Hark
Download

Privacy Policy

Last updated November 4, 2026

Hark is a native desktop email and calendar client for Google Workspace and Gmail accounts (macOS today; Windows and Linux planned), published by Souplin Labs LLC, a Wyoming limited liability company ("we", "us"). This policy explains what Hark does — and, more importantly, does not do — with your data.

Hark for Mac comes in two builds: the one from the Mac App Store (the “App Store build”) and the one downloaded from harkmail.app (the “website build”). They handle your Google data in exactly the same way. Where they differ — updates, crash reports and how you subscribe — this policy says which build it is talking about.

The short version

Hark has no backend for your mail or calendar. When you connect a Google account, your device talks directly to Google's servers. Your email, calendar, contacts, and Google access tokens stay on your device. We never receive, proxy, store, or have any access to your Google data. Nothing Hark sends us is taken from your mailbox — the one way anything of yours can reach us is if you attach it to a bug report yourself, which is described below. We cannot read your mail, because Hark never sends it to us.

What data Hark accesses, and where it stays

With your explicit consent on Google's sign-in screen, Hark uses Google APIs on your device to:

  • read, organise (label/archive/snooze/trash), search, and compose/send your Gmail;
  • read and manage your Google Calendar events and Google Tasks;
  • read your contacts, for two things: completing recipients and event guests as you type, and showing a sender’s profile photo on their messages;
  • read/update Gmail settings you change in the app (signature, vacation, filters, send-as aliases);
  • attach Google Drive files you explicitly pick to a message you are writing. Drive files already attached to a calendar event by someone else are shown, but Hark does not attach new ones to events.

All of this happens in a direct connection between your device and Google (googleapis.com). The data is stored locally on your device:

  • Google access/refresh tokens: in your operating system's secure keystore (macOS Keychain / Windows Credential Manager / Linux Secret Service), encrypted by the OS.
  • A local cache of recent messages, calendar events, and downloaded attachments, to make the app fast and available offline. Signing out of or removing the account removes it; deleting the app without doing so does not, and the help page lists what to remove by hand.

We do not transmit any of this to our servers — we have no server that touches it.

What we (the publisher) receive

Nothing from your mail, calendar or contacts. No telemetry, including the usage events below, contains your account list, email addresses, subjects, message content, or contacts. Hark never sends us anything out of your mailbox on its own.

The things below do reach us. Only a bug report can carry anything of yours — because you put it there:

