Privacy Policy
Hai is a macOS app for business communication and supplier collaboration. It is built on a simple premise: your business data belongs to you, not to us. We do not have your account, we do not keep copies of your messages, and we do not operate a server that receives them.
In short
- No accountNo phone number, email or sign-up. Your identity is generated on this Mac at first launch.
- No usage dataNo analytics, no advertising SDK, no crash reporting, no profiling.
- Content stays hereMessages, files, supplier profiles and requirements live on your Mac.
- Network only on your actionDirect to a peer, to a relay you configure, or to a model service you configure. Nothing else.
01Scope
This policy explains how Hai (the “app”) handles information, and what you can do about it. The app is developed and published by Wang Ting (“we”, “us”).
It covers the macOS app and its on-device features. It does not cover third-party services you configure yourself — for example a relay server you enter, or an AI model service you connect. Those are operated by their own providers, under their own policies; we neither control them nor can we make commitments on their behalf.
02What we do not collect
This section lists things we deliberately do not do — not things we have not got around to yet. They are product decisions.
- No registration. There is no account system. We do not collect phone numbers, email addresses, names or company details.
- No device identifiers. No IDFA, MAC address or serial number, and no cross-app tracking.
- No access to other system data. No contacts, calendars, photo library, location or clipboard history.
- No behavioural records. No event logging, no feature-usage statistics, no session-duration reporting.
- No third-party SDKs. No analytics, advertising, push proxy or crash-collection SDK.
- No ads, no profiling, no sale or sharing of data with anyone.
You do not have to take our word for this. The app contains no server address and no reporting channel. Watch its network behaviour with a firewall or packet capture: you will only see connections to devices on your local network, to a relay you configured, and to a model service you configured. The appendix shows how.
03What the app handles locally
“Handles” here means reading and writing files on your Mac. All of it happens on the device; none of it is uploaded.
| Category | Contents | Location | Purpose |
|---|---|---|---|
| Identity key | A 32-byte Ed25519 private key and its public key | accounts/<id>.key in the app data directory, mode 0600 |
Signs your messages and business card so the other side can confirm it is you |
| Messages and attachments | Text, files and images you send and receive | Local database and attachment folder | Displaying conversations; holding a file while the other side is offline, then sending it |
| Business records | Supplier profiles, requirements, responses, after-sales notes | Local database | Browsing, filtering and summarising |
| Summary drafts | Entries proposed by an AI summary | Local database | For you to review one by one before anything is recorded |
| Diagnostic log | Connection, handshake and file-transfer events | Log file on this Mac | Tracing “why won’t it connect” and “why did the file not arrive” |
None of this passes through us. We hold no copy and have no channel to read it.
04Where your data lives
The app runs in the macOS App Sandbox, so everything sits inside its container:
~/Library/Containers/com.workbuddy.bizcollab/Data/Library/Application Support/HaiThree consequences:
- Backup — copy that folder. It is self-contained: database, attachments and identity key.
- Move to a new Mac — place the folder at the same path on the new machine, then open the app.
- Delete everything — remove the app and delete the container. Deletion is permanent; we have no backup to restore from.
Upgrading from an early build: versions released before sandboxing stored data in ~/Library/Application Support/Hai. The sandboxed app cannot see that folder — your data is not lost, the sandbox simply narrowed what the app can reach. To carry it over, copy the folder into the container path above (you may need to grant Terminal Full Disk Access temporarily).
05When data leaves your Mac
Four cases only, each triggered by something you do. None of them sends anything to us.
| Case | Trigger | Goes through | What the other side sees |
|---|---|---|---|
| Direct connection | You send a message or file and both sides are reachable | No server at all | What you sent, encrypted in transit |
| Relay | Direct fails, and you have configured a relay | The relay server you entered | Ciphertext plus the metadata needed to forward it (section 06) |
| AI summary | You start a summary and have configured a model service | The model service you entered | The text you chose to summarise |
| Local discovery | While the app is running | Other devices on the same LAN | A service name and identity identifier, so devices can find each other |
The app also asks your local router for a port mapping (NAT-PMP, PCP or UPnP) so that outside devices can reach you directly. That conversation is with your router only; it does not involve us and carries no business content.
06Relay servers
A relay is the fallback when a direct connection cannot be made. It is off by default: address, port and credentials are entered by you. We do not provide, operate or have access to the relay you use.
Because messages and file bytes are end-to-end encrypted between the two devices (section 08), the relay forwards ciphertext. It cannot read your conversations, file names or attachments. What it can see is the metadata required to forward traffic:
- connection identifiers at both ends, used to deliver data to the right connection;
- packet sizes and timing;
- when connections open and close.
