Privacy Policyfor HeroSpace.

NextUI Inc. ("HeroSpace," "we," "us," or "our") makes the HeroSpace website, the HeroSpace desktop app for Mac, and the services behind them (together, the "Service"). This Privacy Policy explains what personal information we collect when you use the Service, how we use and share it, how long we keep it, and the choices you have.

HeroSpace brings your mail, calendar, support tickets, meeting notes, tasks, and notes into one app, connects to the apps you choose, and works through AI coding agents you run on your own Mac. This policy also explains what happens to information that passes between HeroSpace, those apps, and those agents.

When you use a workspace managed by an organization, that organization may decide who in it can see shared information, and its own policies may also apply. Questions about this policy or your information can be sent to support@herospace.ai.

• Account information. Your name, email address and whether it is verified, profile photo, account identifier, and how you sign in (an email code, Google, or GitHub). We do not receive your Google or GitHub password.
• Settings and preferences. Your time zone, appearance, notification choices, which agent and model handle each kind of task, whether Triage new tickets is on, and your draft settings, including any description you give of how you write and the addresses you ask us never to draft replies to.
• Workspace information. Workspace names, logos, websites, task prefixes, members, roles, and invitations.
• Your content. Tasks, notes (including the pictures, videos, and links you add to them), and files you upload.
• Agent runs and chats. When an agent works on a task or answers you in the chat panel, we save what you asked, the chat's title, the steps it took, the start of what its tools returned, what it asked you to approve, and the name of the Mac it ran on. They are visible only to you.
• Memory. Short notes about you that every agent HeroSpace starts reads first (Settings › Memory): what you write there, what an agent saves with your OK, what you import from another assistant, and what HeroSpace learns from how you change an agent's draft before you send it, with where each one came from. They are visible only to you.
• Suggested tasks. When HeroSpace suggests a task from your mail, a ticket, or a meeting, we save its title and description, who it is about, where it came from with a short quote, and whether you added or dismissed it, so it is not suggested again. Suggestions are visible only to you; one you add becomes a task in your workspace.
• Imports. A record of each import of notes, tasks, or memories: what kind, how many items, and which files were skipped.
• Feedback on summaries. When you mark a summary of mail, a ticket, or a meeting as helpful or not, we save your answer, what you said was off, which agent and model wrote it, the step it suggested, and a one-way code that tells summaries apart. We do not save the summary, or the mail, ticket, or meeting it came from.
• Connected apps. For each app you connect: its credentials, the account it belongs to, the permissions you set, the calendars or repositories you select, and a record of each action an agent took through it. See Connected Apps below.
• Sign-in records. Sessions, sign-in codes and verification records, and the tokens Google or GitHub return when you sign in with them.
• Technical information. IP addresses, device, operating system and app version, timestamps, errors, and the operational logs that come with running and securing the Service. The desktop app checks our servers for updates every hour.
• Communications. What you send us by email or through the support chat in the app.

Mail, calendar events, support tickets, and meeting notes from the apps you connect are read from those apps when you open them. We do not copy your mailbox, calendar, or tickets into a HeroSpace database; the exceptions are described in Connected Apps and Google User Data.

Please share only information you have permission to provide. You never need to send us a password or verification code when asking for support.

Your mail, calendar, tickets, and notes contain information about other people, such as people who write to you, guests at your meetings, and your customers. HeroSpace processes it only to show it to you and to do what you ask, on your behalf. You are responsible for connecting only accounts you are allowed to use and for using other people's information lawfully. If you want information about you removed from someone's HeroSpace account, ask them, or write to support@herospace.ai and we will help.

We use information to:

• Provide the Service: sign you in, keep your workspace in sync across your devices, and show your mail, calendar, tickets, meeting notes, tasks, and notes.
• Do what you ask in the apps you connect, and what the features you turn on do for you.
• Hand content to the agent you choose when you use an agent feature.
• Prefill a new workspace's name, logo, and website from the company behind a work email.
• Send sign-in codes, the notifications you ask for, and essential account and security messages.
• Answer support requests, find and fix errors, and keep the Service reliable.
• Learn which summaries help, from your feedback on them.
• Detect abuse, protect accounts, enforce our terms, and meet legal obligations.

Where a legal basis is required, we process information to provide our services under our agreement with you, for legitimate interests such as security and support, to comply with law, or with your consent where required, for example when you connect an app. You may withdraw consent without affecting the lawfulness of processing that happened before withdrawal.

We do not sell your personal information, use it for advertising, or use your content to train AI models.

