Privacy & Data Control Specification

A fact-based explanation of how HotTea handles your data, network requests, and persistence boundaries.

1. What Data HotTea Stores Locally

HotTea stores all user data in a local SQLite database located within your device's standard application data directory (e.g., ~/Library/Containers/org.hottea.hottea/Data/Documents/hottea.db on sandboxed macOS/iOS, or ~/.local/share/hottea/ on Linux):

Bookmarks: URLs, titles, and categories explicitly bookmarked by you.
Browsing History: Visited URLs, page titles, and timestamps created during regular (non-private) browsing.
Research Notes: Notes and web snippets clipped from webpages, including cited source URLs.
Session State: List of currently open tab URLs to restore your workspace when restarting the application.

Zero Cloud Sync by Default: This data is never synchronized with any remote server unless you configure an external backup mechanism outside HotTea.

2. External Network Communications

HotTea initiates outbound network connections only under direct user instruction:

Direct Web Browsing: When you navigate to a website, your device connects directly to that website's host server over standard HTTP/HTTPS.
Search Engine Queries: When entering search terms into the address bar, HotTea formats a standard query URL for your active provider (Google, DuckDuckGo, Bing, or Brave Search). The query is sent directly to that provider. We do not use intermediary proxy servers.
Optional AI Providers: In future releases, AI interactions will connect directly to the provider endpoint you explicitly configure (e.g., OpenAI, Anthropic, or a local Ollama instance). HotTea will prohibit silent fallback to remote cloud servers.

3. First-Party Telemetry & Tracking

HotTea contains zero first-party telemetry. Specifically:

No user tracking or analytics SDKs (Google Analytics, Mixpanel, Firebase, etc.).
No automatic crash report uploads containing memory dumps or browsing traces.
No advertisement measurement beacons.
No user account registration or mandatory licensing servers.

4. Private Browsing vs. Anonymous Browsing

It is essential to understand what Private Browsing in HotTea does and does not do:

What Private Mode Does:

Private tabs instruct WebKit not to commit disk cache files or persistent cookies. HotTea will not record visits or URLs opened in private tabs to your local browsing history database.

What Private Mode Does Not Do:

Private mode does not anonymize your network traffic. Destination websites, internet service providers (ISPs), and network operators can still observe your IP address, DNS lookups, and TLS server name indications (SNI). For network-level anonymity, use dedicated onion routing tools such as Tor.

5. Current Encryption Status & Roadmap

In the current version (v1.1):

The local SQLite database (hottea.db) is stored unencrypted in plaintext within the application sandbox. It relies on operating system access controls (e.g., FileVault on macOS, iOS Data Protection, or BitLocker on Windows).
Planned .tea Vault: An encrypted container specification is documented in our repository (docs/threat_model_tea.md). Implementation of authenticated encrypted storage (e.g., AES-GCM or XChaCha20-Poly1305 with Argon2id key derivation) is planned for Phase 5 of the project roadmap.

6. Open Source License & Warranty

HotTea is open-source software provided under the Apache License 2.0. As stated in Section 8 of the license, HotTea is provided on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

If you discover a potential privacy or security issue, please contact the maintainers through our responsible disclosure process at GitHub Security Advisories.