Privacy Policy

Heatsink is local-first. Without signing in, the desktop app reads your PC's sensors, drives your case screen and lights, and saves your themes on your PC. None of that is sent to us. The app contacts us only to check for a newer version, and that check carries no account information.

When you create an account or sign in, we collect the following:

• Account information. We store your email address and display name. How we receive them depends on how you sign in: from Google or Microsoft when you use social sign-in, or from you directly when you sign up with an email code or a password. A password is stored only as a hashed credential; a passkey is stored only as a public key, which cannot be used to sign in as you anywhere else.
• Two-factor secrets. If you turn on two-factor authentication, we store your authenticator secret on our servers, out of reach of any app or browser, and your recovery codes only as hashes, never in a form we can read back.
• Themes and lights. We store the themes you save to your account, with their version history so a change can be undone, and each signed-in PC's lighting setup.
• Computer snapshots. Each signed-in PC reports its name, its hardware components and their current sensor readings (such as temperatures, loads and fan speeds) so you can see and control it from the web. Removing a computer in Settings deletes its snapshot.
• Streams and connections. We store the definitions of the data streams you set up and, for an MCP connection, the list of tools it offers. We never store the API keys or passwords those streams use; they stay on your PC.
• Agent conversations. We store your conversations with the in-app assistant for 30 days so you can pick one up again, then delete them.

• To authenticate you and keep you signed in across the desktop app and the web.
• To sync your themes, lights and streams between your PCs and the web.
• To show your PCs' sensor readings in the web app and let you, or an assistant you connect, control them.
• To send transactional email you request, such as sign-in codes and notices that your email address changed.

Your account and application data is stored using Google Firebase (Firestore and Firebase Authentication) in the United States. Our API and MCP server run on Google Cloud Run in the us-central1 region.

We do not sell, rent, or share your personal information with third parties for their marketing purposes. We share data only with infrastructure providers necessary to operate the Service (Google Cloud, Firebase, our transactional-email provider Plunk, and the AI providers described below) and only to the extent required to provide it.

The Service does not use analytics, advertising or error-reporting services, and sets no tracking cookies. If we add any, we will describe them here before they go live.

To answer a request in the in-app assistant, Heatsink sends an AI provider the text you type and what the assistant reads to answer it, such as a theme, your PCs' sensor readings, or a stream's data. To give an unfamiliar sensor a readable name, Heatsink sends the sensor's technical name and its hardware component. We currently use:

• Anthropic (Claude) answers the assistant, names themes and lighting effects, and labels sensors. It keeps your content for up to 30 days, may access it in that time for safety and security, and then deletes it. Content its automated systems flag can be kept for up to two years.
• Fireworks AI steps in for each of those jobs when Anthropic is unavailable. It holds your content in memory only, for minutes at most, and does not write it to storage. It logs usage counts, not content.

Under our current account settings, neither provider uses your content to train its models. Heatsink does not control how a provider handles your content once it is sent. We may add or change providers, and we will update this section when we do.

If you connect an assistant of your own, such as Claude or ChatGPT, to your Heatsink account, what it reads through Heatsink is handled by that assistant's provider under its agreement with you. You can revoke that access by disconnecting Heatsink in that assistant, or by emailing legal@heatsink.io.

Account data is retained for as long as your account is active. Agent conversations are deleted after 30 days. Sign-in codes and other single-use records expire within minutes. To delete your account and everything stored with it, email legal@heatsink.io from your registered account email. Once deleted, your data cannot be recovered.

The Service is not directed to children under 13. By using the Service, you confirm that you are at least 13 years old. If you believe a child under 13 has provided us with personal information, contact us at legal@heatsink.io and we will delete the associated data promptly.

You may access, correct, or delete your personal data at any time.

• Deletion: delete themes and remove computers in the app, or email us to delete your account as described under Data Retention.
• Correction: edit your profile in the app, or email legal@heatsink.io for anything you cannot change yourself.
• Access: email legal@heatsink.io for a copy of the data stored with your account.

If you can no longer sign in, email us from your registered account email. We respond to all requests within 30 days of receipt.

We may update this policy from time to time. When we do, we will revise the "last updated" date at the top of this page. Continued use of the Service after changes constitutes acceptance of the revised policy.

Questions or concerns? Email us at legal@heatsink.io.