Help and FAQ

Download HeyLook_<version>_windows_x64-setup.exe (Windows 10 or 11, 64-bit; recommended). The .msi is for managed installs and does not install WebView2 itself; the setup.exe does. An MSI update asks for administrator rights.

The installers are not code-signed yet. If SmartScreen appears, choose More info, then Run anyway.

The universal .dmg works on macOS 11 or later, Apple silicon and Intel. The app is self-signed but not notarised by Apple, so macOS blocks its first start once.

1. Open the .dmg, drag Hey Look! to Applications, and start it from Applications (not from the disk image).
2. macOS says “Hey Look!” Not Opened. Click Done, not Move to Trash.
3. Open System Settings > Privacy & Security, scroll to Security, click Open Anyway next to the message about Hey Look!, confirm with your password or Touch ID, then click Open.

Prefer Terminal? Run this once instead of steps 2 and 3: xattr -dr com.apple.quarantine "/Applications/Hey Look!.app"

Versions that Hey Look! installs itself start normally. The Dock icon shows the unread number (Settings > Notifications & tray > Dock badge). Notifications are not available on macOS in this version.

Updating from a version before 1.0.6: the Keychain asks about your saved passwords once more at the first start, because the app is now signed with a fixed certificate. PDF attachments open in your default app (the preview offers Open and Save as).

HeyLook_<version>_linux_amd64.AppImage runs on any distro; .deb is for Debian and Ubuntu; .rpm (_linux_x86_64.rpm) is for Fedora and openSUSE. .deb and .rpm installs ask for your password.

If your desktop has no tray area, closing the window quits Hey Look!

Links and attachments open with xdg-open (package xdg-utils; gio and sensible-browser are tried next), so you need a default browser and default apps. Notifications need a notification service (a bare window manager needs one such as dunst). Passwords need GNOME Keyring or KWallet running and unlocked.

The tray icon has no click action: use Open Hey Look! in its menu. PDF attachments open in your default app (the preview offers Open and Save as).

Overlay tools that hook into other programs’ graphics (for example RivaTuner Statistics Server, which comes with MSI Afterburner) can crash the web view that draws the app. Hey Look! notices, writes the cause to startup.log in its data folder and restarts itself (at most three times in ten minutes). If it keeps happening, exclude hey-look.exe and msedgewebview2.exe in that tool.

On the welcome screen choose Sign in with Google, Sign in with Microsoft or Other account (IMAP / SMTP).

Gmail: Sign in with your Google account. While Google is still reviewing Hey Look!, Google shows a warning first and limits sign-ins to the first 100 people; see Google says “Google hasn’t verified this app”. With a personal Gmail account you can also add Gmail with an app password (Other email account, provider Gmail).

Microsoft (Outlook.com, Hotmail, Microsoft 365) signs in in Microsoft’s own window. Work and school accounts (Microsoft calls each organisation a “tenant”) may block IMAP/SMTP until an admin enables it for the mailbox.

Your mail downloads in the background. Closing the window keeps Hey Look! running in the tray; use Quit in the tray menu to exit.

Hey Look! has not finished Google’s review yet. Until it has, Google shows a warning page the first time you sign in with Google, and again when you turn on Google calendar sync: “Google hasn’t verified this app”. Google shows this page for every app that is still under review. It does not mean there is a problem with your account, and nothing was changed.

To continue:

1. On the warning page choose Advanced, then Go to Hey Look! (unsafe).
2. Read the permissions Google lists and allow them if you are happy with them. Hey Look! asks only for what its mail and calendar features need, and it is open source, so you can check; see Google API data use. If you would rather not click through the warning, use an app password instead (below).

The limit of 100 people. While the review is going on, Google lets up to 100 people sign in with Google; it counts them over the whole life of the project. When that number is reached, new people cannot finish Sign in with Google until Google approves Hey Look! What you can do then:

• Gmail with an app password (personal Gmail with 2-Step Verification): create an app password at myaccount.google.com/apppasswords, then in Hey Look! choose Settings > Add account > Other email account, provider Gmail, and enter your address and the app password. Work or school accounts often cannot create app passwords.
• Wait for the review. Once Google approves Hey Look!, the warning goes away and Sign in with Google works for everyone. The release notes will say so.