That is enough to infer that two identities communicated during a given period; it is not enough to recover content. If the relay is run by a third party, their handling of that metadata is governed by their policy — worth checking before you rely on one.
If you prefer no relaying at all, simply leave the relay unconfigured. The app will then communicate only when a direct connection is possible, and will say so plainly instead of silently taking another route.
07AI summaries
The summary feature turns long requirement documents into structured entries. It is off by default: you enter the model service address, model name and key in settings.
- The text to be summarised goes straight from your Mac to the service you entered. It does not pass through us.
- We cannot read those requests, do not store requests or results, and do not resell anything.
- Results are never written automatically into supplier profiles or the requirements list. You confirm each entry.
- Whether that service retains your input, and for how long, is its decision. Check its terms before sending anything sensitive.
Without a model service configured, everything else works; you simply have no summaries.
08Encryption and identity
The transport uses the following standard algorithms, all from Apple’s CryptoKit. There is no home-grown cryptography:
- Key agreement — an ephemeral X25519 key pair per connection (forward secrecy).
- Key derivation — HKDF-SHA256.
- Content encryption — ChaCha20-Poly1305 (authenticated; tampering is detected).
- Identity signatures — Ed25519. The handshake is signed by both identity keys, which authenticates the peer and blocks man-in-the-middle attacks.
An identity identifier is derived from the public key, and a fingerprint can be shown for you to read out and compare. Comparing fingerprints is the only reliable way to rule out a man in the middle — if they do not match, stop.
Encryption protects the transfer, not what happens afterwards. The other side can screenshot a message or forward a file. That is outside what any transport can protect, and outside our control.
09System permissions
| Permission | Why | If you decline |
|---|---|---|
| Local network | Finding peers on the LAN, connecting directly, accepting inbound connections | Communication only via a relay |
| Notifications | Alerting you to new messages | No alerts; messages still arrive in the app |
| Files and folders | Reading attachments and certificate files you pick; writing exports where you choose | That file cannot be sent or exported |
Beyond these, the app requests no Full Disk Access, Accessibility, Screen Recording or Input Monitoring. The sandbox limits it to its own container plus files you explicitly choose in the system file panel.
10Retention and deletion
How long data is kept is up to you. We hold no copy, so there is no retention period on our side.
- Messages and business records — kept until you delete them.
- Pending attachments — files queued while the other side is offline are removed from the queue as soon as they are delivered; records older than seven days are dropped, and the attachment copy goes through normal file cleanup.
- Diagnostic log — stored locally, viewable and clearable in the app.
Three ways to delete: a single message; a whole conversation (with its messages and attachments); or the app plus its container (everything).
11Your rights
Because the data is on your device, you can exercise these directly, without asking us:
- Access and export — the data directory is plain structure (SQLite and ordinary files), so you can back it up or export it.
- Rectify — edit supplier profiles, requirements and responses in the app.
- Erase — see section 10.
- Withdraw — clear the relay address to stop relaying; clear the model service settings to stop summaries.
If you believe we hold information about you that needs attention, or you have questions about this policy, contact us as described in section 14. We normally reply within seven business days.
Nothing in this policy limits any right granted to you by the law of your country or region.
12Children
The app is designed for procurement, tendering and supply-chain collaboration, not for children. We do not knowingly collect personal information from children; since the app collects no personal information at all, this does not depend on an age check. If you believe a minor is using the app inappropriately, please contact us.
13Changes to this policy
If this policy changes, the effective date and version at the top of the page change with it, and the new text is published here. Material changes to data practices will be called out prominently. It is worth re-reading after a major update.
We will not apply a revised policy retroactively to narrow rights you already have.
14Contact
Questions about this policy, data handling, or the app’s behaviour:
Including the app version (Settings → About) and your macOS version helps us investigate faster.
15Appendix: verify it yourself
A privacy policy should not require faith. Three things you can check on your own machine, without our help.
-
Data really is local
Send a few messages, then look at the container’s contents and timestamps:
ls -lh ~/Library/Containers/com.workbuddy.bizcollab/Data/Library/Application\ Support/Hai -
What it listens on and connects to
Endpoints are a local listener plus direct peers; if you configured a relay, that connection appears too:
lsof -nP -iTCP -sTCP:LISTEN | grep -i hai -
What it is allowed to do
The entitlements in the signature are the real capability list — sandbox, networking, user-selected files:
codesign -d --entitlements :- /Applications/Hai.app
If what you observe differs from this page, that is a defect. Tell us (section 14) and we will fix either the implementation or this document — both count as bugs.