1. Who this covers
firsthello is a personal cold-email workspace. You sign in with Google and connect a Gmail account. Each Gmail address gets its own separate SQLite workspace on the server. This policy covers people who use the product (you), and the information you put into it about people you email (prospects).
The product is intended for your own outreach from your own Gmail. How you use it with other people's data is also governed by the Terms of Service and by laws that apply to you.
2. What we collect and why
Depending on how you use the product, the server may store:
- Account and sign-in. Your Gmail address; optionally your Google display name and profile photo (if the profile permission is granted); encrypted Google OAuth tokens; a Gmail history cursor and last sync time.
- Session. A signed, HttpOnly cookie named
fh_sessionthat identifies which Gmail workspace this browser may use (about 30 days). - Prospects and outreach content. Names, emails, companies, notes, templates, drafts (including revision history), sent-message metadata, schedules, campaigns, follow-up settings, suppressions (opt-outs / bounces), activity log entries, and research notes you save.
- Replies and bounces. For threads the app started: Gmail message and thread IDs, From/Subject headers, snippets, plain-text bodies (when read permission allows), attachment metadata (filename, type, size). Attachment bytes for replies are fetched from Gmail when you open them and are not copied into the workspace database. After a real send, draft attachment bytes are dropped from the server; downloads then read the copy in Gmail Sent.
- AI labels and drafts. Optional labels and short summaries on replies; AI-written draft replies kept unsent until you send them.
- Agent and research settings. Campaign agent preferences (approval mode, send window, daily limit, research source toggles, opt-out line preference) and follow-up preferences.
- Shared public feeds. Startup Outreach and similar features keep a shared store of public web signals (company pages, funding news, public posts). That feed is the same for every user and is built from public sources, not from your mailbox.
- Browser preferences. Theme and a few UI flags in local storage, only if you accept preference cookies (see Cookies).
We use this information to run the product for you: send and schedule email through your Gmail, detect replies and bounces on threads you started, show your workspace, power optional AI and research features, and email you optional reply digests when that feature is configured.
Hosting: the web app is served by Vercel. The API, background jobs, and all SQLite databases run on a single virtual machine rented from a cloud provider; the provider and region are available on request at hello@updates.firsthello.world. Servers may be located outside your country.
3. Gmail access and permissions
When you connect Gmail, firsthello requests Google OAuth scopes that currently include:
https://www.googleapis.com/auth/gmail.send— send mail from your accounthttps://www.googleapis.com/auth/gmail.readonly— read mail (used for reply text, sync, and attachments on tracked threads)https://www.googleapis.com/auth/userinfo.profile— name and photo for your avatar (optional for core mail features)
The app does not request scopes that modify or delete mail (for example gmail.modify).gmail.readonly can technically read the whole mailbox; the product is built to open messages on conversations it started. Reply HTML is converted to plain text for storage and is not rendered, so remote images in replies are not loaded by the app UI.
OAuth tokens are encrypted with a server key before storage. Disconnect deletes the stored tokens and signs you out; it does not wipe your workspace data (see Deletion).
4. Message tracking
firsthello tracks sends, replies, and bounces for conversations it started. It does not track opens: there are no tracking pixels and no link rewriting in outbound mail.
Reply sync uses Gmail history (and a full thread rescan when the history cursor is missing or expired). Bounce senders such as mailer-daemon / postmaster can auto-suppress an address. You can also mark a prospect as opted out; suppressed addresses are blocked from further sends.
5. AI processing
AI features are optional and only run when the operator has configured provider keys.
- Reply sorting (Groq). Subject and reply text (truncated) may be sent to Groq to produce a label and one-line summary stored in your workspace.
- Assistant / campaign agent (Groq, and optionally Typesafe/Jev). Prompts may include lead details, research notes, draft text, and similar workspace content needed to research, write, or triage. Drafts stay in your workspace until you (or an approved campaign send path) send them.