Calendar sync with Google always asks for Google’s own calendar permission, even for a Gmail mailbox that uses an app password, so the same warning and the same limit apply to it. Calendar sync for Microsoft mailboxes is not affected.

Any account with IMAP and SMTP works. Detect settings finds the servers for an address (presets, the provider’s autoconfig (a file with its server settings), the Thunderbird ISPDB, DNS and probing). Only the domain and the address are sent, never the password.

iCloud needs an app-specific password from account.apple.com (Sign-In and Security, App-Specific Passwords), because Apple offers no sign-in window for third-party mail apps. Yahoo also uses an app password.

Servers must offer SSL/TLS or STARTTLS; servers that accept only unencrypted connections cannot be added.

Proton Mail Bridge listens on 127.0.0.1 with a self-signed certificate: choose Proton Mail Bridge in the provider list and use the username and password Bridge shows. For other servers turn on Trust this server’s certificate under the advanced settings. The certificate is then not checked for IMAP and SMTP of that account, so use it only for servers you control.

Settings > Mailboxes > Reading & sync > Max emails to download per mailbox is 500, 1000, 2000 or 5000 (default 2000), counted per mailbox over all its folders. When a mailbox is over the limit, the oldest mails are removed from this computer only; they stay on the server. Drafts, flagged mail, pinned or snoozed conversations and the newest message of each folder are kept. New mail always arrives.

It is optional, per mailbox, and off until you turn it on: Settings > Mailboxes > (account) > Calendar > Sync calendar with Google (or Microsoft). Your browser opens the provider’s own page to ask for calendar permission. This is separate from your mail sign-in, which does not change. Then choose the calendars to sync: their events appear in Hey Look!’s calendar, and the events you add, change, delete or answer are saved back to Google Calendar or Outlook.

Turn the switch off and the synced calendars and events are removed from this computer and the calendar sign-in token is deleted; they stay with your provider. Repeating events from a synced calendar are read-only. For Google, see Google says “Google hasn’t verified this app”; a Microsoft work or school account may need an admin to approve calendar access. CalDAV and other services are not supported.

On servers that support IMAP IDLE, new Inbox mail arrives at once, as long as Hey Look! is running. Settings > Mailboxes > Reading & sync > Get new Inbox mail instantly (push) turns it off, for all accounts or one mailbox; the mailbox’s server panel shows Push or Polling. If the server has no IDLE, or the connection keeps failing, Hey Look! checks at your interval (every 2 minutes by default). While push works, the regular check of all folders runs only every 10 minutes (or your interval, if it is longer), and push covers the Inbox only.

Open Settings > Mailboxes. All accounts holds the defaults. Each account has the same pages; a setting you change there is marked Custom and overrides the default for that mailbox only. Reset goes back to inheriting. Signatures, templates and filters can belong to all accounts or to one mailbox.

Press Ctrl K (Cmd K on macOS) for the command bar: type a command or a folder name.

Hold Shift when you click New mail, Reply, Reply all or Forward (or press Shift+C, R, A or F), double-click a draft, or press Pop out (Ctrl+Shift+O) while writing. To read in a window, double-click a conversation or press Shift+Enter. Settings > Composing > Open new messages, replies and forwards in a separate window makes a window the normal way, and Shift then does the opposite. Up to 8 windows can be open; each remembers its size and place, and closing one that holds a message asks Save, Discard or Cancel. Quitting or updating saves every window’s message to Drafts first.

The formatting toolbar is one row; when the window is narrow, more controls move into its More menu (find and replace, change case, text direction, zoom, spacing). Pasting from Word, Excel, a web page or another app is cleaned, and the Paste options button lets you keep the source formatting, merge it or keep the text only; Settings > Composing sets the default. A reply quotes the original in a block that keeps its look.

The message is saved to Drafts by itself about every 30 seconds and a copy is kept on your computer. If the app ends unexpectedly, the next start saves the message to Drafts by itself, asks nothing, and shows a toast that stays until you close it, with Continue writing.

