Security and privacy
Where your data goes,in plain words.
What HeroSpace reads, what it keeps, where its AI runs and every company that touches your data on the way.
Updated
01The short version
Your mail stays in Gmail.
HeroSpace reads your mail from Google as you use it and keeps no copy of your mailbox. Calendar, tickets and meeting notes work the same way.
Our AI reads only what it needs.
Summaries, drafts and the chat run on HeroSpace’s servers, on OpenAI models hosted by Microsoft Azure. To sum up a thread, it reads that thread, and no one trains AI on it.
Agents ask before they act.
You pick what HeroSpace’s AI and your agents can do in each app. Changes there wait for your yes, and Activity lists the calls they made.
02How it moves
How your data moves
Every arrow is encrypted in transit (TLS)
Your Mac
The app
- Summaries stay on your Mac. What it saves to open faster is encrypted with your Keychain
- A synced copy of your tasks, notes and settings
- Signing out clears it
HeroSpace’s servers
On Cloudflare, PlanetScale and Fly.io
- Pass your mail, events and tickets between your apps and your Mac, without keeping them
- Run HeroSpace’s AI, sending each job only what it needs
- Keep your tasks, notes, chats, settings and memory
- Keep your app sign-ins encrypted. They never reach the app or an agent
- Keep each agent call to your apps, encrypted, for 30 days
Your apps
Gmail, Google Calendar, Plain, Granola
- Your mail, events, tickets and meeting notes stay where they are
- Drafts and emails you send later are Gmail drafts until they go
- Disconnect an app anytime in Settings › Integrations
Agents you connect send what they read to the company behind them, like Anthropic, OpenAI or Cursor, under your account and their terms.
03The details
Your mail and calendar
When you open Mail, HeroSpace’s server asks Google for your mail, with the access you gave it, and passes it to the app. It doesn’t store your messages or attachments.
A few things are kept so features work: the ID and time of an email you snooze, send later or wait on a reply to, labels you add in HeroSpace, and tasks you make from an email, which can quote it.
If you say yes when HeroSpace asks, it adds your Google Contacts and the people you email or meet to your workspace’s Contacts, which everyone in the workspace sees: each one’s name, email address, photo and job title, never what an email or meeting said. Settings › Contacts turns it off, and HeroSpace never changes your Google Contacts.
HeroSpace’s AI
Summaries, quick replies, drafts, triage and the chat run on HeroSpace’s servers. Each job reads only what it needs, like the thread you’re summing up or the email you’re answering, and goes through OpenRouter to OpenAI’s models hosted by Microsoft Azure. When Azure can’t answer, a backup model on Amazon Web Services or Google Cloud does.
None of them train on it. They may keep a request for up to 30 days to check for abuse.
Sorting only picks from fixed labels, like what a thread needs from you, and writes no text. In the chat, changes HeroSpace’s AI makes in your apps follow the permissions you set, and wait for your approval unless you allow them.
App sign-ins
When you connect an app, its sign-in is kept encrypted and used only by HeroSpace’s server to call that app for you. Google sign-ins are kept by Composio, which connects HeroSpace to Google. No sign-in ever reaches the Mac app, the AI or your agents.
Activity
Settings › Activity lists every call HeroSpace’s AI or one of your agents made to your apps. Their details are kept encrypted for 30 days, then deleted.
Your own agents
Claude, ChatGPT, Codex, Cursor and other agents can work with your HeroSpace through its MCP server, from any device. Each one signs in as you, and you can disconnect it anytime.
A connected agent acts as you, and its changes in your apps follow the permissions you set. What an agent reads goes to the company behind it, under your account and their terms.
On your Mac
Summaries are kept on your Mac only. So it opens fast, the app keeps a synced copy of your tasks, notes and settings, and what it fetched lately, which it encrypts with your Mac’s Keychain. Signing out clears them.
What we keep, and for how long
Your account, workspace, tasks, notes, chats, settings and memory stay until you delete them or your account. Our servers keep nothing the AI read for a summary or a draft. Agent calls to your apps are deleted after 30 days. Error reports and logs never include what an email or note says.
04Providers
Every company that touches your data
And what each one does. None of them may use your data for anything but running HeroSpace, and none trains AI on it.
- Cloudflare
- Hosts our servers and this website, stores files and sends our emails.
- PlanetScale
- Our database, in the United States.
- Fly.io
- Keeps your workspace in sync across your Macs.
- Microsoft (Azure OpenAI)
- Runs the OpenAI models behind HeroSpace’s AI.
- Amazon Web Services (Bedrock)
- Backup AI models, when Azure can’t answer.
- Google Cloud (Vertex AI)
- Backup AI models, when Azure can’t answer.
- OpenRouter
- Passes HeroSpace’s AI requests to the model providers above.
- Composio
- Connects HeroSpace to Gmail and Google Calendar.
- PostHog
- Usage counts, error reports and logs, with your name and email. Never what an email or note says.
- Plain
- Runs the support chat in the app.
- Firecrawl
- Reads a company’s public website, and finds a person’s public profile by name and company, when you turn on lookups, people added from Google included.
- context.dev
- Looks up public details about companies and people, like a logo or a job title, when Firecrawl can’t find them.
- Its favicon service gives us a company’s logo when its website won’t show it to our servers. It gets the domain only.
Found a security problem, or need this for a review?
Write to support@hero.space. We answer security reports first, and we’ll fill in your company’s questionnaire.