You can connect Gmail, Google Calendar, GitHub, Plain, and Granola during onboarding or in Settings › Integrations. Each connection uses the app's own sign-in, and you approve what HeroSpace may do on that app's consent screen. Gmail and Google Calendar connect through Composio, so Google's consent screen names Composio.

• How we use a connection. To show you that app's information in HeroSpace, to do what you ask there, such as sending a reply or moving a meeting, and to let your agents use it within the permissions you set.
• Permissions. Every action a connected app offers is set to Allow, Ask, or Deny. A small set of reads starts allowed; everything else, including every change, starts at Ask. An action set to Ask waits until you approve that exact action in HeroSpace. HeroSpace's own screens also respect what you set to Deny.
• Credentials. Connection credentials are encrypted and kept only on our servers, except Gmail's and Google Calendar's, which Composio keeps for us (see Google User Data). They are never sent to the app on your Mac or to an agent.
• Records of agent actions. When an agent uses a connected app, we keep an encrypted record of the action, what it sent, and what came back, so an approval cannot be used twice and you can see what happened. That record can include an email, event, ticket, or meeting note the agent read. We delete it 30 days after the action.
• Sharing a connection. Connections start private. If you share one with your workspace, its current members can use it through their own agents under the permissions you set, which can include reading what that account holds. They never receive its credentials, and actions set to Ask still wait for your approval.
• Disconnecting. Disconnecting in Settings › Integrations deletes the stored credentials, cancels pending actions, and stops HeroSpace's access. For GitHub, Plain, and Granola we also ask the app to revoke our access. For Gmail and Google Calendar we delete the connection at Composio; to end Google's grant too, remove Composio in your Google Account connections, which also ends it for any other app you connected through Composio.

Connected apps are run by other companies under their own terms and privacy policies, which govern the information they hold.

This section applies when you sign in with Google or connect Gmail or Google Calendar. It describes how HeroSpace accesses, uses, stores, and shares data received from Google APIs.

What we access.

• Sign in with Google: your name, email address, and profile photo (the openid, email, and profile permissions), to create and identify your account. Signing in does not give HeroSpace access to your mail or calendar.
• Gmail, if you connect it: your messages and threads, including their content and attachments, labels, and drafts (gmail.modify), within the permissions you approve on Google's consent screen.
• Google Contacts, with Gmail: the names, email addresses, and photos of the people you saved in Google Contacts and of your other contacts, the people you have emailed (contacts.readonly and contacts.other.readonly). HeroSpace only reads them.
• Google Calendar, if you connect it: the list of your calendars, your events with their guests, places, and descriptions, and free and busy times (calendar.calendarlist.readonly, calendar.events, and calendar.events.freebusy).

How we use it.

• To show your mail, attachments, and calendar in HeroSpace and do what you ask: archive threads, mark them read or unread, write, attach files to, send, or discard replies, create, change, cancel, or delete events you organize, answer invitations, and color events.
• To suggest who an email or invitation goes to as you type, from your mail, your contacts, and the meetings on your calendar.
• For features you turn on: auto drafts read new mail that waits on you and save a reply as a draft in your Gmail, which you review and send yourself. "Only to people you've emailed" searches your sent mail for the sender's address.
• When you use an agent feature, or your agent uses your Google connection, the relevant message or event goes to the agent you choose, as described in AI Agents.

We do not use Google user data for advertising, sell it, use it to determine creditworthiness or for lending, or use it to develop, improve, or train generalized AI or machine-learning models. No one at HeroSpace reads your Google user data unless you ask us to, for example for support, it is needed for security or to investigate abuse, or the law requires it.

How we store it.

• We do not copy your mailbox or calendar into a HeroSpace database. Screens read from Google when you open them.
• Composio, which connects Gmail and Google Calendar for us, keeps your Google connection's credentials, encrypted, and adds them to each request HeroSpace sends to Google, so they never reach HeroSpace. Composio keeps a log of those requests, including what Google sent back, for up to one year.
• Records of agent actions through your Google connection are encrypted and deleted 30 days after the action. The runs of agents that read your mail or calendar for a task stay with your account.
• The desktop app keeps an encrypted copy of what you recently viewed on your Mac for up to two weeks, removed when you sign out, and attachments you open in a temporary folder cleared after a day.

How we share it. Google user data is shared only with the providers that run the Service for us (Cloudflare, PlanetScale, and Composio, which carries every request to Google, and our sync service for the agent runs and suggested tasks that quote it); with the agent you choose when you use an agent feature, which sends it to its provider under your own account; and with members of your workspace if you share the connection with them, whose agents can then ask to use it, each request waiting for your approval. It is never sold or transferred to data brokers or advertising platforms, and is shared with anyone else only with your consent, for security or abuse investigations, or as required by law. In a merger, acquisition, or sale of assets, it is transferred only with your prior consent.

