Hailsi translates conversations on your device. Your voice and your conversations are transcribed, translated, and voiced by models running on your own computer — Hailsi does not send them to us or to any cloud service for processing. Hailsi has no user accounts and no analytics or telemetry code: the app never reports how you use it.
A small number of narrow network features do exist, and this policy lists all of them: license checks for paid purchases, an update and model-catalog check, model and voice-component downloads, and — if you use it — Hailsi Link, whose connection service necessarily sees connection metadata such as your IP address. Each is described plainly below. There are no others.
%APPDATA%\Hailsi\user-settings.json). Saving transcripts to disk is
on by default and can be turned off (the toggle is offered during onboarding); turning it
off stops the disk write immediately, mid-session.%APPDATA%\Hailsi\entitlement.json;
it includes the purchase email address the payment provider returns to the app (see §2.1).%LOCALAPPDATA%\Hailsi\models; the fast-voice
pronunciation component (§2.3) is cached in the app's install folder, not under models..hailsi\logs folder in your Windows user
profile (%USERPROFILE%\.hailsi\logs). They leave the machine only if you choose to send
them (§3).Deleting your data: you can delete individual sessions or all history in Settings ("Clear conversation history"), cap how many sessions are kept, or use "Start fresh" to wipe all user content back to a new-install profile ("Start fresh" keeps your license). Uninstalling and deleting the folders above removes everything else except the license key, which lives in the Windows Credential Manager: deactivating the license in the app (Settings → "Deactivate this device") frees the machine slot and removes the stored key, and the uninstaller's optional "Delete app data" checkbox does the same when the machine is online (and keeps the key if it is not); if you uninstalled without deactivating, remove the entry directly in Windows Credential Manager. All of this data is on your machine, under your control — we hold no copy.
Hailsi's core loop is local. The following are all of the app's network connections, what each one carries, and when it happens.
Purchases are handled by Lemon Squeezy as merchant of record: checkout happens in your browser on their hosted page, and your payment details go to them, not to us (their privacy policy governs the purchase itself).
If — and only if — you activate a paid license, the app talks to Lemon Squeezy's license API over HTTPS:
At most once per launch (plus when you check manually), the app fetches a single static file
(latest.json) from updates.hailsi.com to learn whether a newer version exists. The
request carries no identifiers: no account, no machine ID, and not even your app version
(the comparison happens locally). Like any web request, it necessarily reveals your IP
address and a user-agent string (which names the updater component, not your app version).
Downloading and installing an update each require your explicit click.
Separately, at every launch the app refreshes its model catalog (the signed list of
downloadable language/voice packs) from the same host: up to two requests that carry no
information about you — no body, no query parameters, no identifiers. So: the app does
contact updates.hailsi.com automatically at every launch, and those requests carry
nothing about you beyond what any HTTP request inherently reveals.
When you install a language or voice pack, the files are fetched from Hailsi's
download host (dl.hailsi.com, served by Cloudflare), or from Hugging Face: for packs not
yet mirrored, and as a per-file fallback when a mirrored file is unavailable. The app's
processing-engine runtime — which the first-run setup you confirm downloads — and the
Quality-voice environment come from dl.hailsi.com only, with no fallback source. The
requests are plain public-file downloads: no user content, no
account, no authentication. Because the URL names the pack, the download host necessarily
learns which language packs were fetched from your IP address, and therefore which languages
you use — a property of any download, not an added identifier.
What triggers a download, and how you are told. These downloads are large, so the app tells you about them:
Nothing a Link partner sends can trigger a download — this is enforced in code: resolving a partner's pack list is inert and never starts a fetch.
Every file downloaded from these pack sources is checked against a signed catalog — a cryptographic hash for pinned files; for specific files the signed catalog may authorize a size check instead.
One additional component download. If your languages use the fast voice tier (the default where it is available), the app's processing engine downloads its pronunciation component — a pinned binary (the goruut engine) — the first time it is needed: from GitHub (the component's official release page). Its size is included in the first-run total above and in the download notices. The request is a plain public-file download — no user content, no account, no identifiers — and, as with any download, that host sees your IP address and which file was fetched. The file is verified against a checksum pinned in the app's own code (this component is not distributed through the signed catalog above). If GitHub cannot be reached, the component is not downloaded and the app falls back to its other voice engine for those languages (or to text only, if that engine is not installed), and it tries the download again the next time it is needed. That component runs as a helper process on your computer that opens a local network port for the app's own use only; Windows may ask you about network access for it — the app tells you beforehand that it needs none, and choosing Cancel does not affect Hailsi.
