Privacy Policy

Hugo App Ltd  ·  Effective date: 11 October 2026

Hugo is built on a simple principle: your focus data is yours. This policy explains what we collect, why we collect it, and what we do not do with it.

Hugo App Ltd ("Hugo", "we", "us", "our") is the data controller for the purposes of UK GDPR and the Data Protection Act 2018. We are a company incorporated in England and Wales (Company Number: 17036487), with our registered office at 10 Dryden Court, St Neots, PE19 1QY.

If you have any questions about this policy, contact us at nick@tryhugo.app.

1. What Hugo collects and where it lives

Data stored locally on your device

The vast majority of Hugo's data never leaves your Mac. The following is stored in your macOS Application Support directory, in system preferences or in the macOS Keychain on your device only:

• Session history: start time, duration, session type, apps and tabs used, goals, and project name
• Tab justification history: URLs, reasons given, and whether tabs were approved or denied
• Projects: names, allowed apps, allowed URLs, and descriptions
• Weekly review records
• Session blocklist (domains you have chosen to block in Research Mode)
• App preferences: dark/light mode, accent colour, last-used timer duration
• Licence status and trial end date
• A randomly generated device identifier (UUID) used for licence verification
• Your email address, if you have given it to start a trial or subscribe (used to check your trial and subscription status)
• Your consent record for Hugo AI
• Hugo AI trial session count
• Access and refresh tokens for any task or calendar service you connect, stored in the macOS Keychain
• For Notion, your workspace name and the database or page you chose as a source; if you turn on block-start nudges, which Apple calendars they use
• The task and calendar items shown in the session picker, held in memory while Hugo is open and never written to disk

This data is not transmitted to Hugo's servers and is not accessible by us. You can delete it at any time by removing the Hugo app and its Application Support folder from your Mac. Connector tokens are held in the macOS Keychain on your Mac; Hugo's backend holds them only for the moment it takes to hand them to the app (see section 5).

Data transmitted to Hugo's backend

Hugo's backend is hosted on Vercel. It stores none of the content of your sessions, and keeps only the limited records listed under "What Hugo's backend keeps" below. The following is transmitted in specific circumstances:

• On every app launch: your device UUID and email address (if subscribed) are sent to verify your licence status with Stripe. No response data is retained by Hugo.
• When you start a 14-day free trial: your device UUID and the email address you give are sent to start the trial and to send you the trial emails described below.
• When you subscribe: your device UUID, email address, and selected plan are sent to initiate a Stripe Checkout session.
• During Hugo AI sessions only: when you open a new browser tab, Hugo sends your session goal, the new tab's URL and title, a brief page snippet (maximum 300 characters), your currently allowed tab titles, your project name and description if active, minutes elapsed in the session, and the number of tabs blocked so far. This is sent to Google Gemini to make a tab decision. It is not stored by Hugo after the decision is returned.
• When you connect a task or calendar service: the service sends a one-time authorisation code to Hugo's backend, which exchanges it for an access token and hands that token to your copy of Hugo within 60 seconds. The exchange exists so that Hugo's client secrets stay on the server rather than being shipped inside the app. When a token needs renewing, the app sends its refresh token through the backend to renew it. The backend never stores your task or calendar data.
• Goal sharpening and picking one task: when Hugo sharpens a goal, or helps you pick one task from a list, it sends what you typed or said, and the role from your AI profile if you set one, through Hugo's backend to Google Gemini. For an item picked from a connected service it also sends that item's title, any notes Hugo has for it (up to 500 characters), the name of the list or calendar it came from, and its start or due time. If you answer Hugo's one follow-up question, your answer is sent too. Gemini returns a suggested goal that you can undo or edit. When a Hugo AI session starts, your goal and the names of the apps you allowed are sent once, so Hugo can judge how long each app normally stays in front. Our servers store none of it, and none of the text reaches our analytics. Tasks Hugo saves for after this one stay on your Mac and are forgotten after 12 hours.
• Spoken goals: when you speak a goal, Hugo records only while the microphone button is on, for 60 seconds at most, into a private temporary file on your Mac. Hugo reads the recording once and deletes the file before sending it; a cancelled recording is deleted without being sent, and a file left behind by a crash is removed the next time Hugo opens. The recording, with a short list of your own project, list and app names to help with spelling, goes through Hugo's backend to Google Gemini to be turned into text. Hugo tells Google not to keep the recording, and Hugo's backend does not store or log it. The text that comes back is treated exactly like a goal you typed (see "Goal sharpening and picking one task" above). Hugo's analytics record only whether it worked and how many seconds you spoke, never your words.
• Screen reading: screen reading is used in Hugo AI sessions only. It is on by default, needs the macOS Screen Recording permission, and can be switched off in Settings. When Hugo needs to know what you are working on in an app you allowed, for example when you switch to another document in it, or when its window title never changes (such as a desktop AI chat), and in Safari without the Hugo extension when a page gives Hugo nothing to go on, Hugo takes one still picture of that single window and reads the text in it on your Mac with Apple's built-in text recognition. The picture is thrown away straight away: it is never saved, uploaded or sent to anyone. Up to 600 characters of the text, leaving out a sidebar of other conversations where Hugo can find one, go through Hugo's backend to Google Gemini for that one decision, and are not stored or logged. Hugo reads any one window at most once every three minutes and no more than 20 times a session, never reads Hugo's own windows or Chrome, and never runs in Deep Work, Pomodoro, Research or Break Time. macOS may show its screen-recording indicator while a reading is taken.
• When you create a share card: the details shown on the card, which can include a goal you wrote, are stored for 30 days so that the link works, then deleted.

