Privacy
Your taste is yours.
No accounts. No profile on our servers. No ad trackers. Hearth asks Qloo what it needs to answer, keeps everything else on your device, and lets you erase it whenever you like.
Stays on your device
- Your anchors and their tags
- Your origin and destination cities
- Your preferences (vibe, budget, who's coming)
- Your last result
- Share delete-tokens
Stored in your browser (IndexedDB & session storage). Not on our servers.
Leaves only when needed
Anchor queries to Qloo
Only the entity ids and city needed for the search. No name, no account, no email.
Composition prompt (only if an LLM is configured)
The list of already-grounded places, wrapped and marked as untrusted data.
A share card (only when you create one)
Whitelisted place fields, 30-day expiry, deletable by you at any time.
Delete everything
Removes your anchors, preferences and last result from this device immediately. There is no account to delete.
The fine print, honestly
Rate limiting and the daily Qloo budget are enforced using a hashed, short-lived identifier derived from your connection — not a cookie that follows you. It exists to stop abuse and keep the API bill sane.
Share cards are the only thing that outlives your session, and only because you asked for them. They contain whitelisted place fields, expire after 30 days, and are protected by a delete token held on your device.
If a language model is configured, it never receives a free-text description of you — only the grounded list of places to be organised.