The button at the top of the folder pane, or Ctrl B (Cmd B), folds the pane to a column of icons: each mailbox is its colour with its unread number. In a window narrower than 1100 px it folds by itself; Settings > Appearance > Side menu sets Automatic, Always expanded or Always icons only. Drag a mailbox to change the order (or use Alt+Up and Alt+Down), and give it a Display name in Settings.

Undo send: after Send, the message waits in a local outbox for 0, 5, 10, 20, 30 or 60 seconds (default 10), and Undo cancels it. If Hey Look! is closed by force (a crash, Task Manager, an installer), it goes out at the next start. A normal Quit sends a message that is still waiting at once.

Archive, delete and junk are applied to the server after 3, 6, 10, 15 or 30 seconds (default 6), so you can take them back.

Send later: pick a preset or any date and time, up to one year ahead. A worker inside the app sends it, so Hey Look! has to be running. A message whose time passed while the app was closed is sent at the next start by default; the “ask” setting makes it wait as Overdue instead. Temporary errors are retried up to 3 times, 5 minutes apart.

Type operators in the search box: from: to: subject: body: folder: is:unread|read|flagged|pinned has:attachment after:2026-01-31 before: after:7d and "quoted phrases". Only mail downloaded to this computer is searched. For a mailbox whose webmail is known, a Search in webmail button opens it; Gmail gets the same search with the operators translated.

Open Settings > General and choose English, Vietnamese, French, Chinese (Simplified), Spanish, Japanese, German or Russian in the first row. It applies at once, without a restart. English is the default, and Hey Look! does not pick a language from your system. The translated texts are new and may contain mistakes; tell us on GitHub if you find one.

Hey Look! updates itself after you agree. It checks when the app starts and when its window comes back (from the tray, or to the front) after a couple of hours, tries again after 15 minutes if a check fails, and checks on demand in Settings > About. Turn the automatic check off there (“Check for updates automatically”) and no automatic request is made.

Download and install downloads the update with a progress bar while you keep working, checks its signature, and restarts into the new version after a 5-second countdown you can cancel. If you are writing a message it asks first and saves the message as a draft; Later installs the update when you quit. Skip this version hides the notice for that version.

Only GitHub is asked, and nothing is downloaded until you agree. Every update package is signed, and the app refuses anything that does not match its built-in public key. An MSI install asks for administrator rights; .deb and .rpm installs ask for your password. If an update cannot be installed, the app offers the download from GitHub instead.

Closing the window keeps Hey Look! and its sync running in the tray. Turn off “Keep running in the tray when the window is closed” in Settings and the close button quits instead (it asks first when scheduled messages are waiting).

On Windows a new-mail notification can have up to three buttons (Archive, Delete, Mark as read, Flag, Reply, Snooze). Linux notifications have no buttons. macOS notifications are not shown in this version because the app is not signed with an Apple Developer ID; new mail still shows in the app and in the menu-bar icon. Snooze a conversation to a preset or your own times; it returns to the Inbox then.

Mail cache and settings are a SQLite file: %APPDATA%\thnonl.heylook\heylook.db on Windows, ~/Library/Application Support/thnonl.heylook/ on macOS, ~/.local/share/thnonl.heylook/ on Linux.

Passwords, OAuth tokens, the AI key and the OAuth client secrets are in Windows Credential Manager, the macOS Keychain, or the Secret Service on Linux (GNOME Keyring, KWallet; one of them has to be running and unlocked). All entries are named heylook…. OpenPGP secret keys are the exception: they are in the app’s database, protected by their passphrase.

Nothing is sent anywhere except to: your mail servers; Google’s and Microsoft’s sign-in services; Google Calendar and Microsoft Graph, only for a mailbox where you turned on calendar sync; the Thunderbird ISPDB and your own domain’s autoconfig address (where a domain publishes its server settings) when you press Detect settings; the AI endpoint you configure; the server behind an image you allowed to load; the sender’s address behind the Unsubscribe link when you press it; and github.com for the update check (GitHub sees your IP address; when you agree to update, the installer comes from github.com).

