Who we are
Hey Look! is free, open-source software (MIT License) published by the developer known as thnonl (“we”, “us”). Contact: namth.onl@gmail.com.
In short
Hey Look! runs on your computer and talks directly to your mail provider. We do not run a server for the app. We do not receive, collect or store your mail, calendars, contacts, passwords or sign-in tokens, and the app contains no analytics, advertising or telemetry code.
1. What the app stores on your computer
| Data | Where |
|---|---|
| Copies of your messages and folders, addresses taken from your mail for suggestions, calendar events (your own events and, for a mailbox with calendar sync on, the events of the calendars you chose), settings, rules, signatures, templates, OpenPGP keys (secret keys only in passphrase-protected form) | A local database in your user data folder: Windows %APPDATA%\thnonl.heylook\, macOS ~/Library/Application Support/thnonl.heylook/, Linux ~/.local/share/thnonl.heylook/ |
| Passwords, OAuth refresh tokens, the calendar sign-in token of a mailbox with calendar sync on, your AI key, OAuth client secrets | Your system’s credential store: Windows Credential Manager, macOS Keychain, or the Secret Service on Linux (GNOME Keyring, KWallet), in entries named heylook… (a calendar sign-in token is a separate entry ending in :calendar) |
| A recovery copy of the message you are writing (none for a message with Encrypt on) | The same local database; it is removed when the message is saved, sent or discarded |
| A technical start-up log without message content | startup.log in the same data folder |
Access tokens and attachments you open are kept in memory or a temporary folder for the session. This data is protected by your computer’s own account and disk protection; keep your computer secure.
2. Which servers the app connects to
| Destination | When | What is sent |
|---|---|---|
| Your mail servers (IMAP, SMTP) | To sync, send and organise mail | Your sign-in (password or OAuth token) and the mail actions you take |
Google sign-in (accounts.google.com, oauth2.googleapis.com) and Microsoft sign-in (login.microsoftonline.com) | When you add a Google or Microsoft account, when you turn on calendar sync for one, and when a sign-in is renewed | The sign-in request. You sign in on the provider’s own page in your browser |
Google Calendar (www.googleapis.com) and Microsoft Graph (graph.microsoft.com) | Only for a mailbox where you turned on calendar sync: to download its calendars and to save the events you add, change, delete or answer | Your calendar sign-in token and the event changes you make |
Your mail domain’s autoconfig address, the Thunderbird ISPDB (autoconfig.thunderbird.net) and DNS look-ups | Only when you press Detect settings | The domain of your address (your own domain’s autoconfig also receives the address). Never your password |
| The AI endpoint you configure (optional) | Only when you ask for a summary, a translation or “Write with AI” | The text of the message(s) or draft involved and your instruction (see section 5) |
| Servers named in a message | Only when you allow remote images, or press Unsubscribe on a newsletter | A normal web request from your computer. For allowed images the app downloads them itself where it can. For any it cannot download, the message view may request them directly, and then the sender can see that request |
| github.com | To check for a newer version (at start, when the window comes back after a couple of hours, and again after 15 minutes if a check fails; it can be turned off in Settings, About) and to download an update you agreed to | A request for the latest version file. GitHub sees your IP address. Your mail and accounts are never sent |
Links you open go to your browser; files you open go to the app your system uses for them. Those services and apps are not controlled by us.
3. Google user data
If you add a Google account, Hey Look! requests:
https://mail.google.com/to read, send, organise and delete your Gmail messages through IMAP and SMTP. Google offers no narrower permission for IMAP and SMTP.openid,email,profileto learn the address and name of the account you signed in with.https://www.googleapis.com/auth/calendar.events, only if you turn on calendar sync for a Google mailbox: to show the events of the calendars you choose and to save the events you add, change, delete or answer to Google Calendar.https://www.googleapis.com/auth/calendar.calendarlist.readonly, with calendar sync: to list your calendars so you can choose which to sync. The list is never changed.
The calendar permissions are a separate request, made only when you turn on calendar sync; if you never do, Hey Look! never asks Google for them.
