Hirsla Privacy

What stays on your device

Your cards, their text, their summaries, and the facts read out of them. Photos, PDFs, files, and recordings you save. Your own notes. The search index.

The reading happens there too. Titles, summaries, tags, facts, transcription of voice memos, reading handwriting, search and Ask all run on your device. Nothing is sent anywhere to be read, and no part of your library is used to train anything.

On the Mac, the clipboard is kept only when you press Control-Command-V, choose Keep in the menu bar icon, or choose Keep the Clipboard in Spotlight; until then the icon shows only what kind of thing is there. A card kept this way notes the name of the app it came from. The Spotlight index of your cards stays on the Mac.

What leaves your device

Five things, and nothing else.

Saving a link loads that page. When you share a link into Hirsla, your device fetches it from whichever server it lives on, to read its title, description, and preview image. That server sees the request, as it would in any browser. It does not come to me. A YouTube or Vimeo link is read through that service’s own preview service instead, for its title, channel, and thumbnail, which come from that service’s servers. A link’s preview is loaded again if its saved image is gone, and saved links are read again after an update that improves how they are read.

Places are looked up in Apple Maps. Saving a place, and showing a card on the map, asks Apple Maps for the name and address. A Google Maps link is opened once at Google, to find out which place it is. When Apple Maps knows a place’s own website, that website is loaded once, so the card can be found by what is on it. If you switch on “Save where I capture”, the place where you saved something is turned into an address the same way. This is Apple’s service, under Apple’s privacy terms.

iCloud sync goes through your own iCloud. Sync is on by default and can be switched off in Settings. When it is on, your cards and their originals travel through your personal iCloud account, in a private database only your Apple ID can open. It is Apple’s infrastructure, not mine, and I have no access to it. A few settings, such as appearance and the fleeting days, follow you to your other devices the same way.

Purchases go through Apple. Card packs are bought with Apple’s in-app purchase system. Apple handles the payment and tells the app that a purchase exists. I never see your name, your payment details, or your Apple ID. I see sales totals in App Store Connect, the same as any developer.

A problem report you choose to send. If you use Report a problem, your mail app opens with a diagnostics report and recent app logs attached, and you send it to me. Together with feedback you choose to send, that is the only way anything from the app reaches me, and it only happens when you decide to send it. You can read the attachment first, and remove it.

Nothing goes to me, and nothing goes to an AI company, unless you choose to send feedback or a problem report, or connect an AI app on your Mac.

AI apps you connect on the Mac. In Settings › Connections you can let AI apps on your Mac, such as Claude or ChatGPT, search and read your cards. It is off until you turn it on and confirm. Hirsla sends nothing anywhere: the AI app asks on your Mac, and what it reads then goes to that company, under its own privacy rules, and Hirsla cannot take it back. An app can add notes and links only if you allow it, and no app can change or delete a card. From version 1.3, People stay out of reach unless you switch on Let AI apps read People. Every request is listed on your Mac for 30 days and never sent to me. Remove one app, or turn Connections off, and access stops at once.

Permissions the app asks for

Photos, when you pick a photo or video to save. Camera and microphone, when you take a photo, scan a document or record a voice memo. Speech recognition, to turn a recording into text on the device. Location, only if you switch on “Save where I capture”, and only to note where a card was saved. Contacts, from version 1.3, the first time a person’s photo or contact card is needed. Hirsla asks once, for the contacts you allow, only reads them, and never changes Contacts. A person’s name and photo stay on your devices and in your own iCloud.

Each one is asked for at the moment you first use the feature, and the app works without any of them. On the Mac, Control-Command-V and the box at the edge of the screen need no Accessibility or Input Monitoring permission.

Keeping and deleting

Cards stay until you delete them. A deleted card sits in Recently deleted for 30 days, where you can put it back, then it is removed for good from your devices and from iCloud.

Deleting the app removes the library on that device. If sync was on, the copy in your iCloud stays until you remove it from iCloud settings.

Backups are copies of your own library kept on your own device, and in its iCloud Backup if that is on. They are not sent to me.

Your rights, and why they are easy here

There is no account to close and no profile of you to hand over, because I hold nothing. Your data is already in your possession: Export everything writes the lot to a zip file: a folder of Markdown files with the original files beside them, and that is never locked behind a purchase.

If you have sent me a problem report and want it deleted from my mailbox, write to me and I will delete it.

Swiss and European data protection law gives you rights of access, correction, and deletion. For anything I actually hold, which is email you have sent me, those rights are a single message away.

Children

Hirsla is a general-purpose app and is not directed at children. It does not knowingly collect anything from anyone, of any age.

Who is responsible, and how to reach me

Niklaus Gerber, Switzerland. niklausgerber.com

hirsla@niklausgerber.com

Hirsla is a private side project and has nothing to do with my employer.