There is no analytics or crash-reporting code in the source. That is verified from the source, not by a network capture. See the privacy policy.

Remote and background images are blocked until you allow them (once, per mailbox, or always). A tracking pixel is a remote image, so it is blocked with the rest; the app has no tracker list. Allowed images are downloaded by the app where it can; any it cannot fetch itself, the web view may request directly. Links whose visible text is a web address that points somewhere else ask you to confirm, and opening an executable attachment asks first.

It talks only to the endpoint you configure (any OpenAI-compatible API, including local servers), and only when you press a button. A summary sends up to 24,000 characters of the readable messages of a conversation, a translation up to 60,000, and Write with AI your draft, the subject and, for a reply, up to 6,000 characters of the message you reply to. Decrypted OpenPGP content is sent too, because the assistant reads the readable text. The key is in your system’s credential store. Long mail is translated in parts of about 8,000 characters, and Cancel stops it. If the Assistant cannot work, a message stays on screen and its button opens the right field in Settings.

Remove your accounts in Hey Look! (Settings > Mailboxes > account > Remove account; mail stays on the server), uninstall the app, then delete its data folder (see “Where is my data?”) and any heylook… entries in your system credential store.

Create an Ed25519 / Curve25519 or RSA 3072 key, with an optional expiry, locked by a passphrase. In the composer you can encrypt to the recipients’ keys and sign; the app shows whether each recipient has a usable key before you send. Incoming mail can be decrypted and signatures verified.

Import and export keys (armoured), and save a passphrase-protected backup file (*-secret-key-BACKUP.asc). Closing the key page without a backup asks “Back up now” or “Close anyway”. After repeated wrong passphrases, unlocking waits 30 seconds.

Secret keys are stored in the app’s own database, locked with your passphrase, not in the OS credential store. Interoperability with other OpenPGP software has not been tested yet.

Open an issue on GitHub. Issues are public, so never post private mail, passwords or tokens. Say which system and Hey Look! version you use (Settings > About, which also links to the website, the support page and the source code). Hey Look! is made in spare time, so answers can take a while.

Report it privately: open github.com/thnonl/hey-look/security and choose “Report a vulnerability”, or write to namth.onl@gmail.com. Please do not open a public issue. See Security.

• On macOS there are no notifications (the Dock icon does show the unread number); the app is signed with the project’s own certificate and is not notarised; the Print menu entry is Windows and Linux only. On Linux notifications have no buttons, the tray icon has no click action, and a Confidential message is not hidden from screen capture.
• The installers are not code-signed, and the macOS app is not notarised.
• Push (IMAP IDLE) covers the Inbox of servers that support it; other folders and servers without push are fetched by polling (default every 2 minutes).
• Search covers mail downloaded to this computer.
• Calendar sync covers Google and Microsoft; CalDAV and other services may come in a later update. Google sign-in and Google calendar sync are limited to the first 100 users until Google finishes its review (see Google says “Google hasn’t verified this app”). A single occurrence of a repeating event cannot be edited. There are no shared inboxes.
• Hey Look! does not create missing standard folders (Drafts, Sent, Archive, Deleted Items); actions that need one show an error.
• A message you write is saved to Drafts about every 30 seconds and a copy is kept on your computer. If Hey Look! is closed by force, or on macOS when you log out, restart or shut down, the next start saves it to Drafts by itself and a toast that stays until you close it says so, with Continue writing; if it cannot be saved to the server it is kept on this computer for up to 30 days (the text of the last few seconds may be missing, and a message with Encrypt on is not copied). A message you already sent is kept and goes out at the next start.
• Calendar update and cancellation emails are accepted when the From address matches the organiser. There is no DKIM, SPF or S/MIME check.
• The interface is in English by default, with Vietnamese, French, Chinese (Simplified), Spanish, Japanese, German and Russian in Settings. Those translations were written with AI help and checked by language specialists; more languages may come in a later update.
• PDF files are drawn inside the app on Windows only; on macOS and Linux they open in your default app. There is no plain-text-only mode when writing, and Format Painter, AutoFormat and the mini toolbar are not there yet.