Horatio

Privacy Policy

Effective 13 August 2026

Horatio is an ambient AI watcher for macOS, made by Todd Gilbert (an individual, not a company). It is a signed and notarized desktop app — not a web app, not a mobile app, and not a browser extension. You describe what to watch in plain language — “when someone replies to this email”, “when someone comments on foo/bar#12”, “watch this pricing page” — and Horatio connects to the right source, watches quietly, and surfaces an AI-written summary in its own timeline.

This policy describes how Horatio handles information, including information obtained from Google APIs when you connect Gmail.

There is no Horatio server

Horatio does not create an account, does not sync your data to a Horatio backend, and does not run analytics or telemetry that carry message content. There is no Horatio-operated server that stores anything you watch. The only network traffic is between your Mac and the services you connected — Gmail, Slack, GitHub, or a web page you named. Watched content is not sent to a Horatio server or to any model provider.

Sources Horatio can watch

Each source is opt-in. Horatio only talks to a service after you connect it, and only for watches you wrote.

• Gmail. OAuth. Horatio reads incoming mail to match watches you wrote. Details below; this is the only source that uses Google APIs.
• Slack. Tokens you create for a Slack app you install. Horatio reads messages in channels you invite it to.
• GitHub. A personal access token you paste. Horatio reads notifications, issue and pull-request comments, and repository activity you asked it to watch.
• A web page. No login. Horatio fetches a URL you named and notices when its readable content changes.
• Claude Code. Local to your Mac. Horatio watches Claude Code sessions on this computer (permission prompts, idle dialogs, agent completion). Nothing is sent to Anthropic by Horatio.

What Horatio accesses from Gmail

If you connect Gmail, Horatio asks Google for one OAuth scope: https://mail.google.com/. Nothing else. That scope is what Gmail’s IMAP transport requires. With it, Horatio can:

• notice new mail as it arrives (IMAP IDLE), rather than polling
• read message metadata (sender, subject, date, labels) and message content
• decide whether a message matches a watch you wrote, and write a short summary of the ones that do

Horatio reads incoming mail in order to evaluate your watches. It does not send mail, delete mail, or change anything in your mailbox. A summary only appears in the timeline when a message matches criteria you wrote.

Where Google user data goes

Nowhere off this Mac. Horatio evaluates watched events with a language model running on your own machine, through Ollama. Google user data never leaves the device. It is not sent to Horatio, and it is not sent to any third party. The same is true of Slack, GitHub, and web-page watches. Claude Code events are already on this Mac.

Horatio’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not retained or used to develop, improve, or train generalised AI or ML models.

What Horatio does not do

Horatio does not sell Google user data, or transfer it to advertisers, data brokers, or resellers. It is not used for advertising. It is not shared with anyone.

What stays on this Mac

Everything the app stores is a file in ~/Library/Application Support/Horatio:

• watches.json — the watches you created, in your own words
• events.jsonl — the timeline: title, summary, and reason for each surfaced hit
• cursors.json — sync positions and app settings
• seen.json — deduplication state
• secrets.json — OAuth refresh tokens and API keys, encrypted via the macOS Keychain (Electron safeStorage)

Deleting the app removes that directory and the tokens on this machine.

How to revoke access

Disconnect a source inside Horatio. For Gmail, you can also revoke access at myaccount.google.com/permissions. Revoking at Google immediately stops Horatio from reading the mailbox, even if the app is still installed. Slack and GitHub tokens can be revoked in those products the same way.

This website

horatio.studio is a marketing site for the Mac app, not the app itself. If you join the waitlist, the email address you type is stored so we can tell you when the app is ready. That address is not Google user data, and it is not used to train models.

Terms

Use of Horatio is also covered by the Terms of Service.

Contact

Todd Gilbert. Questions about this policy: hello@horatio.studio. tgdesign.dev.

Back to Horatio