The short version
This policy covers the Herald mobile apps for iPhone, iPad, Apple Watch and Android (the “app”) and this website, heraldapp.dev. Herald is developed and published by lukethedev (“we”, “us”), who can be reached through our support form.
Herald has no server of its own. Everything you type, say or attach goes from your device to the Hermes Agent instance that you run and configure. We never receive your conversations, bots, files, voice recordings or connection credentials.
The app contains no analytics, no advertising SDKs, no crash reporting services and no tracking. We cannot see who uses the app or how. We do not sell personal information, and we do not share it for advertising.
This website counts page views with cookieless, aggregated analytics from our host, Vercel, as described in This website.
What stays on your device
- Connection details for each Hermes instance you add: its address, a label, the sign-in mode and your dashboard username. Passwords and tokens are kept in the operating system’s secure storage (Keychain on Apple devices, Keystore-backed encrypted storage on Android).
- App settings and state, such as pinned bots, group rooms and read markers, avatar choices, appearance, accent colour, language, voice settings and Hermes Pet preferences.
- Voice notes you record, saved in the app’s private storage so they can be played again.
- Widget, Live Activity and watch data. A short summary of bot status (for example a bot’s name and “working”) is shared with Herald’s own widgets and Live Activities through a private app group on your device, and relayed from your iPhone to your paired Apple Watch using Apple’s device-to-device connection.
- Optional Mail key. If you connect HermesMailAgent, its API key is stored in secure storage.
Deleting the app removes this data from the device, subject to your operating system’s backup settings. It does not delete information already held by your Hermes instance or the services it uses.
What leaves your device, and where it goes
| Information | Destination and purpose |
|---|---|
| Messages, attachments, voice clips, bot and group settings, schedules, kanban changes and plugin settings | Your own Hermes instance, to provide the features you use. Your Hermes decides which model, speech and tool providers process them. Herald never contacts a model provider directly. Photo metadata such as location is stripped before upload. |
| Dashboard username and password, or session token | Your own Hermes instance, only to sign in. |
| Push token, Live Activity token and device name | Your own Hermes instance, only if you tap Register for push notifications. The push plugin on your computer uses them to send you banners. You can remove them in Settings. |
| Push banner text (a bot’s name and a short status) | Expo’s push service, then Apple Push Notification service or Firebase Cloud Messaging, only after you register for push. They see the banner, never your conversations. |
| Mail API key, inbox actions and email content | HermesMailAgent (hermesmailagent.com), only if you choose to use the optional Mail feature. It is a separate service with its own account, terms and privacy policy. |
| Sign-ins to MCP servers and links you open | The relevant website, opened in your browser at your request. MCP sign-ins are completed through your Hermes. |
Group rooms may be mirrored to the Hermes connections you save so that they stay in sync with your other clients. Those computers and the services they use are controlled by you or their operators.
Voice, wake word and read-aloud
Voice notes and dictation are sent to your own Hermes for transcription with the speech provider you configured. The optional “Hey Herald” wake word runs only on your device’s on-device speech recogniser. If none is available, the wake word is disabled rather than sent to a server.
The wake word listens only while Hands-free is on and a chat is open, or with the screen locked if you also turn on Listen with the screen off. Android shows a notification the whole time it is listening. Read-aloud replies are generated by your Hermes, or by your device’s built-in voice when that isn’t available.
In CarPlay, your iPhone records from the car’s microphone only while the voice screen is listening. The clip goes to your own Hermes for transcription, like a voice note, and the reply is spoken back. The car only receives the list of bots and their status, not your conversations.
Device permissions
- Camera: scan the pairing QR code and take photos to attach. QR codes are read on the device.
- Photos: attach pictures and videos, and set bot avatars. Only the items you pick are read.
- Microphone and speech recognition: voice notes, dictation and the optional wake word, as described above.
- Notifications: show banners from your bots.
- Local network (Apple devices): reach a Hermes instance on your Wi-Fi or tailnet.
- Face ID, Touch ID or biometrics: the optional app lock. Your operating system checks your identity and Herald only receives a yes or no.
Each permission is requested when you first use the feature. You can change it at any time in your device settings, and the rest of the app keeps working.
Purchases
Herald is a one-time purchase through the App Store or Google Play. Apple or Google processes your payment under its own privacy policy. We do not receive your payment details or your store account identity. We receive aggregated sales and download reports from the stores, which don’t identify you. There is no Herald account.
This website
This website has no advertising, no tracking cookies and no accounts. Fonts, images and video are served from the site itself. If you pick an accent colour, that choice is saved in your browser’s local storage and never sent to us.
We use Vercel Web Analytics to see which pages are visited, so we know what to improve. For each page view it records the page address, the referring site, your approximate location (country, region and city), and your browser, operating system and device type. It doesn’t use cookies, doesn’t tie page views to you or your IP address, and doesn’t follow you across other sites. Visitors are told apart only by a hash of the request that is discarded after 24 hours, and we only see aggregated totals. See Vercel Web Analytics privacy and compliance for details. The app itself has no analytics.
The interactive phone is a simulation with scripted replies. What you type stays in the page’s memory, is not sent anywhere, and disappears when you leave or refresh. The demo doesn’t use your microphone or camera.
The site is hosted by Vercel, which processes technical request information such as IP address, browser type, requested pages and timestamps to deliver and secure the site, under Vercel’s privacy policy.
When you contact us
If you use the support form or email us, we receive your name, email address, message and any details you choose to include, such as your device and app version. Form messages are delivered by email through Resend to our support inbox, which is hosted by HermesMailAgent. We use this information only to answer you and fix problems.
To keep out spam, the form asks your browser to solve a small puzzle before it sends. The check runs on our own site, with no third-party captcha service and no cookies, and the puzzle contains nothing about you. Your IP address is held briefly in the server’s memory to limit repeated messages, and is not stored.
We keep support conversations for as long as needed to help you and for reasonable record-keeping, then delete them. You can ask us to delete them sooner. Please never send passwords, pairing codes, API keys or private conversations.
Security
Herald connects only to the addresses you configure. Over HTTPS or Tailscale, the connection between your device and your Hermes is encrypted in transit. Herald allows plain HTTP only to private network and tailnet addresses, and that traffic is not encrypted.
Pairing QR codes can contain credentials, so treat them like passwords. No software or network can be perfectly secure, but we design Herald to keep your data on hardware you control.
Your choices and rights
You can remove saved connections, remove push registration, revoke permissions or uninstall the app at any time. Conversations stored on your Hermes are managed there.
Depending on where you live, you may have rights to access, correct, delete or export personal information we hold, and to object to or restrict how we use it. In practice, the only personal information we hold is what you send us when you contact support. Use our support form (choose Privacy request) to make a request and we will respond within 30 days. You can also complain to your local privacy regulator, such as the Office of the Australian Information Commissioner.
Children
Herald is a tool for people who run their own Hermes Agent. It is not directed at children under 13, and we do not knowingly collect personal information from children. If you believe a child has sent us personal information, contact us and we will delete it.
International transfers
Our hosting, email and notification providers may process information in countries other than yours, including the United States. Where we use them, we rely on their contractual and legal safeguards. Where your Hermes and its providers process data is up to your configuration.
Changes to this policy
If our practices change, we will update this page and the date at the top. Material changes to the app’s data practices will also be noted in the release notes of the version that introduces them. The terms of use explain the rules for using Herald.
Send us a message through the support form and we’ll get back to you.