Privacy Policy

Draft dated November 10, 2026. Not yet in effect.

This is a draft. It describes how we intend to handle information in Hickory and is still being reviewed by counsel. It may change before Hickory opens more widely. Items marked TBD are not decided yet. Questions are welcome at support@heyhickory.com.

1. Who we are

Hickory is a personal AI assistant made by Hickory Labs LLC, a Virginia company based in Charlottesville, Virginia ("Hickory Labs", "we", "us"). This policy covers the website at heyhickory.com, the Hickory apps and web app, any messaging channels we offer (such as text messages), and related services (together, the "Services"). "You" means the person using the Services.

2. The short version

• We collect what you give Hickory and what it needs to do the job you ask for.
• We do not use your conversations, memories or connected-account data to train AI models, and we don't let our model providers do so either.
• Your messages are processed by third-party AI model providers, currently Anthropic, so Hickory can answer.
• We don't sell your personal information or share it for cross-context behavioral advertising.
• You can ask us to delete your account and data at any time.

3. Information we collect

Information you give us

• Waitlist and contact details. If you request access, your name, email address and, if you choose, who you'd use Hickory with.
• Account details. Your name, email address, and phone number if you add one. If you sign in with a provider such as Google or Apple, we receive the basic profile details that provider shares, such as your name and email address.
• Content. Messages, voice input, files, images, lists, calendar items, notes and anything else you send to Hickory or save in it, including the memories Hickory keeps so it can help you over time.
• Payment details. If you buy a paid plan, payment is handled by a third-party payment processor. We receive limited information such as your plan, billing status and the last digits of your card, not your full card number.
• Messages to us. Anything you include when you email support or send feedback.

Information collected automatically

• Device and log data, such as IP address, browser and device type, operating system, time zone, pages and features used, and timestamps.
• Security signals. Our site uses Cloudflare Turnstile to tell people from bots on forms, and we keep a salted, one-way hash of your IP address for a short time to limit repeated form submissions.
• Usage data, such as how many messages you send and which features you use, so we can run the service, enforce plan limits and fix problems.
• Location, only if you choose to share it with Hickory.

Information from others

• Connected services you choose to link, described in section 6.
• Other members of a Space may add content that mentions you, as described in section 7.

Depending on how you use Hickory, your content may include sensitive information, such as health questions, information about your children or household, or financial details. Share only what you're comfortable with Hickory using to help you. Hickory is not a doctor, lawyer or financial advisor.

4. How we use information

• To provide the Services: understand your requests, answer them, remember context you've asked Hickory to keep, and take actions you've asked for or allowed.
• To run your account, process payments, and enforce plan and usage limits.
• To keep the Services safe and secure, prevent fraud and abuse, and debug problems.
• To communicate with you about your account, the waitlist, changes to the Services, and support requests.
• To understand how the Services are used and improve them, using aggregated or de-identified usage data where we can.
• To comply with law and to protect our rights and the rights and safety of others.

If we ever want to use your information for a purpose that is materially different from these, we'll ask you first.

5. AI model providers and training

Hickory uses large language models run by third-party providers. Today that is Anthropic. To answer you, we send the relevant parts of your messages, memories and connected data to the provider, which processes them on our behalf under its commercial terms. We may add or change model providers; we'll update this section when we do.

We do not train, fine-tune or otherwise improve AI models on your content, and we use model providers' commercial offerings under which your inputs and outputs are not used to train their models. Providers may keep data for a limited period for abuse monitoring or as required by law, under their own terms.

We may review specific conversations only when you ask us to (for example, in a support request), when they are flagged for a suspected violation of our Terms, or when the law requires it.

6. Connected accounts

You can choose to connect other services to Hickory, such as a calendar, email or file storage. When you do, Hickory receives the data that service shares under the permissions you grant, and uses it only to do what you ask. You can disconnect a service at any time in Hickory's settings, and disconnecting stops new access. To remove data Hickory already retrieved, ask us or delete your account.

Google user data. Hickory's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We don't use Google user data for advertising, we don't sell it, we don't use it to train AI models, and we don't let model providers use it for training or any purpose other than providing Hickory to you.