What Hugo's backend keeps

Hugo's backend keeps a small number of records in Upstash, a database service. Apart from share cards you choose to create, none of them contain the content of your sessions, your goals, page or screen text, or your task or calendar data.

• Your trial: the email address you gave, your device UUID, your trial dates and which trial emails have been sent. We keep this record after the trial ends so that a trial cannot be restarted on the same Mac. You can ask us to delete your email address from it at any time.
• Your installation: your device UUID and a public key created by your copy of Hugo, kept for up to a year, so the backend can tell requests from your copy of Hugo apart from anyone else's.
• Your plan: your subscription status, cached for up to a day.
• Limits: counters by device UUID and IP address that stop the service being overused, which expire within a day.
• Connected services: a one-way fingerprint of your refresh token, linked to your installation, for up to 90 days, so that only your copy of Hugo can renew it.
• Share cards you create, for 30 days.
• YouTube channels: the channel of a YouTube video Hugo has looked up, by video, for 7 days. This is not linked to you.

Trial emails

If you start a 14-day free trial, we email you at the address you gave: up to five emails during the trial with tips and reminders, one when it ends, and up to two in the month after. Every one of them except the email telling you that your trial has ended has an unsubscribe link.

Product analytics and crash reports

Hugo sends usage events to PostHog so we can see which features work: for example, that a session started, how long it ran, the plan you are on, and the website domain (never the full address) of a tab Hugo checked. Events are linked to your device UUID and include your app and macOS version, device model, language and time zone, and PostHog may use your IP address to estimate your approximate location. They never include your goals, what you typed or said, page or screen text, or your task and calendar items. If you answer the end-of-trial survey, your answer is recorded, with any email addresses or links removed.

When Hugo crashes or hits an error, it sends a report to Sentry with technical details about the app and your Mac and a record of the app's recent activity, including the web addresses of requests it made. Crash reports are not linked to your device UUID or email address.

2. Third parties we work with

Stripe

We use Stripe to process payments. When you subscribe, your email address and device UUID are shared with Stripe as customer metadata. Your payment card details are entered directly on Stripe's hosted checkout page. Hugo never sees or stores them. Stripe processes payments under its own privacy policy and is PCI-DSS compliant.

Google Gemini

Hugo uses Google Gemini to make tab decisions during Hugo AI sessions, to sharpen goals and to turn spoken goals into text, as described in section 1. When Hugo AI is active and you open a new tab, minimal session context is sent to Gemini per decision. Hugo AI also runs the short session during onboarding. After onboarding, you can avoid it by choosing another mode before you start a session. Google's API data usage policies apply to data sent to Gemini. Hugo does not retain any data after the decision is returned.

Vercel

Hugo's backend functions are hosted on Vercel. Vercel retains ephemeral platform logs for a short period (typically 1 to 7 days) as part of standard platform operation. These logs may contain IP addresses and request metadata.

Upstash

Upstash stores the backend records listed under "What Hugo's backend keeps" in section 1, on our behalf.

Resend

We use Resend to send the trial emails described in section 1. Resend receives your email address and the content of each email.

PostHog

PostHog, hosted in the EU, receives the usage events described in section 1.

Sentry

Sentry, hosted in the EU, receives the crash and error reports described in section 1.

