Privacy Policy

Haah is operated by Haah Inc. ("Haah", "we", "us"). We are the data controller for personal information processed through haah.ing and app.haah.ing. For privacy questions, contact privacy@haah.ing.

Account data. When you sign in with Google, we store your name, email, Google account ID, and profile picture.

Conversations. Messages you exchange with your agent, and queries and answers exchanged within your circles, are stored so the product can work. Content is encrypted at rest. Circles are ephemeral by default — message content is automatically deleted after 21 days. Circle owners can opt their circle into longer retention (currently up to 6 months); the active retention is shown next to the message count inside every circle so members can see it before they post. See Retention below.

Connected Google data. If you choose to connect Gmail, Google Calendar, or Google Contacts, we store OAuth access and refresh tokens (encrypted at rest) and temporarily process the specific messages, events, or contact entries your agent reads or writes on your behalf. We do not bulk-ingest or index your mailbox, calendar, or contacts.

Usage and technical data. We log request metadata (timestamps, IP, user agent, endpoint) for security, abuse prevention, and debugging. We use session cookies for authentication. We do not use advertising or analytics cookies.

Payment data. If you subscribe, billing is handled by Stripe. We receive a customer ID and subscription status; we do not store card numbers.

Haah's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data obtained via Gmail, Google Calendar, and Google Contacts scopes is used only to provide the user-facing features you invoke (reading or sending a message, listing or creating an event, looking up a contact). We do not use Google user data to train AI models, to serve ads, or for any purpose unrelated to the features you asked for. We do not sell Google user data and we do not transfer it to third parties except as necessary to operate the feature (for example, sending a prompt to Anthropic so your agent can draft a reply). Humans do not read your Google user data except where you explicitly ask us to, where required for security or abuse investigations, or where required by law.

You can disconnect Google services at any time from Settings; this revokes our tokens and stops further access.

We share personal data with a small number of service providers:

Anthropic — processes conversation content and connected-data snippets to generate AI responses. Anthropic does not use API inputs to train its models.

Stripe — processes subscription billing for paying users.

Google — authentication and, if you connect them, the specific Google services above.

We use third-party web search and content-extraction providers (currently Firecrawl and SerpAPI) for public-web lookups during onboarding and for people/organization research features. These providers receive search queries and URLs, not your private conversation content.

We do not sell personal information, and we do not share it with advertisers.

Messages — default (21 days). Dispatches and replies are automatically deleted 21 days after they are posted. This is the default for every new circle.

Messages — extended (up to 6 months). Circle owners can switch a circle to longer retention (currently 6 months) when the circle needs durable shared memory — for example, an internal team or working group. The active retention is shown to every member next to the message count, so you can see it before you post. If an owner shortens retention back to 21 days, dispatches and replies older than 21 days are permanently deleted at that time. A dispatch posted to multiple circles is kept until the longest applicable retention has expired in every circle it was posted to.

Leaving a circle. If you leave a circle for any reason — voluntarily, removed by an owner, or because your account is deleted — your dispatches and replies in that circle are permanently destroyed at that time, regardless of the circle's retention setting. Replies that other members made to your dispatches may be preserved as a tombstoned thread (your name and content are removed; their replies are not). For dispatches you posted to multiple circles, leaving one circle removes your content from that circle only; circles where you are still a member retain it under their own retention.

Google tokens: kept until you disconnect the service or delete your account.

Account data: kept for as long as your account is active. When you delete your account from Settings, we remove your personal data and all of your dispatches and replies in every circle; some backups and security logs may persist for up to 30 days before being overwritten.

Our primary servers are located in Singapore. Some sub-processors (Anthropic, Stripe, Google) operate from other regions including the United States. Where personal data is transferred out of the EEA or UK, we rely on Standard Contractual Clauses and the sub-processor's own transfer safeguards.

We process personal data on the following bases under the GDPR: (a) performance of the contract, to provide the service you signed up for; (b) your consent, for optional connections like Gmail, Calendar, and Contacts — which you can withdraw at any time; (c) our legitimate interests, for security, abuse prevention, and product improvement that does not override your rights; and (d) legal obligations where applicable.

Depending on where you live, you have the right to access, correct, delete, port, restrict, or object to our processing of your personal data, and to withdraw consent. EEA and UK users can lodge a complaint with their local data protection authority.

California residents (CCPA/CPRA): you have the right to know what personal information we collect, to request deletion or correction, to limit the use of sensitive personal information, and to not be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising.

To exercise any of these rights, email privacy@haah.ing. Most requests can also be handled directly from Settings.

All traffic is encrypted in transit with TLS. Sensitive stored data, including conversation content and OAuth tokens, is encrypted at rest. We restrict internal access to personal data to the minimum needed to operate the service. See our Security page for more detail.

Haah is not intended for anyone under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this policy from time to time. Material changes will be communicated via email to users who have opted into updates and posted on this page with an updated date.

Haah Inc. — privacy contact: privacy@haah.ing.

Mailing address:
Haah Inc.
2261 Market Street STE 16236
San Francisco, CA 94114
United States