Privacy
Heytora reads the window in front of you, at the moment you ask, to answer your question. This policy explains what that means in practice: what it reads, what it keeps, where it goes, and what you can do about it.
These policies describe how Heytora works today. They have not yet been reviewed by a lawyer, and they will be updated before paid plans open. Material changes will always be dated below.
The short version
Heytora looks at your screen and listens only while you hold the shortcut, unless you turn on the optional wake word.
Your journal, memory and agent history are kept on your own PC. Your questions and screen context go to Google's Gemini to be answered, under your own Google API key.
Our servers hold your account, your plan and how much of it you have used. We do not sell your data, show you ads, or track you around the web.
Who we are
Heytora is made and operated from South Africa. Our registered company name, registration number and address will be published here before paid plans open. In these policies, “Heytora”, “we” and “us” mean the company that operates Heytora.
For anything about your personal information, write to privacy@agentora.co.za. We are the “responsible party” under South Africa's Protection of Personal Information Act (POPIA) and the “controller” under the GDPR and UK GDPR.
What Heytora reads
When you hold the shortcut (Ctrl + Win unless you have changed it) and speak, Heytora reads the window you are working in: which app it is, the window's title, and the names of its buttons and fields. It takes a screenshot only when it has to see something those names cannot tell it. It records your voice for as long as you hold the key.
Before anything is read, windows that look like they hold passwords or banking, such as password managers, are masked.
In the default mode, Heytora does not read your screen or open the microphone until you hold the key. There is an optional wake-word mode, off unless you turn it on, in which the microphone stays open so you can say “Tora” or “Hey Tora” instead. In that mode, short clips of speech (about two seconds, and never silence) are sent to Google to check for the word.
What stays on your PC
Heytora keeps its working data on your computer, in the HeyTora folder under %LOCALAPPDATA%: a journal of the questions you asked and the answers you got, facts it has learned about you (such as “prefers metric”), the history of tasks you handed to its agents, the actions you have approved, and logs. Logs are capped at about three megabytes, and API keys and passwords are removed from them automatically.
Lessons you choose to record are saved as video files in your Documents folder, under Tora Lessons. Your settings and API keys are kept in a settings file in the folder Heytora is installed in.
None of this is sent to us, except the agent history if you choose to sync it (see below). You can delete any of it at any time by deleting the files. Uninstalling Heytora does not remove the HeyTora data folder, so that a reinstall keeps your journal; delete the folder yourself if you want everything gone.
Your account
To use Heytora you create an account with your email address and a password. We keep your email address, an optional display name, your plan and its status, and a record of how much you have used each month (for example, how many questions and tasks), so that plan limits can be applied. Your password is stored only as a secure hash by our authentication provider; we never see it.
If you are signed in, Heytora can keep a copy of your agent task history on our servers, so it survives a reinstall and appears on another PC. Only you can read it, and you can delete it.
Payments
Paid plans are sold through Paddle, which acts as the merchant of record: Paddle is the seller of the subscription, handles payment, and deals with sales tax and VAT. Paddle collects your billing details and payment method under its own privacy policy. We receive what we need to run your plan, such as your subscription status, renewal date, and the country for tax. Your card number never reaches us.
Who else is involved
To answer you, Heytora sends your voice, your question and the screen context gathered for it to Google's Gemini models. Today this uses a Google API key you add during setup, so the request goes from your PC to Google under your key and Google's terms. Under those terms, Google may use content sent with a free-tier key to improve its products, and does not for a paid-tier key. Check Google's current Gemini API terms for the detail.
When Heytora searches the web for you, the search goes to DuckDuckGo, or to Tavily if you have added a Tavily key. If you connect another AI service for the background agents, requests for those tasks go to that service under its terms.
We also use service providers who process data on our behalf: Supabase for accounts and the database, Cloudflare for this website, GitHub to deliver the installer, Paddle for payments, and an email provider to send account emails such as password resets. They may only use your data to provide their service to us.
We do not sell your personal information or share it for advertising. Neither is a business we are in.
This website
This site does not use analytics, advertising, or tracking cookies, and you do not need an account to read it. Our hosting provider, Cloudflare, processes your IP address and basic request details to deliver the site and protect it from abuse. The download button takes you to GitHub, which sees your request for the installer.
Why we use it
We process your information to provide the service you signed up for (your account, your plan, answering your questions), for our legitimate interests in keeping Heytora secure, preventing abuse and fixing problems, to meet legal obligations such as tax records, and with your consent where we ask for it, such as the wake-word mode. You can withdraw consent at any time by turning the feature off.
How long we keep it
Account information, usage records and synced agent history are kept for as long as you have an account. When you close your account, we delete them within 30 days, except where the law requires us to keep something longer, such as payment and tax records, which Paddle and we keep for the period the law sets.
Data on your own PC stays until you delete it.
Where it is processed
Heytora runs on your computer, but the services above may process data in other countries, including the United States and the European Union. Where your information is transferred across borders, we rely on safeguards the law recognises, such as the standard contractual clauses our providers offer, as POPIA section 72 and the GDPR require.
Keeping it secure
Data travelling between the app, this site and our servers is encrypted. Access to your account data is restricted so that each user can read only their own records, and only our server can change a plan. Access to production systems is limited to the people who need it. No system is perfectly secure, and if a breach affects your information we will tell you and the regulator as the law requires.
Your rights
Wherever you live, you can ask us what personal information we hold about you, ask for a copy, ask us to correct it, ask us to delete it, and object to how we use it. If you are in the European Union or the United Kingdom, you can also ask us to restrict processing or to give you your data in a portable format. If you are in California, you have the right to know, delete and correct, and the right not to be discriminated against for using them; we do not sell or share personal information.
To use any of these rights, write to privacy@agentora.co.za. We will answer within 30 days. You can also close your account at any time.
If you are not satisfied with our answer, you can complain to the Information Regulator of South Africa, or to the data protection authority where you live.
Children
Heytora is not for children under 13. If you are under 18, or under the age of digital consent where you live if that is higher, you need a parent or guardian's permission to use it, and they should read this policy with you. If you believe a child has given us personal information without that permission, write to us and we will delete it.
Changes to this policy
This policy will change as Heytora does. Material changes will be dated at the bottom of this page, and anyone with an account will be told before the change takes effect.
Contact
Questions about privacy go to privacy@agentora.co.za, and anything else to support@agentora.co.za. We would rather answer them than not.
Last updated 1 October 2026