7. Shared Spaces

Hickory lets you create Spaces you share with other people, like a partner, family or team. Content you add to a shared Space, including messages, lists, calendar items and Space memories, can be seen and used by the other members and by Hickory when it helps them. Your personal Hickory stays private to you unless you choose to share something into a Space. The owner of a Space may be able to remove members or delete the Space and its content.

8. Text messaging

We may offer the option to message Hickory by SMS or other messaging apps. If you add your phone number and opt in, we'll use it to deliver Hickory's replies and, where needed, one-time sign-in codes.

• Message frequency depends on how you use Hickory. Message and data rates may apply.
• Reply STOP to opt out at any time; reply HELP for help, or email support@heyhickory.com.
• We do not sell, rent or share your mobile number or text-messaging opt-in information with third parties for their marketing. We share it only with the messaging providers that deliver messages for us.

See the text-messaging section of our Terms for the program terms.

9. When we share information

We do not sell your personal information. We share it only as follows:

• Service providers that help us run Hickory, such as cloud hosting and storage, databases, AI model providers, payment processing, messaging and email delivery, and security. They may use the information only to provide services to us.
• People you choose to share with, such as members of a shared Space.
• Third parties Hickory contacts for you, when you ask Hickory to take an action that involves them.
• Connected services, when you direct Hickory to send information to them.
• Legal and safety: to comply with law or valid legal process, to protect the rights, property or safety of you, us or others, and to investigate fraud or abuse.
• Business transfers: as part of a merger, acquisition, financing or sale of assets, subject to this policy's protections.
• Professional advisors, such as lawyers and accountants, under confidentiality duties.

We may share aggregated or de-identified information that can't reasonably be linked to you. We won't try to re-identify it.

10. Cookies and similar technologies

The heyhickory.com marketing site does not use advertising cookies or third-party analytics today. Cloudflare, which hosts the site, may set strictly necessary cookies for security and bot protection. The Hickory app uses cookies and local storage to keep you signed in and remember your settings. If we add analytics, we'll update this section. Our site does not currently respond to browser "Do Not Track" signals.

11. Retention

We keep information for as long as your account is active and as needed to provide the Services, then delete or de-identify it, unless we need to keep it longer to meet legal, tax or accounting obligations, resolve disputes, or enforce our agreements. Specific retention periods for each kind of data are TBD and will be listed here before launch. Waitlist entries are kept until Hickory opens to you or you ask us to remove them.

12. Your choices and rights

• Access, correction and deletion. You can ask for a copy of your information, correct it, or delete your account and its data by emailing support@heyhickory.com. In-app controls are TBD.
• Memories. You can ask Hickory what it remembers and ask it to forget things.
• Connected services. You can disconnect them at any time.
• Email. You can unsubscribe from non-essential emails using the link in them. We'll still send messages about your account.
• Texts. Reply STOP.

Depending on where you live, including Virginia under the Virginia Consumer Data Protection Act, you may have rights to access, correct, delete or get a portable copy of your personal data, to opt out of certain processing, and to appeal our decision on a request. To use them, email us. We'll verify your request, respond within the time the law requires, and won't discriminate against you for using your rights. If we decline your request, you can appeal by replying to our decision.

13. Security and agent risks

We use reasonable technical and organizational measures to protect information, including encryption in transit and access controls. No system is perfectly secure, and we can't guarantee security.

An AI assistant that can take actions for you carries extra risks: it can misunderstand a request, produce wrong or incomplete answers, or be targeted by content written to manipulate AI agents. Review important actions before you rely on them, and grant only the permissions you need.

14. Children

Hickory accounts are for adults (18 or older). We don't knowingly collect personal information directly from children under 13. Parents may store information about their household, including children, in Hickory to manage family life; that information belongs to the parent's account and is handled under this policy. If you believe a child has given us personal information directly, contact us and we'll delete it.

15. Where data is processed

Hickory Labs is based in the United States, and we and our providers process information in the United States and possibly other countries. If you use Hickory from outside the U.S., your information will be transferred to and processed in the U.S.

16. Changes to this policy

We may update this policy. We'll change the date at the top, and if a change is material we'll give you reasonable notice, for example by email or in the app, before it takes effect.

17. Contact

Hickory Labs LLC
Charlottesville, Virginia, USA
Mailing address: TBD
support@heyhickory.com