Privacy policy

The essentials

• On your device: Hearth stores your Council history locally.
• With your AI providers: your council conversation and any context you share are sent to the AI services you choose. Their privacy policies apply.
• With us: we receive your email if you join the launch list, anything you send for support, and technical information handled by our website and update services.
• Your choices: you can export or delete local Council data and contact us to stop launch emails or request deletion of information we hold.

The sections below explain these points in more detail.

1. Who we are and what this covers

This policy covers the Hearth website, the local Hearth application, and communications with Devious Dog Labs LLC, a Virginia limited liability company (“we,” “us,” or “our”). For privacy questions and requests, contact us at privacy@deviousdoglabs.com.

AI providers, AI assistants installed on your computer, and other services you choose have their own privacy policies. Future hosted services will have additional disclosures before you enable them.

2. Your local Council data

Hearth stores your Council conversations, questions, responses, shared context, settings, and history on your device. Files you supply and local records used to troubleshoot problems may also contain personal information.

During ordinary Council use, Devious Dog Labs does not receive your conversation history to store on our servers. Your chosen AI services do receive the content needed to run your Council, as explained below. If you send us conversations, screenshots, or files for support, we receive those materials.

Storing data on your device does not guarantee that it is encrypted there. Protect your device, user account, and backups. Exported copies, backups made by your operating system, and records kept by other AI tools are managed separately from Hearth.

3. What your AI providers receive

Your council conversation and any context you share are sent to your chosen AI providers, under their policies. This can include relevant profile or project information, attached files or images, and content from local folders you allow Hearth to read. A Council can involve models from multiple AI labs and send more than one request.

If you use OpenRouter, requests pass through OpenRouter to the selected model providers. If you use a supported AI assistant installed on your computer, that tool handles its own connection to its AI service. Running Hearth on your device does not mean the AI runs offline.

These services may receive your shared content, account information, connection details such as your IP address, and records of your usage. Their terms and settings determine how long they keep information, whether they use it to train models, where they process it, and how it can be deleted. We do not promise that every provider immediately deletes your content or excludes it from training. Review the services your content passes through before sharing confidential information or information about other people.

An API key is a secret code that lets an app use your AI account. On Mac, Hearth stores its OpenRouter API key using the operating system’s built-in secure storage. Supported AI assistants installed on your computer manage their own sign-in information. Other ways of running Hearth may use local files or system settings to store keys.

Hearth or the connected tool must use the key or other sign-in information when making an AI request you authorize. Keeping a key on your device does not mean it is never sent over a network.

4. Information we receive

• Launch signup: your email address, when you signed up, and the fact that you requested Hearth first-look and launch news. The signup form sends this to our Hearth signup service, which runs on our hosting provider’s servers. To limit repeated attempts, the service also keeps a coded value derived from your IP address, called a salted, one-way hash. This is stored in a separate record that is not linked to your email address. An IP address identifies an internet connection. These attempt counts are used to limit repeated signups, and expired counts are cleared when later signup requests arrive.
• Support: your email address, correspondence, and any screenshots, files, or diagnostic information you choose to provide. Review those materials before sending them; do not send API keys or unnecessary sensitive content.
• Website and download requests: Our hosting and security provider delivers and protects the website, update feed, and downloads. This infrastructure can receive IP addresses, request times, requested paths, browser or app information, and security-related records.
• Software updates: the native app checks for updates and downloads release information and application files. The servers handling these requests can receive connection details such as your IP address, request time, and the files requested. Hearth turns off the updater’s optional system-profile reporting, which sends details about your computer; the servers can still keep request records.

If we introduce purchases or license activation, we will first describe the payment and licensing services involved and explain what customer, payment, license, and device-activation information they process. This policy does not describe those systems as already in use.

5. How information is used and disclosed

We use the information we receive to send requested Hearth first-look and launch news, answer support requests, deliver and secure the website and updates, diagnose reported problems, and meet applicable legal obligations. We do not use your local Council conversations as an advertising profile or collect them for our own model training.