- Local retrieval (RAG). Embeddings for saved research, notes, replies, and sent text can be computed on the server with a local model (default
BAAI/bge-small-en-v1.5). Vectors are held in server memory for search; this is not a separate cloud LLM call for embedding search itself. - Voice assistant (optional). If enabled, audio/text may be processed by Deepslate and spoken with Cartesia.
Providers process what is sent in each request under their own terms. firsthello does not claim that providers delete prompts on a particular schedule; see each provider's documentation.
6. Third-party services
Depending on server configuration, firsthello may call the services below. Presence in this list means the codebase can use them; an operator may leave some keys empty so those paths stay off.
- Google — sign-in, Gmail API, and incidental web assets (fonts, favicons; WebRTC STUN may use Google's public STUN host)
- Groq — language model API for sorting and writing
- Typesafe (Jev) — optional decision routing for the assistant
- Resend — optional email digests of new replies to your signed-in address (outreach itself still goes through your Gmail)
- Exa, TinyFish, Firecrawl, Apify, Agent Reach — optional web / social research and referral scanning (public results; research is built not to log into your LinkedIn/Reddit/X accounts)
- Fundable and StartupDB — optional startup funding / company data for Startup Outreach
- Upstash Redis — optional shared cache (for example referral scan results)
- Deepslate and Cartesia — optional voice
- Hugging Face — model weights may be downloaded once for local embeddings
No separate data processing agreements are signed with these providers today; each handles data under its own standard terms and privacy policy. Many of them are based in the United States, so data sent to them may be processed outside India and outside your country.
This product does not include third-party product analytics scripts (for example ad or product analytics pixels) in the frontend as shipped. The cookie notice only covers the sign-in cookie and optional preference storage.
7. Cookies and local storage
- Essential:
fh_session— keeps you signed in. Required for the app to work. Rejecting preference cookies does not remove it. - Preferences (optional): theme and a few UI layout flags in local storage, gated by the cookie banner Accept / Reject choice.
8. Storage and retention
Per-user data lives in a SQLite file on the server under the configured data directory (one file per Gmail address). Shared public Startup Outreach data lives in a separate shared database.
The codebase does not define automatic deletion schedules for workspace data, reply text, or activity logs. Data remains until an operator deletes files on the server, or until other deletion tooling is added. In practice, your workspace is kept until you ask for it to be deleted (see Deletion).
Security certifications: none. firsthello does not hold SOC 2, ISO 27001, or similar certifications. Tokens are encrypted at rest in SQLite; that is an application control, not a certification.
9. Disconnect, logout, and deletion
- Sign out clears the browser session cookie. Gmail stays connected on the server, so scheduled sends and reply sync can keep running.
- Disconnect Gmail deletes stored OAuth tokens and signs you out. Prospects, drafts, sent history, and replies for that address remain on the server so reconnecting the same Gmail can restore the workspace.
- Full account / data deletion is not exposed as a self-serve button in the product today. To request deletion of your workspace file(s), email hello@updates.firsthello.world. Send the request from the Gmail address of the workspace (or otherwise prove you own it). We delete that address's workspace file and stored tokens within 30 days and confirm by email. Public Startup Outreach data is not part of your workspace and is not affected.
10. Your rights and contact
Depending on where you live, you may have rights to access, correct, delete, or restrict processing of personal data, or to lodge a complaint with a regulator. firsthello is run from India, so India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 apply; you may complain to the Data Protection Board of India. If you are in the EU or UK, the GDPR may also apply and you may complain to your local data protection authority. Grievance officer: Nirman Patel, at the contact below. We aim to answer requests within 30 days.
Privacy contact: hello@updates.firsthello.world.
Data sharing / sale: the product is built as a private workspace per Gmail address. We do not describe selling your mailbox contents. We do not sell personal information, and we do not share it for cross-context behavioural advertising (as those terms are used in US state laws such as the CCPA/CPRA).
11. Changes
If this policy changes, we will update the “Last updated” date on this page. For material changes, we will also email the Gmail address of each connected workspace before the changes take effect.
Related: Terms of Service.