Google API Services

Where you connect Google Calendar or Google Tasks, Hugo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Hugo reads your calendar events and your tasks only to show you the blocks and items you could turn into a focus session. Hugo does not use Google Calendar or Google Tasks data for advertising, does not sell it, and does not allow humans to read it except with your explicit permission, where required for security or to comply with the law.

3. The Hugo Bridge Chrome extension

The Hugo Bridge extension requires the following Chrome permissions to function: tabs, tabGroups, storage, alarms, and activeTab, plus access to the web pages you visit, which it uses only as described here.

During an active Hugo session, the extension reads the URLs and titles of your open tabs to enforce your focus environment. In Hugo AI mode only, for the tab being checked, it reads the page's short description or opening lines (up to 300 characters); on YouTube, the channel and description; on supported AI chat sites, the conversation title and only your latest message and the reply (up to 300 characters each). It adds short extracts from up to five tabs you allowed. Hugo sends these through its backend to Google Gemini for that decision only, and nothing is stored.

The extension does not read page content outside of Hugo AI mode, does not transmit your browsing history, and does not access cookies, passwords, or any account data on websites you visit. It never reads what you are typing: to avoid hiding a tab with an unsent message, it notes only whether you have typed something, and that yes-or-no never leaves Chrome. It communicates with the Hugo app exclusively via a local connection on your own machine and is inactive when no Hugo session is running.

4. Safari integration

Without the Hugo for Safari extension, Hugo controls Safari tabs using macOS AppleScript automation, which requires you to grant Hugo Automation permissions in macOS System Settings. Hugo reads tab URLs and titles and can open, close, or move tabs during a session. In Hugo AI sessions it also reads a page's short description or opening lines (up to 300 characters) for the AI decision. Hugo does not read Safari browsing history or cookie data.

Hugo for Safari is an optional extension that comes inside the Hugo app. It talks only to the Hugo app on your own Mac, over a connection that never leaves your computer, and sends nothing to Hugo's servers or anyone else directly. During a session it tells Hugo which tabs are open (address, title, and whether each is pinned or playing sound) so Hugo can set them aside and put them back; that list is kept on your Mac until they are restored. In Hugo AI, for the tab being checked, it also reads the page's short description or opening lines (up to 300 characters); on YouTube, the channel and description; on supported AI chat sites, the conversation title and only your latest message and the reply (up to 300 characters each). It adds short extracts from up to five tabs you allowed. Hugo sends these through its backend to Google Gemini for that decision only, as it does for Chrome, and nothing is stored. The extension never reads what you are typing: to avoid hiding a tab with an unsent message, it notes only whether you have typed something, and that yes-or-no never leaves Safari.

5. Connected task and calendar services

Hugo can offer you your existing tasks and calendar blocks at the start of a session, so that you pick something you already meant to do rather than facing a blank field. Connecting a service is optional, and Hugo works fully without any connection.

What Hugo connects to

You can connect Todoist, TickTick, Google (Google Calendar and Google Tasks, through one connection) and Notion. Hugo can also read your Apple Calendar and Apple Reminders through macOS itself, using the standard system permission prompts. That route involves no account connection and no data leaving your Mac, except as described under "What leaves your Mac" below.

Read-only, always

Every connection Hugo makes is read-only. Hugo requests read-only permission scopes from each service and never creates, edits, completes, moves or deletes anything in your task manager, your calendar, or your Notion workspace. macOS grants apps full access to Calendar and Reminders, but Hugo only reads them. Hugo is not a task manager and never becomes the system of record for your work.

The specific permissions requested are:

• Todoist: data:read
• TickTick: tasks:read
• Google: https://www.googleapis.com/auth/calendar.readonly and https://www.googleapis.com/auth/tasks.readonly
• Notion: read content only

What Hugo reads

When you open the session launcher, Hugo fetches a short list of your current items so it can show them to you: task titles, due dates, priorities and the name of the list or project they belong to, and calendar events from two hours ago to two days ahead, with their titles, start and end times, calendar name, and the number of other attendees (never who they are). Hugo does not keep task notes or event descriptions. For Notion, Hugo shows the titles of the databases and pages you have shared with it so you can choose one, then reads items only from the one you chose.

These items are held in memory on your Mac while Hugo is open, so that the picker opens instantly. They are never written to disk, sent to Hugo's servers or stored by us.