  • Reporting a bug (only when you send one): the “Report a Bug” window sends what you typed, whether you marked it a bug or a feature request, which part of the app you picked from a fixed list, and any images you attach yourself, to a report endpoint we run. It has a “Your name or email (optional)” field that is pre-filled with the email address of your signed-in account so we can reply to you; it is sent with the report unless you clear or change it, and clearing it makes the report anonymous. It also sends your app version, build and commit, macOS version, hardware model, CPU/RAM/disk, thermal state, low-power mode, locale, time zone, uptime, the time you sent it, how many accounts are connected (a count) and a random per-install id. It sends no message content, subjects, anyone else’s address, tokens, or log files — the log-collecting reporter is a separate build that is not compiled into the public app at all. The images are the part to think about: if you attach a screenshot of your inbox to show us a bug, that screenshot reaches us, because you sent it. Attach nothing, and nothing of your mail leaves your Mac. Each report becomes an issue in a private GitHub repository we control, holding the title and description, the name-or-email field, the type and area, and the app and machine facts above; a copy of the report and its images is kept in our Cloudflare R2 storage. That copy is deleted 7 days after the issue is closed (an open issue keeps it; a copy whose issue no longer exists is deleted after 180 days). The GitHub issue itself is kept; to have yours deleted, email support@souplin.com. We are told of each new report by an email sent through Resend, carrying its type, area, title, app version and a link to the issue.
  • Checking for updates (website build only): once you have allowed automatic checks (Hark asks on its second launch), the app fetches a small update-feed file from a host we run, about once a day (about once an hour on beta builds), and downloads a new build from it when you accept one. Separately, even with automatic checks off, Hark reads that same public file at launch and once a day, retrying every 15 minutes while it cannot reach it, only to learn whether your version is still supported; nothing is downloaded or installed unless you choose to update. No identifiers are sent: the host sees your IP address and the time, the request’s User-Agent carries the app and macOS version, and the request carries your Accept-Language preference — nothing about your account. You can also check by hand from the Hark menu. The App Store build has no updater of its own: the App Store updates it, and Hark sends us nothing for that.
  • Counting active Macs: once a day, while Hark is open, it sends a random usage ID, the date, the Hark version, build number and update channel (which build it is), the macOS major version, and the number of Gmail accounts signed in to Hark (only the number, such as 0 or 2). If more accounts are signed in later that day, it sends the new number. The ID is created on your Mac for this count and for the usage events below, and is not linked to your Hark account, your subscription or any Google account. It carries no email address or other account identifier and nothing from your mail or calendar. The server does not store your IP address, and records are deleted after 13 months.
  • Usage events (Google Analytics): while you use Hark, it records which features you use. Each event is a fixed choice from a list built into the app: for example that you opened a message, replied, archived, picked a snooze preset, searched, created a calendar event, switched the calendar view, or changed a Hark setting (which one, and a value such as on, off or dark). Hark also records when a session starts and ends and how long it was in the foreground; whether a sign-in, sync or send failed (for a sign-in, a rough reason such as network; never the error text); the first-run and subscription screens you see; your subscription state (such as trial or subscribed) and whether it is through the App Store or harkmail.app; the number of Gmail accounts signed in (0, 1, 2, or 3 or more); when Hark was installed (only the week, for installs older than this feature); the Hark version, build and update channel; the macOS major version; and the app’s display language. Each event has its time to the second (for a subscription change we keep only the day), a random event id and a counter. Events never contain anything you type, search terms, label or calendar names, email addresses, subjects, message or event content, message counts, or any other data from your Google account.
    Hark sends the events to our server (events.harkmail.app), not to Google; the app contains no Google Analytics or Firebase code. Our server uses your IP address only to limit request rates and to look up your country. It does not store or pass on your IP address or your User-Agent. It forwards the events, with your country code (such as DE), to Google Analytics, which processes them for us under Google’s data processing terms. Google sees our server’s address, not yours. We have turned off Google signals, ads personalization and all of Google Analytics’ data-sharing settings. Google Analytics deletes the individual events after 14 months; its summary reports (totals, not individual events) can be kept longer. We also keep a copy of the events, with the country code but no IP address or User-Agent, in our Cloudflare R2 storage, and delete it after 14 months. The events use the same random usage ID as the daily count above. Events not yet sent wait on your Mac for up to 14 days.
  • Attaching a Google Drive file: Google’s file picker is a web component, so choosing a file opens a page on harkmail.app in your browser. Loading it reaches our host, which sees your IP address, the time, and a random one-time id — the same things any website sees. It does not see your email address, your files, or which file you picked, and the page’s Google credential is created in your browser and never sent to us. It can only ever grant access to files you pick yourself: it comes from a separate Google Cloud project that has never been granted access to mail. Nothing happens here unless you use this feature.
  • Crash diagnostics (opt-in, off by default): with it switched on, Hark reads the crash reports macOS itself keeps about Hark (the website build reads the crash files macOS writes; the App Store build receives them through Apple’s MetricKit, when macOS delivers them) and sends a fixed set of fields: an incident id and time, the app version, build and commit, the macOS version and hardware model, the exception type, signal and termination reason, which thread crashed, and the stack frames. No field in that report can carry mail — no message content, no addresses, no account identifiers. With the switch off, Hark reads no crash reports at all, let alone sends one. We delete crash reports after 90 days.
  • App Store purchases and subscriptions (App Store build): you buy a Hark subscription through Apple’s In-App Purchase, and Apple processes the payment: we never see your card, your Apple Account, its email address or your name. Each Mac carries a random identifier generated on that Mac (not a serial number or any hardware address). The App Store build sends it to our subscription server to ask whether this Mac is subscribed, and passes it to Apple with a purchase, which Apple returns inside the transaction. When you subscribe, restore purchases, or the subscription renews or changes, the app sends us the transaction information Apple signed, and Apple sends us its own notices about that subscription. From these we keep: Apple’s transaction ids, the product, whether it was bought in Apple’s test environment, the subscription’s state, its expiry and billing-grace dates, whether it will renew, any refund or revocation date, the per-Mac identifier, and, for another Mac signed in to the same Apple Account, Apple’s id for that account’s download of Hark and when that Mac was added and last checked. If you never subscribe, asking stores nothing. App Store and harkmail.app subscriptions are separate: one does not unlock the other build. Manage or cancel an App Store subscription in your Apple Account’s subscription settings (App Store › your account › Subscriptions); Apple handles refunds. We never link any of this to, or receive, your Gmail data.
  • Subscribing on harkmail.app (website build): payment is processed by Stripe, and your billing account is separate from your Google account: you create it with an email address of your choosing and sign in either with a one-time link emailed to that address or with Google Sign-In — through a separate sign-in client that has no access to Gmail, never the connection Hark uses for your mail. Each Mac you use Hark on carries a random identifier generated on that Mac (not a serial number or any hardware address), which is what links it to your billing account; you can link up to five, and your account page lists them and can remove the Mac whose Hark opened it. We receive a subscription record: that email, a Google account id if you signed in with Google, subscription status with the date it started and the renewal or retry-until date that goes with it, an opaque Stripe customer reference, those per-Mac identifiers, when each Mac was linked and last checked in, and — once a Mac of the website build asks what it is entitled to — when that Mac’s 30-day trial started and ends, whether or not you ever subscribe. Signing in stores a one-way hash of the sign-in link and of your session, with when each was created and last used; the session key itself is held only until the browser that asked for it collects it, and the record is deleted once the link expires. We never link it to, or receive, your Gmail data.

