Privacy Policy

This is a non-binding English translation provided for convenience. The legally binding version is the German original.

Last updated: October 2026

1. Controller

Joel Schneider & Paul Yurian Kreft
Heym GbR (civil-law partnership)
Maybachstraße 22
50670 Köln, Germany
Email: privacy@heym.app

2. Privacy contact

Questions about data protection, and requests for access, rectification or erasure, go to privacy@heym.app. We answer within the statutory deadlines.

3. Overview of processing

As part of our service we process the following categories of personal data:

• Account data — name, email address, profile image, time zone
• Content data — tasks, goals, habits, life areas, labels, pomodoro sessions, favorites, settings
• Calendar data (optional) — events from your Google Calendar, if you connect it (see section 18)
• Payment data — billing information, payment history (via Stripe)
• Usage data — access timestamps, device and browser information
• Technical data — IP addresses, error messages, request metadata

4. Applicable legal bases

We process personal data on the following GDPR legal bases:

• Consent (Art. 6 (1) (a) GDPR) — the data subject has consented to processing for a specific purpose (e.g. web analytics).
• Performance of a contract (Art. 6 (1) (b) GDPR) — processing is necessary to perform the user agreement.
• Legitimate interests (Art. 6 (1) (f) GDPR)— processing is necessary to safeguard our legitimate interests, provided the data subject's interests do not prevail.

5. Registration and user account

During registration we collect the following data:

• Email address
• Name (where transmitted by the identity provider)
• Profile image (where transmitted by the identity provider)
• Time zone

Depending on the chosen sign-in method, some of these fields may be unavailable. When signing in with Apple Sign-In, the user may hide their name and use an Apple-generated relay address instead of their actual email. In that case we process only the pseudonyms supplied to us.

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract). Registration is a prerequisite for using our service.

6. Authentication

We offer several sign-in methods: external identity providers (Google, Apple) and email-based sign-in (magic link). Data is only transmitted once you actively select the relevant method.

6.1 Email authentication (magic link)

When signing in via magic link you enter your email address and receive a one-time sign-in link by email. Your email address is transmitted to our authentication provider Supabase (see section 9.1) for this purpose. The email is delivered via the service Resend (see section 9.4).

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

6.2 Google OAuth

When signing in via Google, your name, email address and profile image are transmitted from your Google account.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

Transfer to third countries: Google is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023).

Google's privacy policy: https://policies.google.com/privacy

6.3 Apple Sign-In

When signing in via Apple, your name and email address are transmitted from your Apple account. Apple lets you hide your email address (Private Relay); in that case an Apple-generated forwarding address is transmitted.

Provider: Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

Transfer to third countries: Apple is certified under the EU-U.S. Data Privacy Framework.

Apple's privacy policy: https://www.apple.com/legal/privacy/

7. Usage data (your content)

As part of using our service we process and store the content you create:

• Tasks (title, description, due dates, priorities, completion status)
• Goals (title, description, measurements, progress values)
• Habits (title, frequency, target values, daily completions, notes)
• Life areas (name, vision text)
• Labels and categorizations
• Pomodoro sessions (duration, type, status)
• Files you upload (e.g. profile pictures and images in descriptions, notes and life areas)
• Personal settings and preferences

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract). Storing this data is the core purpose of our service.

8. Payment processing (Stripe)

We use the payment provider Stripe for paid subscriptions. Credit card data is processed directly by Stripe and is never stored on our servers.

Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland

Data processed: name, email address, billing address, payment information, transaction history

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

Transfer to third countries: Stripe is certified under the EU-U.S. Data Privacy Framework and additionally relies on EU standard contractual clauses (SCCs).

Stripe's privacy policy: https://stripe.com/privacy

9. Hosting and infrastructure

9.1 Database and authentication (Supabase)

Our database and authentication are hosted by Supabase. All user data is stored in a PostgreSQL database and in Supabase file storage in the EU.

Provider: Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 (contracting party; affiliate of Supabase, Inc., USA)

Server location: EU (Paris, France; AWS eu-west-3)

Data processed: all data listed in sections 5–7

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

Transfer to third countries: Data is stored in the EU. Because Supabase is headquartered outside the EEA, we rely on EU standard contractual clauses (SCCs) pursuant to Art. 46 GDPR.

9.2 Application hosting (Vercel)

Our web application is hosted on the Vercel platform. All HTTP requests to our service are processed by Vercel infrastructure.

Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA

Server location:Requests first reach the nearest location of Vercel's global network, where they are checked (e.g. for a valid sign-in) and forwarded. The servers that run our web application are located in the EU (Paris, France).

Data processed: IP addresses, HTTP request metadata (URL, headers, method), server logs

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in reliable, performant hosting).

Transfer to third countries: Vercel is certified under the EU-U.S. Data Privacy Framework and additionally relies on EU standard contractual clauses (SCCs).

9.3 DNS and network protection (Cloudflare)

We use Cloudflare for DNS resolution, DDoS protection and edge routing. All traffic to our service is routed through Cloudflare infrastructure.

Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA

Data processed: IP addresses, HTTP request metadata, TLS connection information

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in security, availability and performant delivery of our service).

Transfer to third countries: Cloudflare is certified under the EU-U.S. Data Privacy Framework and additionally relies on EU standard contractual clauses (SCCs).

9.4 Email delivery (Resend)

For authentication emails (magic links, email confirmations) we use Resend as our SMTP provider.

Provider: Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA

Data processed: recipient email address, send timestamp, delivery status

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

Transfer to third countries: Resend is based in the United States. We rely on EU standard contractual clauses (SCCs).

10. Error monitoring (Sentry)

To ensure stability and to fix bugs we use the service Sentry. Technical information is collected automatically when an error occurs.

We additionally use Sentry Session Replay to help us reproduce errors. User interactions (clicks, navigation, input fields) are captured as technical recordings. Session replays are collected for 10 % of all sessions and for 100 % of sessions in which an error occurs. Input fields flagged as sensitive (in particular password fields) are automatically masked before transmission to Sentry.

Objection: You can object to session-replay recording at any time by emailing privacy@heym.app. After we confirm your objection, no further session replays will be recorded for your account.

Provider: Functional Software, Inc. (Sentry), 1501 Mariposa St #408, San Francisco, CA 94107, USA

Data processed: error messages, device information, browser type, timestamps, IP addresses, session recordings (clicks, navigation, DOM interactions)

Server location: EU (Germany)

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the stability and debuggability of our service).

Transfer to third countries: Sentry is certified under the EU-U.S. Data Privacy Framework. Data is stored in the EU region (Germany).

11. Rate limiting and security (Upstash)

To protect against abuse and to ensure service availability we use rate limiting.

Provider: Upstash, Inc., San Francisco, CA, USA

Data processed: IP addresses, request metadata (timestamp, frequency)

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in security and abuse prevention).

Retention: data is retained only briefly (a few hours) and is then automatically deleted.

12. Web analytics (PostHog)

We use the analytics service PostHog to understand and improve usage of our website. PostHog is only activated after your explicit consent. As long as you have not granted consent, no data is collected.

Provider: PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA

Server location: EU (Frankfurt, Germany; PostHog Cloud EU instance)

Data processed: page views, interactions, device information, IP address (anonymized where applicable)

Legal basis: Art. 6 (1) (a) GDPR (consent). Cookies and comparable storage mechanisms are set only after your active consent in accordance with § 25 (1) TDDDG.

Withdrawal of consent: You can withdraw your consent at any time with effect for the future by changing your consent settings or by contacting us at privacy@heym.app.

13. Content management (marketing website)

Our marketing website uses Sanity CMS to deliver editorial content (blog, glossary, releases).

Provider: Sanity AS, Oslo, Norway (EEA)

Data processed: when content is retrieved via the Sanity CDN, your IP address may be processed.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in delivering our website content).

Transfer to third countries: Sanity is based in Norway (EEA). No transfer to third countries takes place.

14. Fonts

We use fonts that are hosted locally on our servers (self-hosted via next/font). No data is transmitted to external providers (e.g. Google) when fonts are loaded.

15. Content delivery network (jsDelivr)

For our API documentation we load a JavaScript library via the public CDN jsDelivr. When the API documentation page is loaded, your browser connects to jsDelivr's servers.

Provider: Prospect One Sp. z o.o., Kraków, Poland (EEA)

Data processed: IP address, browser information, timestamp

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in providing functional API documentation).

Transfer to third countries: jsDelivr is operated by a Polish company (EEA). The CDN uses globally distributed servers; as a result your IP address may be transferred to servers outside the EEA when content is delivered.

16. Cookies and local storage

Strictly necessary cookies

We set an authentication cookie to manage your session. This cookie is strictly necessary and is set once you sign in.

Local storage

We use the browser's local storage for your appearance settings (e.g. light or dark theme). This data does not leave your browser and is not transmitted to our servers.