Revoking access. Disconnect Gmail or Google Calendar in Settings › Integrations, and remove Composio in your Google Account connections. Drafts HeroSpace saved and events it created stay in your Google account. Records kept with your HeroSpace account are deleted with it.

HeroSpace's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

HeroSpace does not run AI models, and we do not send your content to an AI provider ourselves. Its agent features work through coding agents you install and sign in to on your Mac: Claude Code, Codex, or Cursor. When you use one, HeroSpace hands the relevant content to that agent on your Mac, and the agent sends it to its provider (Anthropic, OpenAI, or Cursor) under your own account. That provider's terms and privacy policy apply, including its settings on whether it trains on your data, so review them before you use an agent with sensitive information.

What each feature hands the agent:

• Tasks: what you ask, and whatever the agent then reads through HeroSpace's tools.
• Mail: your draft, when you ask an agent to write or change it. To write a reply from nothing, Claude Code also receives the latest message. If you turn on auto drafts, the drafting agent reads the latest messages of new threads that wait on you.
• Support: the ticket, when an agent drafts a reply or sums it up. If you turn on Triage new tickets (in Settings, under Agents), Claude Code also reads each new unanswered ticket you open, to suggest labels, a priority, or whether it is spam.
• Calendar: a meeting's details, when you ask an agent to schedule, change, reschedule, or summarize it, or to write a note to its guests. A summary also reads related mail and meeting notes.
• Notes: the open note, when you ask an agent to write or change it, and a to-do you send to an agent.
• Chat: what you ask, the page you are on unless you take it off, and whatever the agent then reads through HeroSpace's tools.
• Summaries: the thread or ticket, when you press Summarize or turn on summaries for new mail or tickets, so Claude Code can say what it needs from you and suggest tasks on Up next.
• Memory: an agent's draft, what you asked for, and what you sent, when you send a draft an agent wrote after changing it, so Claude Code can note how you write.

Auto drafts, Triage new tickets, summaries, memory, and replies written from nothing run Claude Code with every tool turned off, so the agent can only read what HeroSpace hands it and cannot act on it. Agents that read mail, tickets, or invitations for you can't reach a browser or other apps, and can't change your notes or tasks without asking. Whatever tools an agent has, its changes in your connected apps follow the permissions you set, and by default each one waits for your approval.

While the desktop app is open, it runs a HeroSpace server for agents (an MCP server) that only programs on your Mac can reach. When you choose Connect for an agent during onboarding or in Settings › Agents, HeroSpace adds that server to the agent's own settings. Claude Code, Codex, Cursor, Grok, and Claude Desktop can connect.

A connected agent acts as you. It can see your workspaces, read and change your tasks and notes, and use your connected apps within the permissions you set. It reaches only what you can reach in HeroSpace.

What an agent reads from HeroSpace is then handled by its provider under that provider's own privacy policy. You can disconnect an agent in Settings › Agents, which removes HeroSpace from its settings.

• Within your workspace. Other members may see your name, email, profile photo, role, tasks, and what you choose to share. Your notes, memory, chats, and suggested tasks are visible only to you, and agent runs and connections start private. Workspace administrators manage membership and access.
• With service providers. Providers process information only for the work they do for us, under agreements with us:
  • Cloudflare hosts our API and website, stores uploaded files, sends sign-in emails, and delivers desktop downloads and updates.
  • PlanetScale hosts our database in the United States.
  • Composio connects Gmail and Google Calendar: it keeps those connections' credentials and carries HeroSpace's requests to Google, logging them for up to one year.
  • Our sync service keeps your workspace up to date across your devices.
  • context.dev receives your email address when you create a workspace, to look up your company's name, logo, and website. Personal email addresses return nothing.
  • Plain runs the support chat in the app and receives your name, email address, and what you write when you use it.
• With apps and agents you choose. Connected apps receive the requests you and your agents make. Your agents and their providers receive what is described in AI Agents and Agents Connected to HeroSpace.
• With websites you link. When you paste a link into a note, our servers read that page's title, description, picture, and icon to show a preview. The site sees our servers, not you.
• Content loaded from elsewhere. Videos in notes play from YouTube, Loom, or Vimeo. Viewing an email's original loads its images from the sender's servers, as Gmail does, which can tell the sender you opened it. Profile photos may load from Google or GitHub. These services receive ordinary network information, such as your IP address.
• For legal and security reasons. We may disclose information when required by law or reasonably necessary to protect people, investigate fraud or abuse, or protect legal rights.
• In a business transaction. Information may be transferred as part of a merger, acquisition, financing, or sale of assets, subject to this policy. We will tell you before your information becomes subject to a different policy, and the stricter rules for Google user data above continue to apply.

