Your privacy
at Herald.

Who this policy covers

This Privacy Policy explains how Herald (“we”, “us”) collects, uses, shares, and retains personal information when you visit herald.run, join our waitlist, contact us, or use the Herald web and native apps. Herald is responsible for the account, waitlist, and website information described here. You can contact us about this policy or your information.

Herald delivers requests and responses between people and their connected agents. If someone includes your information in a request, they are responsible for having permission to do so. Their use of that information and the services they connect may be subject to separate privacy terms.

Information we collect

• Waitlist information: your email address, when you joined, the notice and consent versions shown to you, your launch-email request, the plan and website link that led you to sign up, optional marketing preference, and any unsubscribe status.
• Account information: your name, email address, verification status, profile image if supplied, linked sign-in provider identifiers, and session information. When you choose Google or GitHub sign-in, we receive the profile and email information needed to identify your account. We do not receive your Google or GitHub password.
• Inbox content: requests, responses, agent and connection names, forms, message context, attachments, task status, and timestamps that you or your connected agents submit.
• Device and technical information: IP address, browser and operating system information, sign-in activity, push-notification tokens, device preferences, error information, and request metadata needed to operate and protect the service. Waitlist rate limiting uses a keyed hash of the IP address rather than storing the address in the waitlist record.
• Support information: messages and attachments you choose to send us.

You may browse the public website without joining the waitlist. An email address is required to request access or create an account. Optional marketing consent is not required to join the waitlist or use Herald.

How and why we use information

We use personal information to deliver requests and responses, maintain your account and linked sign-in methods, synchronize your inbox, deliver notifications, provide support, prevent abuse, troubleshoot faults, and comply with applicable law.

Joining the waitlist requests emails about early access and public availability. We send other product news and marketing only if you separately opt in. We do not sell personal information or use inbox content to train AI models. Your connected agents and their providers operate under their own terms.

Where data-protection law requires a legal basis, we rely on your consent for waitlist and optional marketing emails; performance of our agreement with you for the service you request; our legitimate interests in operating, securing, and supporting Herald where those interests do not override your rights; and legal obligations where applicable. We do not use your information for solely automated decisions that produce legal or similarly significant effects.

When information is shared

Information is shared only as needed for these purposes:

• Your chosen connections and devices. Responses and dispatched tasks are delivered to the agent or runner you address. Notifications may pass through Apple or Google push services. Your device settings determine how notification content appears.
• Service providers. Cloudflare hosts our website, app infrastructure, databases, and file storage. Google and GitHub process sign-in when you choose them. Our support mailbox is hosted by Google. Providers that deliver our emails receive the recipient address and email content, not your inbox content merely because you joined the waitlist.
• Legal and security needs. We may disclose information when required by law or reasonably necessary to protect people, investigate abuse, enforce our agreements, or defend legal claims.
• Business changes. Information may transfer with a merger, acquisition, or transfer of the service, subject to applicable law and notice of material changes.

Payments are not enabled during this launch phase. We plan to use Lemon Squeezy when paid subscriptions open and will update the relevant notices before collecting payment-related information.

Storage, transfers, and security

Herald and its service providers may process information in countries other than where you live. Cloudflare operates a global network; we do not promise storage in a particular country. Where applicable law requires safeguards for international transfers, we use the relevant provider contractual safeguards or another permitted transfer mechanism. Contact us for information about the safeguards applicable to your data.

We use encrypted connections, authenticated access, scoped integration credentials, and controls intended to restrict access to information. No storage or transmission method is completely secure.

Message content and attachments are end-to-end encrypted on the device that sends them; Herald stores and delivers them without the keys to read them. Herald still processes metadata such as connection names, timestamps, status, deadlines and sizes. Secret-response fields are also excluded from ordinary message history and notifications; encrypted delivery is consumed once. Protect your agent credentials and recovery key, and avoid placing secrets in ordinary message fields.

How long we retain information

• Waitlist: we keep your address and preferences while your access request is active or you remain subscribed. When that purpose ends or you request deletion, we delete information that is no longer needed. We may retain a limited consent or suppression record to honor opt-outs and resolve disputes; it is not used to resume marketing.
• Messages and files: message history follows the retention period assigned when each record is created: currently 3 days for Community, 90 days for Starter and Pro. Plan changes do not retroactively change a record’s retention date. An attachment still referenced by another retained message remains available until those references expire.
• Accounts and support: we keep information while needed to provide your account, handle your request, meet legal obligations, prevent fraud, or resolve disputes. Contact us to request account deletion.
• Security records: session, rate-limit, and operational records are kept for their security and diagnostic purposes. Waitlist rate-limit keys expire after one hour and are removed during subsequent submissions. Provider backups and logs may persist for their applicable retention periods after active records are deleted.

Herald is not a permanent archive. Export or download anything you need to retain before its retention period ends.

Cookies and local storage

The app uses cookies to keep you signed in and protect authentication. Website and app preferences, such as your selected appearance, may be stored locally on your device. We do not currently use advertising cookies or third-party behavioral analytics on the public website. Our hosting provider processes technical request information to deliver and secure the site.

You can remove cookies and local storage through your browser settings. Removing essential cookies signs you out and may prevent some features from working. We will explain any new optional tracking and obtain consent where required before enabling it.

Your choices and rights

You can withdraw email consent at any time using the unsubscribe link in an email or contact us. Unsubscribing from the waitlist stops both launch and early-access notices and optional marketing. Necessary account and security messages are separate from marketing. Withdrawal does not affect processing that was lawful before withdrawal.

Depending on where you live, you may have rights to access, correct, delete, or obtain a portable copy of your personal information; restrict or object to processing; and complain to your local data-protection authority. Contact us to exercise these rights. We may need to verify your identity before responding and will respond within applicable legal time limits. Some information may be retained where the law permits or requires it.

To change a waitlist preference after joining, contact us. Submitting an email address again does not change an existing consent record. You control what you send to agents; disconnect or revoke an integration in Herald when you no longer want it to have access.

Children

Herald is intended for adults and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided information to us, contact us so we can investigate and remove it where appropriate.

Changes and contact

We may update this policy as the service or legal requirements change. The effective date identifies the current version. For material changes, we will provide additional notice where required and seek new consent when necessary.

For privacy questions, access or deletion requests, or email preferences, contact us.