Your messages never leave your Mac.

The short version

• Message data never leaves your Mac. No message, contact, attachment, phone number, or follow-up is uploaded, and there is nowhere on our side to put one.
• The model is on-device. The model that decides whether a reply is owed is Apple’s, running on your Mac. Nothing about your conversations is sent to us, to Apple, or to anyone else.
• The server stores account identity and subscription state. Your email address, an account id, what Stripe says about your subscription, and a hash for each Mac you have used. That is the whole of it.
• Full Disk Access is required because Apple offers nothing narrower. There is no “read Messages” permission to ask for instead.
• Nothing is sold or shared. There are no advertisers, no data brokers, no analytics SDKs, and no third party with a view of your conversations.

What ZenHive reads on your Mac

With Full Disk Access granted, ZenHive reads:

• The message history your Mac already stores — conversations, message text, timestamps, read receipts, tapbacks, and inline replies. It is read only; ZenHive changes nothing in it.
• Which conversations you have pinned, so the list matches Messages.
• Attachments in a conversation, when you open one that contains them, so they can be shown.

Separately, and only if you allow it, ZenHive asks macOS for Contacts access so that conversations carry names and photographs instead of phone numbers. Refusing it costs you names, and nothing else.

Everything ZenHive derives from all of this — the reply-speed habits, the follow-up scores, the leaderboard, what the model made of a conversation — is worked out on your Mac and kept on your Mac.

The on-device model

ZenHive hands the last few messages of a conversation to Apple’s on-device model and asks three narrow questions: what the last message wants, whether you still owe a reply, and what the next move is in a few words.

That model runs on your Mac. It is part of macOS, it does not need a network connection, and ZenHive holds no key to any hosted model — there is no cloud service to switch on, and no version of this app that sends your conversations anywhere.

What the server stores

ZenHive has a small backend, and its only job is to know whether you have paid. It runs on Supabase, with Stripe for payments. It holds:

• Account identity. A user id, and the email address and display name Google returns when you sign in. You choose whether to sign in at all: the free half of the app never asks.
• Subscription state. Your Stripe customer id and subscription id, the status Stripe reports, the current period end, and when your trial started. A log of status changes is kept so that a billing question can be answered.
• Devices. A code identifying each Mac that has activated your account, with a name and the date it was last seen. This exists so one account shared around an office is visible as one, not to limit the Macs you personally use.
• Issued licences. A record that a licence was issued to an account, for a device, on a date. It contains no message data.

The app asks our server where your account stands, receives a signed answer, and believes it for up to seven days. That is the entire conversation between your Mac and our server.

Payments

Stripe processes payments and holds your card details. We never see a card number. Stripe’s own privacy policy governs what it collects when you are on its checkout or billing pages, and the invoices it keeps are subject to the tax and accounting rules it operates under.

Who else is involved

• Google — sign-in only. It tells us your email address and display name; it is told nothing about you in return.
• Supabase — hosts the account records and the sign-in service described above.
• Stripe — subscriptions, cards, invoices, and the billing page.
• GitHub — hosts the download and the update feed. Downloading the app means GitHub sees a request from your IP address, as any download from anywhere does.

None of them receive message data, because none of them are ever sent any. Apple is not on this list either: nothing is transferred to Apple, because the model that reads your conversations is running on the Mac in front of you.

This website

The site sets no advertising or tracking cookies and runs no analytics script. Two things are stored in your browser: your light-or-dark preference, and — only if you sign in on the account page — the session token that keeps you signed in. Both live in your browser’s local storage and can be cleared at any time.

Keeping and deleting

Account and subscription records are kept while your account exists, and the change log and issuance ledger are kept as the record of a commercial relationship. Write to support@zenhive.co from the address you signed in with and we will delete your account and the rows attached to it, other than what Stripe is required to keep for its own accounting. Deleting the app deletes everything it derived, because all of it was only ever on your Mac.

Your rights

Depending on where you live you may have rights to access, correct, export, or delete the personal data an operator holds about you. Here that is a short list, and the same address answers all of it: support@zenhive.co. We do not sell personal data and have no mechanism to.

Children

ZenHive is not directed at children, and accounts are not knowingly created for anyone under 13 (or the age of digital consent where you live, if it is higher).

Changes

If this policy changes in substance, the date at the top changes with it and the app says so. A change that reduced what stays on your Mac would be a change to the product, not to a policy, and would be announced as one.

Questions about any of it: support@zenhive.co. The terms cover the commercial side.