hemilakePrivacy policy
Hemilake runs on your own machine and keeps what it reads there. This page says what it reads, what it sends out, and to whom.
Effective 24 September 2026.
Who we are
Hemisphere is a personal context lake in private beta, developed and operated from Madrid, Spain, by its author ("we", "us"). For the processing this policy describes, we are the data controller. You can reach us at [email protected].
This policy covers the Hemilake software (the hemi command, the local console, the MCP server and the connectors), hosted Hemilake instances, and this website, hemisphere.almansa.dev.
How Hemilake handles data
Hemilake reads the channels you connect (mail, calendar, chats, files, notes) and builds a knowledge graph of people, projects, decisions and dates, which Claude Code and the console then query. You install it on your own computer, or we run a sealed instance for you (see Where your data is stored).
The graph, the original text it was built from, and the credentials for your accounts live on that machine. We do not operate a central server that receives your content, and we cannot read it.
What it reads
Every source is off until you connect it, and you can disconnect any of them at any time. Depending on what you turn on, Hemilake reads:
- Google: Gmail, Google Calendar, Google Drive and Google Contacts (details in the next section).
- Microsoft 365: Outlook mail, calendar, Teams chats and meetings, OneDrive and SharePoint files, and the organisation directory.
- Slack, Mattermost, WhatsApp and Telegram messages from the conversations your account can see.
- Jira, Confluence, GitHub and Shortcut items you have access to.
- LinkedIn and Strava, if you connect them.
- Voice memos, Plaud recordings, notes, local files you point it at, and Claude Code sessions on your machine.
It signs in to each service with the permissions you grant through that service's own consent screen, and it stores the resulting tokens on your machine.
Google user data
When you connect a Google account, Hemilake asks for these scopes and uses each one only for the purpose listed:
| Scope | What Hemilake does with it |
|---|---|
gmail.readonly | Reads your messages so their content becomes episodes and facts in your graph, and so the inbox sweep can tell which threads still wait for your answer. |
gmail.send | Sends a message from your account only when you ask the assistant to send it and confirm the recipients and text. |
calendar.readonly | Reads your events and attendees for your daily brief, meeting preparation and free-time search. |
calendar.events | Creates, changes, answers or cancels an event only when you ask for it and confirm. |
drive.readonly | Reads the text of the documents you search for or open through the assistant. |
contacts.readonly, contacts.other.readonly | Matches names, email addresses and phone numbers to the same person in your graph. |
Google user data is processed on your machine or your sealed instance and stored there, encrypted at rest by the operating system (FileVault on a Mac, an encrypted disk on a hosted instance). To extract facts, the text of a message or event goes to the language-model gateway you configured; you choose that gateway, and it can be a model running on your own hardware. Hemilake does not transfer Google user data to us or to anyone else, except to that gateway at your direction and as needed to provide the features you use.
Hemilake's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular:
- Google user data is used only to provide and improve the features you see in Hemilake.
- It is not sold, not used for advertising, and not used to build credit or lending profiles.
- It is not used to develop, improve or train generalised AI or machine-learning models, by us or by anyone we work with.
- No person at Hemilake reads it. The one exception is when you explicitly send us a specific item to debug a problem, and we use it only for that.
You can withdraw Hemilake's access at any time at myaccount.google.com/permissions, or disconnect the source in the console.
Where your data is stored
On your computer. On a Mac, everything is under ~/Library/Application Support/hemisphere; on Linux, under the data directory you chose at install. Credentials are files readable only by your user.
On a hosted instance. If we run an instance for you, it runs as a Confidential VM on Google Cloud (AMD SEV-SNP memory encryption). Its disk key is released only to the attested Hemilake image, the state is kept as an encrypted snapshot, and the key that unlocks it lives only on your devices. Our operators have no login to the instance and see only ciphertext. When you connect a source to a hosted instance, the sign-in completes inside the instance, so the tokens never pass through us.
What leaves your machine
- Text to your model gateway. The text being analysed goes to the OpenAI-compatible gateway you set in
hemi init, because that model extracts the facts. Its provider's own terms and privacy policy apply. Choose a local model or a provider that does not train on your data. - Embeddings run locally by default. If you pick a remote embedding service instead, short texts go to it.
- People research, if you turn it on, sends a person's name and email domain to your model provider's web search to find their organisation and title.
- Messages and events you ask for. When you ask the assistant to send a mail or a chat message or to create an event, it goes to that service from your account.
- Telemetry, described below.
What we never do
We do not sell personal data, show ads, share your content with data brokers, or combine it with other people's data. We do not receive the content of your graph, so we cannot use it for any of those.
Telemetry
During the beta, hemi sends us two things, tied to your licence key so we can help when an install breaks:
- Crash reports: the error type and message, with your home directory, URLs, email addresses and object ids replaced by placeholders, and the stack frames of Hemilake's own code.
- A daily pulse of counts: version, which connectors are on and whether they report an error, graph sizes, tokens and estimated cost per model, CPU, memory and disk per component, and counts of entity types.
Neither carries episode text, names of people, addresses or credentials. hemi telemetry show prints the exact body, and hemi telemetry off stops it. We keep telemetry for up to 12 months. The manual lists every field.
This website
hemisphere.almansa.dev is a static site. It sets no cookies and runs no analytics or ads. Cloudflare, which carries its traffic, and our web server keep standard access logs (IP address, time, page requested) for security and troubleshooting.
Our licence service keeps, for each licence key, the name and email address it was issued to, each download, and each activated install: an install id, the hostname, operating system, version, and the IP address it last connected from. It uses them to enforce the install limit and to help you when something breaks.
Retention and deletion
Your graph and credentials stay until you delete them. To remove everything from a Mac:
hemi down
rm -rf ~/.hemisphere "$(brew --prefix)/bin/hemi"
rm -rf ~/Library/Application\ Support/hemisphereDisconnecting a source stops new reads; its episodes stay in the graph until you delete them. For a hosted instance, ask us to delete it: we destroy the instance, its disks and its snapshots, and without your key the remaining ciphertext cannot be read. We delete your licence record and telemetry within 30 days of a request, unless the law requires us to keep something longer.
Your rights
If you are in the European Economic Area or the UK, you can ask us to access, correct, delete or export the personal data we hold about you (your licence record, contact details and telemetry), object to or restrict its processing, and complain to a supervisory authority, in Spain the Agencia Española de Protección de Datos. We process that data to provide the service you asked for and, for telemetry, on our legitimate interest in keeping installs working; you can turn telemetry off at any time. Data in your own graph is under your control, and you can exercise these rights on it directly.
Security
Releases are signed, and hemi update checks the signature and checksum before installing. Local services listen on loopback only unless you expose them. Credentials are stored with permissions that only your user can read. Hosted instances use the confidential-computing setup described above. If you find a security problem, write to us at the address below.
Children
Hemilake is a work tool for adults and is not meant for anyone under 16.
Changes
If we change this policy, we update this page and its effective date, and tell licence holders by email before a change that widens what data we collect or how we use it.
Contact
Privacy questions and requests: [email protected].