How File for HEY handles your data
File for HEY is an unofficial Mac app made by Soules Studio Ltd that saves your HEY attachments to a folder on your Mac. This page says what it keeps, what it sends and how to remove all of it.
Last updated 23 October 2026.
Your mail and your sign in
File for HEY reaches HEY only through the official hey command line tool, which ships inside the app and runs as a child process on your Mac. Signing in opens HEY's own page in your browser, and the app never sees your password. Your sign in lives in the macOS Keychain and in the tool's own config folder, both managed by the tool. The app never reads them and never stores a token.
MenuBar for HEY uses the same sign in, so signing out of either app signs out the other too.
File for HEY only reads from HEY and never changes anything there. Nothing you do in the folder ever reaches HEY. Nothing about your mail leaves your Mac except the traffic between the tool and HEY, as with any HEY client.
What stays on your Mac
The attachments themselves, in the folder you chose. Each file carries its HEY labels as Finder tags, a link to its HEY thread under Where from, and a small hidden record File for HEY reads to recognise its own files: the message and the thread it came from, the file's original name and size, the date of the message, the box it came from and the sender's address. A hidden file at the top of the folder records which HEY account it mirrors, how it is laid out, and random ids for the folder and the Mac that fills it. All of these travel with the folder if you sync it.
In its own folder in your Library, never inside the folder of attachments, the app keeps a list of what it has saved and where, a random install id, and notes that let it clean up a download left half done. Your settings are kept in your Library too. Your trial start and your licence key are kept in the macOS Keychain, with a copy of both in that list, so reinstalling the app does not restart the trial.
Your licence
The app checks your licence key on your Mac and never contacts anyone to do it. You pay on Onelink's checkout, under Onelink's own terms, and we never see your full card number.
The page that shows your key after you pay is the one server of ours involved. It reads that checkout from Stripe, and what Stripe sends back includes your email address and, for a card payment, the card's brand and last four digits. The page uses none of those. It only checks that the purchase is for File for HEY, is paid and has not been refunded, then works out your key, shows it to you and stores nothing. Stripe keeps the only record of the purchase. If you lose your key, support finds your purchase in Stripe and sends you that page again.
Usage events and crash reports
If usage data is on, and it is on by default, the app sends PostHog in the EU the name of an event, to a project of File for HEY's own. These are the only events it sends:
- app launched
- first run step completed
- trial started
- licence entered
- purchase opened
- backfill started
- backfill finished
- layout chosen
- box toggled
- kind toggled
- window chosen
- size limit chosen
- adoption offered
- adoption accepted
- restore run
- refile run
- rate limit paused
- incomplete listing seen
- stop state entered
Every event carries the app version, the macOS version and where your licence stands, which is one of trial not started, in trial, trial ended or licensed. Four events add one detail from a fixed list: which first run step, whether a licence key was valid or why not, which size limit, and which stop state.
Each event is sent under the random install id, with the time it happened. PostHog's own library adds the same few facts to every event: its name and version, the app's name, version, build and bundle id, the macOS name and version, and two markers that are always off, saying the install is not identified and no person profile is made. That is everything an event carries.
An event never carries a file name, a path, a folder, a label, a sender, an account or a count of anything. Counts are left out because they would say how busy your business is. The install id is random, made by the app, and maps to nothing outside it. No person profile is ever built, and PostHog is set to discard the client IP address and not to look up a location.
A crash sends a report with the stack, the crash message and where the app and the system libraries it uses were loaded from, and nothing from your mail.
Switch it off under Settings, General, Privacy, "Send anonymous usage data". Nothing is sent while it is off. If you switch it off while the app runs, a crash later in that run is kept and sent only if you switch it back on.
Updates
Checking for updates fetches a small feed from toolsforhey.com and the update itself from GitHub. Both see your IP address and the app version, as any download does. No system profile is sent.
What we do not do
We keep no copy of your mail or your files, and there is no account with us. Nothing is sold, shared or used for advertising.
Removing everything
Quit the app, delete it from Applications, and delete these five:
~/Library/Application Support/com.soulesstudio.toolsforhey.file~/Library/Preferences/com.soulesstudio.toolsforhey.file.settings.plist~/Library/Preferences/com.soulesstudio.toolsforhey.file.plist, which holds when it last checked for updates, where its windows were and the last folder you picked~/Library/Caches/com.soulesstudio.toolsforhey.file~/Library/HTTPStorages/com.soulesstudio.toolsforhey.file
The trial start and the licence are in Keychain Access undercom.soulesstudio.toolsforhey.file. The folder of attachments is yours, and stays until you delete it.
Questions
Write to support@soulesstudio.com. The terms of sale are on their own page.