Use: only to provide the mail and calendar features you see in the app, on your computer. Calendar data is never sent to the AI Assistant. Storage: as in section 1. Sharing: we never receive the data and do not sell, share or transfer it. The app sends Google data only to Google (your mailbox and, with calendar sync, your calendars) and, if you use the optional AI Assistant, the mail text you choose to process to the AI endpoint you configured (section 5). Nobody working on Hey Look! reads your mail or your calendar. Google data is not used for advertising and not used by us to create, train or improve AI or machine-learning models.
Hey Look!’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This includes the calendar information received through the Google Calendar API. Details: Google API data use.
4. Microsoft account data
If you add a Microsoft account, Hey Look! requests IMAP.AccessAsUser.All, SMTP.Send, offline_access, openid, email and profile, used the same way as in section 3. With calendar sync on, Hey Look! also requests Calendars.ReadWrite (Microsoft Graph) for that mailbox, in a separate request, used the same way as the Google calendar permissions in section 3: to show the events of your own calendars and to save the events you add, change, delete or answer. Calendars that other people shared with you are not read.
5. AI Assistant (optional, off until you set it up)
You choose the endpoint (any OpenAI-compatible service, or a server on your own network) and its key. Hey Look! sends text to it only when you press a button for a summary, a translation or “Write with AI”: for a summary up to 24,000 characters of the readable messages of the conversation, for a translation up to 60,000 characters of the message, and for writing help your draft, the subject and, for a reply, up to 6,000 characters of the message you reply to. The assistant reads the readable text of a message, so decrypted OpenPGP content is sent too if you ask about it. That service’s own terms and privacy policy apply to what it receives, and we have no control over it. Leave the endpoint empty to keep the feature off. A long message is sent in parts of about 8,000 characters, one after the other.
6. This website
No cookies, no analytics, and no third-party scripts, fonts or embeds unless you ask for the Ko-fi widget (described below). It is hosted on GitHub Pages; GitHub processes technical data such as your IP address to deliver the pages, under GitHub’s own privacy statement. The theme and motion choices you make with the buttons in the header are kept in your browser only. The Support page can load a Ko-fi widget (a frame from ko-fi.com and Ko-fi’s widget script and images from storage.ko-fi.com) only after you click the button that asks for it; Ko-fi’s own policy then applies. Without that click nothing from Ko-fi is loaded. The page also shows a bank-transfer QR image, which is a file on this site.
7. Keeping and deleting data
Data stays on your computer until you remove it. The app keeps at most the number of messages you set per mailbox (default 2,000) and removes older copies from this computer only; they stay on your server.
- Remove an account: Settings > Mailboxes > (account) > Remove account deletes the local copy of that mailbox and its saved credentials. Mail stays on the server.
- Turn off calendar sync: Settings > Mailboxes > (account) > Calendar > Sync calendar with Google (or Microsoft). The calendars and events are removed from this computer and the calendar token is deleted; they stay with your provider.
- Remove the AI key: Settings > AI Assistant > Remove the saved key.
- Remove everything: remove your accounts, uninstall Hey Look!, then delete the data folder from section 1 and any
heylook…entries left in your credential store. - Revoke access at the provider: Google at myaccount.google.com/permissions; Microsoft in your Microsoft account’s app permissions or through your organisation.
We hold no copy of your data, so there is nothing for us to delete; we are glad to answer questions at namth.onl@gmail.com.
8. Security
Connections to mail servers require SSL/TLS or STARTTLS, sign-in uses OAuth 2.0 with PKCE, passwords and tokens are kept in the system credential store (OpenPGP secret keys are kept in the app’s database, locked by your passphrase), and updates are checked against a signature built into the app. No software is free of faults; we cannot guarantee that the app or your data is free of security risks (see the Terms and Security).
9. Children
Hey Look! is not directed to children under 13 (or the minimum age for consent in their country). We do not knowingly collect data from anyone, as described above.
10. Your rights
Because we do not collect or hold your personal data, requests to access, correct or delete data are fulfilled by the app’s own controls (section 7) and by your mail provider. Your local data-protection authority remains available to you.
11. Changes
We post changes here with a new effective date. If the app starts to use Google user data in a new way, it will ask for your consent in the app first.