Pictures in notes, profile photos, and workspace logos are stored at links that are hard to guess but not private: anyone with the link can open them. Other files require you to be signed in.

We do not sell personal information or share it for cross-context behavioral advertising.

Our database is hosted in the United States. Connection credentials and records of agent actions are encrypted with a key kept apart from sign-in, in a part of the database that never syncs to devices. On your Mac, your session and the copy of recently viewed mail, calendar events, and tickets are encrypted by macOS.

We use HTTPS, access controls that limit each request to what the signed-in person may see, restricted service credentials, and limited staff access. The agent server on your Mac refuses requests from web pages, other computers, and any program without its private address, which only the agents you connect are given. No method of storage or transmission is completely secure. If we learn of a breach that affects your information, we will notify you as the law requires.

The website remembers your theme in browser storage, and our sign-in uses cookies to keep you signed in and complete sign-in redirects. The download button checks in your browser whether your Mac has Apple silicon or an Intel chip to link the right download; the result is not sent to us. The website does not use analytics or advertising trackers.

The desktop app keeps on your Mac:

• Your session and preferences, and your progress through setup.
• Your synced workspace records, such as tasks, notes, and agent runs.
• A copy of recently viewed mail, calendar events, tickets, and meeting notes, so the app opens quickly. It is encrypted, kept for up to two weeks, and removed when you sign out.
• Attachments you open, in a temporary folder cleared after a day, and those you download, in your Downloads folder.
• A short record of the threads and tickets that auto drafts and Triage new tickets have already read, and what they made of them, and the summaries agents wrote of your mail and tickets.

Signing out, or signing in as someone else, removes everything above that belongs to your account from the Mac: your synced records, the copy of your mail, calendar, and tickets, summaries, and recent searches. Device settings such as your theme stay.

You can clear browser storage in your browser's settings. Clearing it or uninstalling the app may sign you out or reset preferences, but it does not delete your HeroSpace account.

We keep your account, workspace information, and content while your account exists. Deleting a note or task removes it from our database, and deleting a task also deletes its agent runs. Agent runs stay with your account until it is deleted. Records of agent actions through connected apps are deleted 30 days after the action. Logs are kept for a limited time and then deleted.

To delete your account, use Delete account in the app's Settings, which asks for a code we email you, or email support@herospace.ai from the address on your account and we may verify your identity first. We then delete your account, content, connections, the agent runs you started, workspaces no one else is in, and the records above. Tasks you created in a shared workspace stay with that workspace. Backup copies are removed as backups expire, and information we must keep for legal, security, or accounting reasons is limited to those purposes. Deleting your account disconnects your apps; to also remove the access you granted, revoke it in each app's own settings, such as your Google Account.

Signing out removes your account's records and the copy of your mail, calendar, and tickets from your Mac, but does not delete your account. Shared workspace records may be subject to your organization's instructions and other members' rights. Information an agent already sent to its provider must be managed with that provider.

You can see and change most of your information in the app: your profile and workspace in Settings › General, your apps and their permissions in Settings › Integrations, and your agents in Settings › Agents. For anything else, including a copy of your data, write to support@herospace.ai.

Depending on where you live, including under the GDPR, the UK GDPR, or the CCPA, you may have rights to access, correct, delete, or receive a copy of your personal information; object to or restrict processing; withdraw consent; or appeal our response. You may also complain to the privacy regulator responsible for your location. We will verify requests and respond within the time the law allows, and we will not discriminate against you for exercising these rights. If your account belongs to an organization, we may refer a request about its workspace records to its administrator.

We are based in the United States, and our database is hosted there. Cloudflare and our other providers may process information in other countries where they operate; Plain's support chat runs in the United Kingdom. Your agent's provider processes what your agent sends it wherever that provider operates. These countries may have privacy laws that differ from those where you live. Where required, we rely on appropriate safeguards for cross-border transfers, such as standard contractual clauses.

HeroSpace is for people 16 and older and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact support@herospace.ai and we will delete it.

We may update this policy as the Service or our practices change. The date at the top identifies the latest version. If a change is significant, we will tell you in the app or by email before it takes effect, and we will ask for your consent where required, including before using Google user data for a new purpose.

For privacy questions or requests, contact NextUI Inc. at support@herospace.ai. Your use of HeroSpace is also subject to our Terms of Service.