Hailsi Link connects you and one partner for a text-translated conversation. What it shares, plainly:
api.hailsi.com). As with any server, it sees each side's IP address and connection
metadata. The connection setup data it forwards (WebRTC "ICE candidates") also inherently
contains the machines' local and public IP addresses — that is how peer-to-peer
connections are established.Nothing automatic. Described in §3.
That is the complete list. Automated checks in Hailsi's release process enforce the app interface's limits: it can only ever talk to the addresses allowed above (a release that added a new interface network connection would fail those checks). Separately, the license, update, and download traffic runs from the app's own code against exactly the endpoints named in §2.1–2.3.
HAILSI_DIAG_LOG_CONTENT), which opens the same gate; while
it is set, the in-app switch cannot close it, and the Privacy pane says so ("Recording is
being forced on by the HAILSI_DIAG_LOG_CONTENT environment variable set on this machine").
Your audio is never written to the log in either state. Even while transcript recording is
on, "Report a problem" still strips those transcripts out of the copy it saves — an
automated check pins that the redaction applied to the exported copy is byte-identical
whether the switch is on or off.Logs leave your machine only if you run "Report a problem", which builds a
plain-text report at a location you choose in a save dialog. Large reports (above
10 MiB) are split into several numbered files. The report opens in any text editor and
begins with a CONTENTS section listing exactly what's inside.
It also contains a USER REPORT section: the note you type into the form, reproduced
verbatim. That note is the one part of the report whose content you author directly.
The rest is app/system info — including which build flavour is running — and a settings snapshot with fifteen content fields always excluded — conversation history, saved sessions, glossary, vocabulary, notes, phrasebook, SRS deck, display names, and more. The snapshot notes only whether each excluded field is set, never its content, and an automated check confirms none of their content can end up in the report. It also contains redacted copies of recent logs.
The app cannot upload the report: there is no upload code. Sending it to support happens only through your own email client if you choose to.
Crashes are logged locally; there is no crash uploader.
Hailsi contains no analytics or telemetry code: none in the UI, none in the processing engine, none in the app shell. This is not just a promise — it is enforced by automated checks: one fails the engine's test suite if Hailsi's own translation-engine code imports any networking library, another freezes the short list of addresses the app's interface may contact, and another ensures the in-app "No analytics, no telemetry" statement stays in the product. The app never phones home about your usage. (The Hugging Face download client's own telemetry is explicitly disabled at engine startup.)
Hailsi records and transcribes your microphone. Two optional features involve other people, and both are off by default:
If transcript saving is on, an in-person partner's speech picked up by your microphone (or by "Translate incoming audio", if you turned that on) is saved on your machine just like your own words. In a Link call, only the text of what you type or say — never the audio — leaves your device, and only after you have confirmed the safety code; your partner's words are not saved to your disk (§2.4).
You are responsible for complying with the recording and wiretap laws that apply to your conversations — in some places every participant must consent to recording or transcription. The app reminds you of this when capture starts. When your microphone turns on, and separately when "Translate incoming audio" starts capturing, the app shows a notice — once per session for each, dismissible — that says what is being captured, how to stop it (the microphone button or Ctrl+M for the microphone; Settings → Audio for incoming audio), and that capturing or translating someone else may require their consent where you live. The notice is a reminder, not legal advice: the app cannot know which law applies to your conversation.
| Party | What they receive |
|---|---|
| Lemon Squeezy (merchant of record) | Your payment and checkout data on their hosted page (their privacy policy governs it). From the app: license key + machine label at activation; key + instance ID at revalidation and deactivation (§2.1). |
| Cloudflare | Operates the Link relay (connection metadata incl. IP addresses, §2.4), TURN relaying of encrypted packets, the update and model-catalog host (your IP, §2.2) and the model-download host (your IP + which packs, §2.3). |
| Hugging Face | Anonymous public-file requests when a pack downloads from the fallback or unmirrored source (§2.3). |
| GitHub (goruut release host) | Anonymous public-file requests when the fast voice tier's pronunciation component downloads (§2.3): your IP address and which file was fetched. |
| MailerLite (website waitlist) | The e-mail address you type into the waitlist form on hailsi.com, which MailerLite stores as our processor under its data-processing addendum; the app itself never contacts MailerLite. |
Nothing in §2 involves providing data to anyone in exchange for money or advertising. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as "sell" and "share" are defined in the California Consumer Privacy Act (as amended by the California Privacy Rights Act).