What other services see

Some things Hark shows come from services other than Google’s APIs and us. They are fetched from your Mac at the moment they are shown, and we never see the requests. Each of these services sees your IP address and the time, as any website does.

  • Images in messages: a message’s remote images load from the servers its sender chose, and a sender can use them to tell that the message was opened. Hark shows them by default; to be asked first, set External images to “Ask before displaying external images” under Settings › General. That setting also turns off the two lookups that follow.
  • Site icons: for a sender with no Google profile photo, Hark asks Google’s site-icon service (t2.gstatic.com) for the icon of the sender’s domain, sending that domain name (for example example.com) — never the address.
  • Brand logos (BIMI): to show the logo a company publishes for its mail, for a sender with no Google profile photo, Hark looks up the sender’s domain (and its parent domain) through Google Public DNS (dns.google), sending the domain name only. If the domain publishes a logo, Hark downloads it from the address the domain names.
  • Gravatar (off by default): with “Look up avatars on gravatar.com” switched on under Settings › Advanced, Hark sends gravatar.com an MD5 hash of a contact’s email address to fetch their picture.
  • Subscribed calendars: a calendar you subscribe to by its web address (an .ics feed) is downloaded by Hark directly from that address, and refreshed while Hark runs. The feed’s host sees the request as it would from any calendar app.
  • One-click unsubscribe: when you use Unsubscribe on a mailing-list message that supports one-click unsubscribing (RFC 8058), Hark sends the sender’s unsubscribe address the standard request for it. That address belongs to the sender, which is how they learn you unsubscribed.
  • Place search: typing a location for a calendar event uses Apple’s Maps search, which receives what you type, under Apple’s privacy policy.

Service providers: a few providers run the parts that reach us. Cloudflare hosts harkmail.app, the update downloads, the bug-report, crash-report, active-Mac and usage-event endpoints, and the storage behind them. Google (Google Analytics) receives the usage events described above. GitHub hosts the private repository where bug reports are tracked. Resend sends the one-time sign-in links for a harkmail.app billing account and our own new-report notices. Stripe processes payments made on harkmail.app; Apple processes App Store purchases. None of them receives your Google data.