What leaves your Mac

When you pick an item and start a session from it, Hugo sends that item's title, the name of its list, project or calendar, and its start or due time through Hugo's backend to Google Gemini, to turn it into a concrete goal you can edit (see "Goal sharpening and picking one task" in section 1). The title becomes your session goal, and if Hugo AI is active during the session, that goal is part of the context sent to Gemini for tab decisions, exactly as a goal you had typed would be. When you speak a goal, the names of your lists and calendars are sent to help with spelling.

Nothing else from a connected service is transmitted. Your full task list, your calendar, and your Notion content stay on your Mac.

Block-start nudges

If you turn on block-start nudges, which work with Apple Calendar, Hugo shows a notification on your Mac when a chosen block starts. These notifications are created on your device and held by macOS until they are shown. Hugo only nudges for timed events with no other attendees, on calendars you have picked, so meetings and all-day events never trigger one.

Where the keys are kept

When you connect a service, the service sends a one-time authorisation code to Hugo's backend, which exchanges it for an access token so that Hugo's client secrets are never shipped inside the app. The backend holds the token for at most 60 seconds, until your copy of Hugo collects it, and the app stores it in the macOS Keychain on your Mac. To renew a token, the app sends it through the backend, which keeps only a one-way fingerprint of your refresh token for up to 90 days so that no other copy of Hugo can use it. Hugo's backend stores no task or calendar data.

Disconnecting

You can disconnect any service at any time in Hugo's settings. Disconnecting deletes the stored tokens from your Keychain and clears the items Hugo was holding. It does not withdraw Hugo's access at the provider: to do that, revoke Hugo's access in the provider's own account settings, which invalidates the token immediately. For Apple Calendar and Reminders, disconnecting stops Hugo reading them; you can also remove Hugo's access in macOS System Settings, under Privacy & Security.

6. What Hugo does not collect

Hugo never collects your real name, physical address, phone number, demographic data, precise location, biometric data, health data, or the content of your work such as documents, emails, or messages, apart from the short extracts described in sections 1, 3 and 4, which are used for a single Hugo AI decision and are not stored.

7. Legal bases for processing (UK and EU users)

Where UK GDPR or EU GDPR applies, we process your personal data on the following legal bases:

• Contract performance: processing your email address and device UUID to verify your licence and manage your trial and subscription.
• Legitimate interests: fraud prevention via device UUID, operating the backend to deliver the service, and sending trial tips and reminders to the email address you gave, which you can unsubscribe from at any time.
• Consent: processing session context data via Hugo AI. You may withdraw consent at any time by choosing a mode other than Hugo AI before you start a session, and you can turn screen reading off in Settings between sessions.
• Consent: reading your tasks and calendar events from a service you have connected. You may withdraw consent at any time by disconnecting the service in Hugo's settings, or by revoking access from the provider.

8. Your rights

Depending on where you are located, you may have the right to access, correct, or delete personal data we hold about you, to object to or restrict processing, and to data portability. Because Hugo stores almost all data locally on your device, you can exercise most of these rights directly by managing or deleting app data yourself.

For data held by Stripe, please contact Stripe directly or use the Stripe customer portal. For any other requests, including removing your email address from our trial records, contact us at nick@tryhugo.app.

If you are in the UK, you have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk. If you are in the EU, you may contact your local supervisory authority.

9. California residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, to request deletion of your personal information, and to opt out of the sale of your personal information. Hugo does not sell personal information. To exercise your rights, contact us at nick@tryhugo.app.

10. Data retention

Session data, projects, and all local app data are stored on your device for as long as you use the app. You can delete this data at any time by removing Hugo and its Application Support folder. Hugo's backend keeps only the records listed in section 1, for the periods given there; to have your email address removed from our trial records, contact us.

Tokens for connected task and calendar services are held in your macOS Keychain until you disconnect the service or delete the app. Task and calendar items are held only in memory and are cleared when you disconnect or quit Hugo. Hugo's backend holds no copy of them; the refresh-token fingerprint described in section 1 expires within 90 days.

Stripe retains customer and payment records in accordance with its own retention policy. Vercel retains ephemeral function logs for a short period as part of standard platform operation.

11. Children

Hugo is not directed at children under the age of 13, or under the age of 16 in GDPR jurisdictions. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at nick@tryhugo.app.

12. Changes to this policy

We may update this privacy policy from time to time. If we make material changes, we will notify users via the app or by email where we hold your address. The effective date at the top of this page will always reflect the most recent version.

13. Contact