Hearth Chat Privacy Policy

Hearth is a private group chat that runs on a server of your own or on one we host for you. This policy covers the Hearth Chat app (iPhone) and Hearths we host at yourname.hearthchat.net. It is written to be checked against the software, not to sound reassuring: everything below describes what the code actually stores.

The short version: no analytics, no ads, no tracking, and nothing is sold or shared. A hosted Hearth stores your username, the way your phone signs in, a push token so your phone can ring, and your messages and files as encrypted data it cannot read.

Who holds your data

• Self-hosted Hearth (on a TomSparkBox, or with Docker): everything lives on that machine and belongs to whoever runs it. Nothing about you reaches us. The server checks tomsparkbox.com once a day for a newer version; that request carries no account or message data.
• Hosted Hearth (yourname.hearthchat.net): we run the server for the person who pays for it. What it stores is listed below. We are the operator, not a member — the encryption keys are never on our side.

The Hearth Chat app on your phone

The app keeps on your device: the address of the Hearth you paired with, your sign-in token, the encryption key for a sealed Hearth, and small preferences (theme, sounds). It contains no analytics, advertising, or tracking code and sends nothing to anyone except the Hearth you paired with.

To deliver notifications the app registers a push token with your Hearth, and your Hearth sends notifications through Apple's push service. On a sealed Hearth a notification carries the sender's name and the channel — never the message text, which the server cannot read.

The camera is used to scan invite codes and to take photos or videos you choose to share; the microphone for calls and voice messages; the photo library for pictures you choose to send. None of that leaves your phone unless you send it.

What a hosted Hearth stores

Hosted Hearths always run sealed: messages and files are encrypted on your device with a key that travels only inside invite links. Our server stores the results and does the plumbing. Concretely, your Hearth's storage holds:

• Your account: the username you picked, a display name, and an optional profile photo. There is no password — instead each signed-in device holds a random token, and the server stores only a hash of it.
• Push registration: the Apple push token for the iPhone app, or a Web Push subscription for a browser, so your device can be notified.
• Messages and files: stored as encrypted blobs the server cannot decrypt — text, photos, videos, voice notes, and other files. Reactions, read positions, and notification settings are stored so the app works.
• What the server necessarily sees: who is a member, who posted when and in which channel, and the name, type, and size of each file. Profile photos and custom emoji are stored as ordinary images so they can be shown to every member.

Billing record for a hosted Hearth

When you buy a hosted Hearth we keep a small record so it can be provisioned, renewed, and cancelled: the email address you paid with, the Stripe customer and subscription identifiers, the plan, and the dates. Payment is handled by Stripe; we never see or store card numbers. The invite email is sent through an email delivery service (Resend). This record is separate from the Hearth itself and is not visible to other members.

Infrastructure

• Traffic to *.hearthchat.net passes through Cloudflare, which terminates TLS in front of our server. Message and file contents inside that traffic are already encrypted by your device.
• Your Hearth's storage is backed up nightly to a separate location so an outage does not lose it. Backups contain the same encrypted blobs and are rotated on a short cycle.
• The Hearth server keeps no request log. Container logs are size-capped and rotate automatically.

What we do not do

• No analytics or usage tracking in the app or on hosted Hearths.
• No advertising, no ad networks, no data brokers.
• No selling, renting, or sharing of your data with anyone.
• No reading your messages or files — on a sealed Hearth we cannot.

Your $5 is the entire business model.

Deleting your data

• Delete your account from inside the app (tap your name → Account settings → Delete my account). This immediately removes your account, every message you sent, the files attached to them, your reactions, your devices, and your push registration from that Hearth. Other people's messages stay. There is no undo.
• Cancel a hosted Hearth in Stripe or by writing to us: the Hearth stops at once and its storage is deleted after a 14-day grace period.
• Billing record: email legal@tomsparkbox.com from the address on the record and we delete it, subject to what tax and payment rules require us to keep.

Children

A Hearth is invite-only; the person running it decides who is in it. Hearth Chat is not directed at children, and we do not knowingly hold a billing record for anyone under 13.

Changes

If this policy changes, the new version is posted here with a new date. Material changes to what a hosted Hearth stores are announced to the admins of hosted Hearths.

Contact

Privacy questions or data requests: legal@tomsparkbox.com

Product support (community forum, not email): d/hearth on demox.world

Hearth: https://tomsparkbox.com/hearthchat · Company-wide policy: TomSparkBox Privacy Policy