Who we are
This policy covers the Hewy apps for Mac and iPhone, the Hewy Daemon you install on your servers, and our services at hewy.app and hewy.ai. Hewy is provided by Last Mountain Wireless Inc. ("we").
What we store, and why
| Data | Why |
|---|---|
| If you join the waitlist on hewy.ai: your email address and when you joined | To email you once, when Hewy launches. Then we delete the list. It's kept on our own server, not with a mailing service, and nothing else is kept with it. |
| Your email address | To find your account when you sign in. We don't email you during the beta. |
| A fingerprint of your login key, which your device derives from your master password | To check that it's you signing in. We never receive your master password. |
| Your account key, encrypted with a key only your password (or recovery code) can make | So a new device can unlock your data after you sign in. |
| Your synced data, encrypted on your device, padded so sizes reveal little | To pass it between your devices. We can't read it. |
| Device ids, their public keys, and when they sign in and sync | To keep each device signed in, and to let you see and remove devices. |
| Messages between your connected chats, while no Hewy app is open to carry them: sealed on your server for the other one, kept for a day at most, and deleted once collected. With them, the keys each server collects with, and their sizes and times. | To pass them between your servers. They're encrypted for the receiving server, so we can't read them. |
| Notification tokens from Apple, with a random id for each device | To deliver notifications from your servers. Their contents are encrypted for your devices; we only pass on ciphertext. |
| If you subscribe while signed in: your plan, when it renews or ends, whether it was refunded, and Apple's ID for the subscription | So your subscription can follow your account. Apple takes the payment; we never see your payment details. |
| Emails you send us | To answer you. |
Our web proxy keeps standard access logs (IP address, time and address requested) for a limited time, for security and troubleshooting. Rate limits use IP addresses briefly, in memory.
Where your data goes besides us
Your servers
Your devices connect to them over SSH, and the Hewy Daemon keeps your chats with agents there.
AI providers you choose
Agents on your servers send your prompts and code to Anthropic, OpenAI or the provider you picked, using your own API key or your Claude or ChatGPT plan. Their privacy policies apply.
Dictation
When you use the in-app microphone, the audio goes from your device straight to OpenAI using your OpenAI key. Without a key, or when OpenAI can't be reached, it's transcribed on your device and goes nowhere. Your keyboard's own dictation is handled by Apple.
Apple
Apple delivers notifications (as ciphertext), distributes the apps, and takes payment for subscriptions.
On your devices
Keys, saved passwords, API keys and your sign-in are kept in your device's Keychain, available only to Hewy on that device. SSH private keys never leave the device they were made on unless you export them yourself.
Keeping and deleting data
We keep your account until you delete it. Deleting it removes everything we store about it; copies in our backups are gone within 14 days. You can delete it yourself in Hewy: Settings → Account → Delete Account.
Children
Hewy is a tool for people who run servers, and isn't directed at children under 13.
Changes
If this policy changes, we'll update this page and its date. Significant changes will be explained in the app.
Contact
Email support@hewy.ai. During the beta, TestFlight feedback in the app reaches us too.
