Hammy eats typos, not secrets. Here's how InkHammy for Mac and iPhone protects your account and your writing, and how to reach us if you find a problem.
You stay in control
- iPhone keyboard: it types and offers on-device spelling without Allow Full Access. AI features only run after you turn on Allow Full Access and sign in. You can turn Full Access off at any time in Settings.
- Mac: InkHammy only reads text after you grant Accessibility permission in System Settings → Privacy & Security → Accessibility. You can turn it off there at any time.
- Secure fields: iOS never gives third-party keyboards access to password and other secure fields, and InkHammy on Mac skips secure text fields. Passwords and credentials are never collected.
How we protect your data
- All traffic between the apps and our services uses HTTPS.
- Your sign-in session is stored in the Keychain on iPhone and Mac. On our side, session credentials are stored hashed.
- AI provider credentials stay on our servers. No API keys live in the apps.
- Submitted text is processed in memory and is not stored by the correction service. Server logs exclude submitted text and redact authorization headers.
- Correction ranges are validated before any change is applied to your text.
- Diagnostic logs stay on the device until they are uploaded, once a day over HTTPS, through short-lived signed upload links, to our Cloudflare R2 storage and our own GlitchTip service. They never include passwords, secure fields or credentials, and uploaded diagnostic logs are kept indefinitely.
- Payments are handled by Apple (iPhone and the Mac App Store edition) and Stripe (the Mac download). We never see your full card number.
Report a vulnerability
Found a security issue? Email our security team with steps to reproduce and the impact you observed. Please don't include real credentials or other people's private text, and give us a reasonable chance to fix the issue before sharing it publicly. We'll get back to you as quickly as we can.
For how we handle data in general, see our Privacy Policy.