Deleting schedules a purge: everything — tasks, notes, events, and files — is permanently deleted 30 days later. If you sign back in before those 30 days pass, the deletion is cancelled automatically and nothing is lost. After the 30 days, deletion removes your workspace, entities, vault contents, agent links, chat history, device links, and account record from our database.

Your rights

If you’re in the EU or UK

You have the right to access the personal data we hold about you, correct it, delete it, receive a portable copy of it, object to our processing, and withdraw consent where processing relies on it. Email support@hime.ai to exercise any of these, and we’ll respond within the time the GDPR requires.

If you’re a California resident

You have the right to know what personal information we collect, request its deletion, correct inaccurate information, and opt out of the sale or sharing of your personal information. We do not sell or share your personal information, so there is nothing to opt out of on that front, but you can still submit a request to know or delete at support@hime.ai.

Changes to this policy

If we materially change this policy, we’ll update the date at the top and, where required, notify you directly.