(The hailsi.com website is separate from the app: it loads Google Fonts, so your browser contacts Google when you visit, and its waitlist form posts to MailerLite (§6).)
Hailsi has no user accounts — no signup, no login, no password. The only purchase identity is a license key. The personal data the product touches, in total:
Hailsi is not directed to children under 16. The EULA requires users to be at least 16 (or the age of digital consent where they live, if higher). The app has no age gate and collects no age information.
Hailsi is sold worldwide, including in the EU and the UK. The facts that bear on data-protection law are as described above: processing of conversation content happens on the user's own device; the app operates no accounts and no server-side store of user content; the narrow network touchpoints are enumerated in §2.
Where we are, and who to contact. Hailsi LLC is established in the United States and has not appointed a representative in the EU or the UK under Article 27: the only personal data the app handles is the license and connection data listed in §2 and §7, it includes no special categories of data, and we assess the processing as unlikely to result in a risk to your rights and freedoms. You can reach us directly at support@hailsi.com, and you keep every right described in this section.
Lawful bases (EU and UK law). We process the small amount of personal data described in §2 on these bases: license activation, re-validation and deactivation (your license key, an instance label containing your Windows computer name, the instance ID, and the purchase e-mail Lemon Squeezy returns to the app) — necessary to perform the license agreement you bought (GDPR Article 6(1)(b)); update and model-catalog checks (your IP address) — our legitimate interest in keeping the software you installed current and safe (Article 6(1)(f)); model, runtime and voice-component downloads (your IP address and the names of the files fetched) — necessary to deliver the language pack you chose (Article 6(1)(b)), and for the later downloads the app starts for your language pair, our legitimate interest in keeping your installation complete (Article 6(1)(f)); Hailsi Link (your IP address and connection metadata at the relay and, when needed, the TURN service) — necessary to provide the connection you ask for when you pair (Article 6(1)(b)); e-mails and diagnostic reports you choose to send us — our legitimate interest in answering you and fixing the product (Article 6(1)(f)); and the e-mail address you type into the website's waitlist form — your consent, which you withdraw by unsubscribing (Article 6(1)(a)). We do not rely on consent for anything the app needs to work, we make no decisions about you by automated means, and we keep support e-mails only as long as the conversation and any follow-up need them.
Your rights. You can ask us to confirm whether we hold personal data about you, to give you a copy, to correct it, or to delete it, and you can complain to the data-protection authority of the EU or UK country where you live. Because the product keeps your content on your own device and we run no servers that store it, the personal data we could ever hold ourselves is limited to e-mails you have sent to support@hailsi.com (including any diagnostic report you attached) and, for the website, a waitlist address. Everything else sits where you can see and delete it yourself: on your machine (§1), with Lemon Squeezy for your purchase (§2.1), and at the Link relay only for the life of a call (§2.4).
International transfers. Hailsi and Lemon Squeezy are in the United States; Cloudflare, Hugging Face and GitHub operate worldwide. Where your data reaches a provider outside the EU or UK, that provider relies on the safeguards named in its own privacy documents — Cloudflare's and MailerLite's data-processing terms name the EU standard contractual clauses and, for the United States, the Data Privacy Framework where the provider is certified.
California. Hailsi is below every threshold of the California Consumer Privacy Act's definition of a "business". The statements in §6 — no sale, no sharing — are true regardless, and we handle requests from California residents the same way as anyone else's (see Data requests below).
Data requests: e-mail support@hailsi.com with the subject "Privacy request" and tell us what you want — a copy of what we hold, a correction, or deletion. We answer within one month of receiving the request (the law lets us extend that by up to two months for a complex request, and we would tell you if so), and we may ask you to confirm you are the person the data is about, usually by replying from the e-mail address the data concerns. What we can act on ourselves: any e-mail or diagnostic report you sent us — we will tell you what we hold and delete it on request — and your website waitlist address, which you can also remove yourself with the unsubscribe link in any waitlist e-mail. What sits elsewhere: your purchase record and receipt are held by Lemon Squeezy as merchant of record — ask them through the "My Orders" link in your receipt or their privacy contact — and your conversations, settings and license record are on your own computer, where §1 explains how to delete them. The Link relay keeps connection bookkeeping only for the life of a call plus about 20 minutes (§2.4); there is nothing there to return.
When this policy changes, we post the new version at https://hailsi.com/privacy with a new effective date.
Hailsi LLC 117 S Lexington St Ste 100 Harrisonville, MO 64701
Governing law and venue: Missouri, USA.