How MenuBar for HEY handles your data

MenuBar for HEY is a free, unofficial menu bar companion for HEY on the Mac, made by Soules Studio LTD. This page says what it keeps, what it sends and how to remove all of it.

Last updated 22 September 2026.

Your sign in

Signing in opens hey.com in your browser, and the app never sees your password. The app reads your mail through the official hey command line tool, which ships inside the app and runs as a child process. Your sign in lives in the macOS Keychain and in the tool's own config folder, both managed by the tool. The app never reads them and never stores them anywhere else. The app never asks HEY who you are. It only checks whether you are signed in. The app never talks to app.hey.com itself.

What stays on your Mac

The app keeps a cache of the last Imbox and Screener page it showed, so the popover opens with something rather than nothing. It holds sender names and addresses, subjects and summaries. It is readable by your user only, as a file only you can read inside a folder only you can open, and signing out deletes it. Beside it are your settings and a random install id.

Signing out in the app also signs the bundled hey tool out. That sign in is shared with any other copy of hey on your Mac, so signing out here signs that copy out too.

Nothing about your mail leaves your Mac except the traffic between the tool and HEY, as with any HEY client.

Usage events and crash reports

If usage events are on, and they are on by default, the app sends PostHog in the EU the name of an event and a detail or two about it. These are the only events it sends:

• app launched
• popover opened
• sign in started
• sign in completed
• sign in cancelled
• sign in not completed
• settings opened
• coffee opened
• update check started
• thread moved
• thread marked seen
• notification action used
• sender screened
• read failed
• settings changed

And these are the only facts an event can carry. Every event has the first four. The other six are the details, such as where a thread was moved, which list a failed read was reading and why it failed, or why a sign in did not finish.

• app version
• build
• macOS version
• install id
• destination
• decision
• action
• setting
• source
• reason

The install id is random. The app makes it, it maps to nothing outside the app, and it survives signing out. A crash sends a stack trace with the same facts. Never your mail, your name, your address or your account, and no person profile is ever built. PostHog is set to discard the client IP address, so your address is not stored with the events.

Switch it off under Settings > Privacy. Nothing is sent while it is off.

Diagnostics you copy

Settings > About has a "Copy diagnostics" row. Pressing it puts one plain text report on your clipboard and nothing else happens. Nothing is written to disk, nothing is sent anywhere, and no usage event is recorded. The text leaves your Mac only when you paste it into a message.

This is everything the report holds:

• the app version and build
• your macOS version
• the version of the bundled hey tool
• whether the app is running from a translocated path or a disk image
• whether the bundled tool passed the app's trust check
• the connection state
• whether a session is open, and whether the popover is showing a restored page
• whether the last connect failed
• how the last Imbox read and Screener check ended, and if either failed the kind of failure, printed as one of these six words: decoding, unreachable, rate limited, cli error, process or output too large
• whether the live update stream has reported ready
• whether the Imbox and Screener lists are empty or not, never a count
• the size in bytes of the cached page file
• up to 50 log lines from the current run

The log lines are the app's own value free lines about failures. Each one names the call that failed, the kind of failure, an envelope code, an exit status, and for a decoding failure the coding path and the description of what was refused. That description is written by the package the app reads the tool's answers with rather than by the app, so it can name an unknown kind of posting or a mail account id, but never a subject, a name or an address.

The report never holds a subject, a sender, a name, an address, a token, the install id or the tool's raw output.

Updates

Checking for updates fetches a small feed from toolsforhey.com and the update itself from GitHub. Both see your IP address and the app version, as any download does. No system profile is sent.

What we do not do

We run no server of our own that holds anything of yours. Nothing is sold, shared or used for advertising, and there is no account with us.

Removing everything

Quit the app, delete it from Applications, and delete~/Library/Application Support/com.soulesstudio.toolsforhey.menubar.

Questions

Write to support@soulesstudio.com, or open an issue on the releases repository.