This website: public pages of harkmail.app load Cloudflare Web Analytics, a cookieless counter that records page views, the referring page, and coarse browser, device and country data. It does not run on the sign-in, account, checkout or Drive picker pages, and it never sees anything from the Hark app or your Google account. Each download from harkmail.app/download records the country, the operating system and browser family, and the referring site (with any campaign tag in the link); it never records your IP address or your full user agent, and these records are deleted after 13 months.

How Google user data is used — and Limited Use

Hark's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • Google user data is used only to provide and improve the user-facing email/calendar features inside Hark, on your device.
  • We do not transfer Google user data to third parties except as necessary to provide those features (the direct device↔Google connection), for security, or to comply with law.
  • We do not use Google user data for advertising.
  • Usage events contain no Google user data, so none of it reaches Google Analytics.
  • We do not allow humans to read Google user data, except with your explicit consent for a specific support request, where required for security/abuse, or as required by law.
  • We do not use Google user data to train generalized/ML models.

How we protect your data

The sensitive data Hark is trusted with — the contents of your Gmail, your calendar, your contacts and your tasks — is protected by keeping it in as few places as possible, and by the operating system's own protections in the one place it does live:

  • In transit: every request runs over HTTPS/TLS directly between your device and Google's servers (googleapis.com). Hark opens no cleartext connections, and there is no proxy or intermediary of ours in that path.
  • Credentials: your Google access and refresh tokens are held only in your operating system's secure keystore (macOS Keychain / Windows Credential Manager / Linux Secret Service), which encrypts them and gates access to them. They are never written into Hark's own files.
  • At rest: the local cache of messages, events and attachments is a file in Hark's application-support directory, protected by your operating system's file permissions and by your device's full-disk encryption (FileVault on macOS, BitLocker on Windows). To be precise rather than reassuring: Hark does not add a second layer of encryption of its own on top of that cache. If your device is not using full-disk encryption, enabling it is what protects this data at rest.
  • Nothing to breach on our side: we operate no server that receives, stores or processes your Google data, so there is no copy of it in our infrastructure to be exposed. See “What we (the publisher) receive” above for the small set of data that does reach us, none of which is Google user data.
  • No diagnostic trace in the shipped app: the action/API-call tracing and bug-report upload used for internal testing is compiled out of the public release build entirely — it is not present in the binary you run, so it cannot capture or transmit your mail.
  • Least privilege: Hark asks for the narrowest scope that implements each feature. For Google Drive that is drive.file, which grants access only to files you individually pick in Google's own file picker — not to your Drive.
  • Access control: we do not access your Google user data, and no employee or contractor reads it, except in the narrow cases set out under Limited Use above (your explicit consent for a specific support request, security/abuse, or where required by law).

Data retention & deletion

Because your Google data lives only on your device, you control it: signing out of your last account removes the local copy and the stored tokens and tells Google to revoke Hark's access. Removing one of several accounts removes its local copy and tokens, and revokes Hark's access only if you tick “Also revoke Hark’s access to this Google account.” If you delete Hark without signing out of or removing every account, the help page lists what to remove by hand. To revoke Hark's access entirely, remove it at Google Account → Security → Third-party access.

Deleting your Hark billing account (website build): sign in at harkmail.app/account/delete. This removes your sign-in, every signed-in browser and the list of linked Macs, and anonymises the subscription record. If you paid through harkmail.app, your billing records and customer profile (email, name, saved payment method) are kept by Stripe, our payment processor; to ask for their removal, email support@souplin.com. While a harkmail.app subscription would still renew, cancel it first; one already cancelled is not charged again.

The App Store build has no Hark account, so there is no account to delete. Cancel an App Store subscription in your Apple Account’s subscription settings; to have the per-Mac identifier and the App Store subscription record described above removed, email support@souplin.com.

Children

Hark is not directed to children under 13 (or the equivalent minimum age in your jurisdiction).

Changes

We may update this policy; the "Last updated" date reflects the latest version. Material changes will be noted in-app or on the website.

Contact

support@souplin.com · Souplin Labs LLC, 28 Geary St STE 650 #493, San Francisco, CA 94108, USA