Trust
How Hi, Moose keeps your data on your device, what reaches our servers, and who to contact about security.
Hi, Moose stores data in three places. Most of it never leaves your computer.
On your device
- Site crawl text
- Drafts and briefs in the local Library
- Visibility history
- Local model prompts
- Credentials
In your Hi, Moose account
- Account details
- Project names and settings
- Team membership
- Scheduled visibility runs
- Saved items you chose to share with your team
- Hosted audio
Sent to model providers
The prompt and content needed for the task you asked for, and nothing else.
How each plan sends itHi, Moose MCP lets Claude, ChatGPT and other MCP clients use Hi, Moose tools with your account.
How a connection works
- 1Consent pageShows the app asking for access, the account it will use, and the full tool list.
- 2Sign-inYou sign in on console.himoose.com.
- 3One scopeThe app receives a single scope covering the listed tools.
- 4Revoke any timeTokens can be revoked from Settings in the app.
What the server can do
- CreateBriefs, drafts and other content, saved to your Library.
- CheckVisibility and site checks for your projects.
- ListenAudio versions of your articles.
What the server cannot do
- Read files on your computer
- Publish to your site
- Change settings or team members
- Delete anything
- Act without a signed-in host app
Tool manifest
A public, versioned list of every tool with a checksum, so your security team can pin the version it reviewed.
Outside text is marked
Text from outside sources in tool results is marked so an agent can tell data from instructions. Markers are a safeguard, not immunity.
Read the MCP security guideWhere your content goes depends on how the model runs.
Managed plans
Hi, Moose sends the content for the task to the model providers listed in Service providers, under our agreements. Managed-plan requests require zero-data-retention providers, and no provider trains on your content. Free preview models are the exception: they may run on providers without a zero-retention commitment.
Bring your own key
The content goes straight from your device to your provider, under your agreement with them.
Local model
Nothing leaves your device.
Search and page research
Services that fetch search results and public pages receive only the query or the public page address. They never receive your account details, content or results.
- Encryption in transit and at rest on hosted services.
- Credentials are encrypted with the macOS Keychain or Windows data protection before they touch disk.
- Every hosted request is checked against the signed-in user and their project membership.
- Sensitive settings are owner-only. Removing a team member never deletes company data.
- Sign-in attempts on the MCP server are rate limited.
- Desktop updates are verified against a published checksum before they install. macOS builds are signed and notarized.
- Account deletion
- Ask us at [email protected] to delete your account. Account details, projects, team membership and hosted audio are removed, and hosted data is generally deleted or anonymized within 90 days.
- MCP jobs and images
- MCP job records are removed automatically within a day of the job expiring. Generated images are deleted after 7 days.
- Cancelled subscription
- Cancelling keeps your account and hosted data so you can come back. Deletion is on request, as above.
- Local data
- Local data is yours. It stays on your device until you delete it.
This list covers providers that process personal data on our behalf. We update it before adding a provider, and DPA customers are notified.
Good-faith research
We will not take action against researchers who report responsibly and avoid customer data.
- Trust page published.