Application privacy policy

Last updated: 30 August 2026

This policy explains how Herculean handles personal information through the Herculean application and its supported integrations (the Application). The public herculean.chat website is covered by a separate website privacy policy.

Who is responsible for your information

The Application and the Herculean service are operated by Truly Digital Ltd, trading as Herculean. Truly Digital Ltd is a company registered in England and Wales under company number 09206603, with its registered office at 86–90 Paul Street, London, EC2A 4NE, United Kingdom.

Truly Digital Ltd is the controller responsible for personal information collected through the Application. To ask a privacy question or exercise your rights, reply to an email you receive from Herculean or write to the registered office above, marking your correspondence Data Protection.

Information we collect

Google sign-in information

When you sign in with Google, Herculean receives only the account information needed to identify and authenticate you:

• your name;
• your email address;
• the profile URL supplied by Google; and
• authentication tokens and related technical identifiers used to maintain and verify your sign-in.

Google acts as an identity provider: it confirms that you control the Google account you selected. Herculean does not receive your Google password and can not use this sign-in to access Gmail messages, Google Drive files, contacts, calendars or other content in your Google account.

If a future feature asks for access to additional Google data, that access will be requested and authorised separately.

Workspace content

We collect and store the information you choose to put into Herculean so that the Application can work. This includes projects, tasks, descriptions, labels, priorities, deadlines, completion state, configuration, memories, attachments or links, and other content you submit directly or through a connected AI assistant.

You decide what workspace content to provide. Herculean personnel may be technically able to access this information when necessary to operate, secure, diagnose or support the Application, but it is not routinely read or reviewed for unrelated purposes.

Activity, analytics and logs

We collect limited technical and usage information needed to understand and operate the Application. This may include:

• IP address, browser or client type, device and operating-system information;
• request times, requested endpoints and response status;
• sign-in, tool-use and feature events;
• diagnostic information, errors and security events; and
• approximate usage counts and performance measurements.

These records are used for operations, security, troubleshooting and basic product analytics. Herculean does not create individual behavioural profiles from them.

How we use information

We use personal information to:

• create, authenticate and secure your account;
• store, retrieve, organise and update the workspace content you ask us to manage;
• carry out requests made through supported integrations;
• maintain, troubleshoot and improve the Application;
• detect abuse and protect users, infrastructure and data;
• provide support and communicate important service information; and
• comply with legal obligations and protect legal rights.

Where UK or European data-protection law applies, account and workspace processing is generally necessary to provide the Application you requested or take steps at your request. Security, limited analytics and service improvement rely on Herculean’s legitimate interests in operating and protecting the Application, balanced against your rights.

How information is stored and processed

Herculean currently runs on privately controlled physical infrastructure. Network endpoints and traffic protection are provided through Cloudflare, so Cloudflare processes requests and information that passes through its network before reaching Herculean’s infrastructure.

The physical storage and application infrastructure is accessible only to Herculean’s sole current staff member. No other person has routine physical or network access to those storage devices. This restricted access reduces exposure but does not eliminate security risk.

We use service providers where necessary to operate the Application:

• Google provides account identity and authentication.
• Cloudflare provides network endpoints, routing and security services and therefore processes traffic passing through its systems.
• Connected AI or other third-party providers receive information when you direct Herculean or that provider to exchange information as part of an integration.

Service providers may process information in countries other than your own. Where required, international transfers must use an applicable adequacy decision, contractual safeguards or another lawful transfer mechanism.

We do not sell personal information nor provide any integration with data collation or advertising services.

Sensitive information

Herculean is not designed as a specialist repository for secrets, regulated records or high-risk personal data. Do not enter passwords, private keys, authentication credentials, payment-card data, government identification numbers, medical records or other sensitive or highly confidential information directly into tasks, projects, memories or descriptions.

When work needs to refer to sensitive material, store that material in an appropriately secured specialist service and put only the minimum necessary reference in Herculean.

Even if you submit information that this policy asks you not to store in Herculean, we will continue to handle personal information in accordance with applicable data-protection law.

Sharing and disclosure

In addition to the providers described above, we may disclose information:

• when you direct us to share it through an integration;
• where required by law or a valid legal process;
• where reasonably necessary to investigate abuse or protect a person’s safety, security or legal rights; or
• as part of a merger, acquisition, financing or transfer of the Application, subject to appropriate confidentiality and legal safeguards.

We do not share workspace content with advertisers.

Retention and deletion

Account information and workspace content are retained only while your account remains active and they are needed to provide the Application.

When you delete your account, or when your account expires or lapses, Herculean starts deleting your account information and workspace content immediately. Your projects, tasks, descriptions, memories, labels, settings and other workspace records are removed from the live Application rather than being kept as a dormant or recoverable account. Authentication tokens and active sessions are revoked or deleted as part of the same process. Once deletion begins, your account and workspace content cannot be restored, so export anything you need before deleting or allowing the account to lapse.

Deletion from live systems is intended to happen immediately, although completion across short-lived technical backups, caches and provider systems may take a limited additional period. Residual backup copies are isolated from ordinary use and removed as those backups expire; they are not restored to recreate a deleted account. We may retain only the minimum information required by law or reasonably necessary for fraud prevention, security, dispute resolution or proof that a deletion request was completed.

Operational, analytics and security logs are kept only briefly where they are needed for troubleshooting, security and Application operation. They are not used to reconstruct a deleted workspace, and Herculean does not keep large volumes of logs indefinitely.

Your choices and rights

Depending on where you live, you may have rights to:

• ask whether we hold personal information about you and request a copy;
• correct inaccurate or incomplete information;
• ask us to delete or restrict use of your information;
• object to certain processing;
• receive information you provided in a portable format; and
• withdraw consent at any time without affecting earlier lawful processing.

These rights may be subject to legal limits. To make a request, reply to a Herculean email. We may need to verify your identity before acting.

You may complain to the data-protection authority responsible for your location. In the UK, this is the Information Commissioner’s Office. In the European Economic Area, you may contact your local supervisory authority.

Cookies and local storage

The Application and infrastructure may use storage or cookies that are necessary for authentication, security and session operation. Any non-essential analytics cookies must be separately disclosed and, where required, presented for consent before use.

Children’s privacy

Herculean is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided information, contact us so that we can investigate and remove it where appropriate.

Security

We use reasonable technical and organisational measures intended to protect personal information, including restricted infrastructure access and authenticated service endpoints. No internet-connected system is completely secure, and we cannot guarantee absolute security.

Changes to this policy

We may update this policy as the Application develops or legal requirements change. We will publish the revised policy and update the date above. We will provide additional notice where a change materially affects how existing personal information is used.