Service providers may process information needed to deliver forms, email, hosting, downloads, or support. These include hosting and security providers for the website, signup handling, update feeds, and downloads, and email service providers for launch messages and support correspondence. We may disclose information when legally required, to protect people and systems, or in connection with a business transfer subject to applicable privacy obligations. We do not sell personal information or share it for cross-context behavioral advertising (advertising based on your activity across different services).

Where applicable law requires a legal basis, we rely on consent for requested marketing, the steps necessary to provide a requested product or support service, legitimate interests in secure and reliable operations where permitted, and compliance with legal obligations. These purposes do not give us unrestricted permission to reuse your information.

6. Cookies and tracking

The current website code includes no advertising pixels or analytics scripts. The app may save preferences such as panel sizes on your device. It may also save recent activity times there to show when you are away and when the Council is inactive. The website’s example conversations run in your browser and do not call AI services. Our hosting and security provider may process technical information and set cookies needed to secure the website and signup form. These are not used to track you for advertising.

Hearth does not use the website to track you across unrelated websites for advertising. The current site does not change its behavior in response to a browser’s Do Not Track signal. Any additional handling required for legally recognized privacy preference signals will be documented before relevant processing begins.

7. How long information is kept and how to delete it

Your local Council data remains on your device until you delete it or remove the relevant storage. Uninstalling the application may leave application data, saved API keys or sign-in information, or backups behind. Use Hearth’s controls to delete your data, and check backups, exported copies, and records kept by other AI tools separately.

We keep signup information while needed to provide the updates you requested, unless you ask us to stop or delete it.

A deleted signup can remain in our hosting provider’s database recovery history for up to 7 days; if we ever restore from that history, we delete it again.

Support messages and records used to operate our services are kept only as needed for support, security, resolving disputes, and applicable legal requirements.

When you opt out or ask us to delete your signup, we delete the signup record and keep your request with our support correspondence so we can continue to honor it. If we later use an email-sending service, it may keep a minimal record of your opt-out so you are not emailed again.

Records kept by AI providers follow each provider’s rules about how long information is kept. We cannot erase a provider’s independent records or copies controlled by you or another person.

8. Your choices and requests

You can export or delete local Council data and manage provider connections in Hearth. To revoke an API key or other access, use the service that issued it. To stop Hearth launch emails or request access, correction, or deletion of information we hold, contact privacy@deviousdoglabs.com. Marketing messages will provide a way to opt out. We honor marketing opt-out requests within 10 business days, without a fee or requiring information beyond your email address and opt-out preferences.

Depending on where you live and which laws apply, you may also have the right to receive a usable copy of your information, ask us to limit or stop certain uses, withdraw your consent, or complain to a privacy regulator. We may ask for information needed to verify your identity before acting on a request. We respond within applicable legal deadlines and explain any lawful reason we cannot fulfill a request. Withdrawing consent does not affect processing that was lawful before withdrawal.

9. Security and processing locations

We use safeguards appropriate to the information and services we operate. No system is completely secure. We will notify affected individuals and authorities of security incidents when required by applicable law. AI services, form processing, email, and hosting may process information outside your home country, including in the United States and other countries where our service providers operate.

10. Adults only (18+)

Hearth is intended only for adults aged 18 and older and is not appropriate for minors. Anyone under 18 may not use Hearth or join the launch list. We do not knowingly collect personal information from anyone under 18 through signup or support. If you believe a minor has provided personal information to us, contact privacy@deviousdoglabs.com so we can investigate and delete that information as appropriate.

11. Changes and contact

This policy’s effective date appears at the top. Later versions will identify their revision date. We will provide notice of material changes and obtain additional consent where required before using information for a materially different purpose. Questions and requests can be sent to privacy@deviousdoglabs.com.

Mailing address: Devious Dog Labs LLC, PO Box 16016, Washington DC 20041.