Analytics cookies

Where PostHog is enabled, analytics cookies may be used. These are set only after your explicit consent in accordance with § 25 (1) TDDDG. Without your consent, no tracking takes place.

17. API access for third-party applications

As part of paid subscriptions we offer an API. When the API is used, we additionally process:

• API keys (name, permission scope, creation date)
• Usage logs (HTTP method, path, status code, response time)

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

18. Google Calendar integration

You can optionally connect your Google account to show your Google Calendar events in the Heym calendar. This is separate from signing in with Google (section 6.2): it only happens when you connect Google Calendar in the settings and grant access on Google's consent screen.

Access requested: read-only access to your calendar list and your events (Google scopes calendar.calendarlist.readonly and calendar.events.readonly), plus the email address of your Google account (scopes openid and email) so the settings can show which account is connected. Heym also asks for permission to create and change events on calendars you own (Google scope calendar.events.owned, see “Editing” below).

Editing: Heym asks for the editing permission when you connect, on the same Google consent screen. You can untick it there and grant it later with “Allow editing” in the settings. Without it, Heym cannot create, change or delete anything in your Google Calendar. With it, Heym changes an event only when you do so in Heym: moving or resizing it, renaming it, changing its details (such as description, location, guests, video call, repeat rule, notifications or whether it shows you as busy), moving it to another calendar you own, or deleting it. Heym creates an event in your Google Calendar only when you create one there from Heym, with the title, time and calendar you chose. If an event has guests, Heym asks you first whether Google Calendar should email them about the change; a deletion always notifies them, as Heym tells you before you confirm.

Data we process:

• The email address of the connected Google account
• The list of your calendars (name, color, your access level such as owner or reader, and whether it is your main calendar) and which of them you selected for display
• Events in the time range you are viewing: title, start and end time, time zone, whether the event lasts all day, its type (a normal event or one Google manages, such as a birthday or focus time), whether you organize it, whether its guests may change it, whether it belongs to a repeating series, a version marker that prevents overwriting newer changes, and how many guests it has. To count guests here we only read whether each guest entry is you and whether that guest has replied.
• The event you open in Heym, and only that one: its description, location, whether it shows you as busy or free, its guests (names, email addresses, who organizes it and each guest's reply: accepted, declined, maybe or none yet), its video call link and provider, its repeat rule, and your notifications for it (whether your calendar's default notifications apply, otherwise each one's kind, pop-up or email, and how long before the event it comes). Heym reads these when you open the event, shows them to you and sends your changes to Google. They are not stored on Heym's servers, not written to logs, and not kept in your browser's offline cache. When you add or remove a guest, Heym reads the event's full guest list from Google once more (including a guest's note or whether they are optional), only to send it back unchanged together with your change, because Google replaces the whole list on every change. Heym never requests event attachments.
• The permissions you granted on Google's consent screen, so Heym knows whether it may offer editing
• A refresh token, stored encrypted. Short-lived access tokens (valid for at most one hour) are only kept in server memory.

Purpose:exclusively to display your events in the Heym calendar, to show an event's details when you open it, to make the changes you make to them in Heym and create the events you create there (if you allowed editing).

Protection: all data exchanged with Google and with your browser travels encrypted over TLS (HTTPS). The refresh token is stored encrypted at rest (AES-256-GCM) and only decrypted on our servers to obtain an access token. Access tokens are never written to the database or to logs; they are kept only in server memory and expire after at most one hour. Heym uses a connection only for requests made by the Heym account it belongs to.

Retention: event data is never stored on our servers or saved to your device; your browser holds it in memory only while the calendar is open. The connection (encrypted refresh token, connected email address, calendar list and selection, granted permissions) is kept until you disconnect Google Calendar, which deletes it immediately, or until your account is permanently deleted, which deletes it together with your account.

Limited Use:Heym's use and transfer to any other app of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google Calendar data only to provide the features described above, which are visible to you in Heym.
• We do not sell Google Calendar data and do not use it for advertising, including personalized, retargeted or interest-based advertising.
• We do not transfer Google Calendar data to third parties, except to the processors needed to run this feature (section 9), to comply with applicable law, or to protect against abuse.
• No person reads your Google Calendar data unless you explicitly ask us to (for example for support), it is necessary for security purposes such as investigating abuse, or we are required to by law.
• We do not use Google Calendar data to develop, improve or train generalized artificial intelligence or machine learning models.

Disconnecting:you can disconnect Google Calendar in the settings at any time. We then immediately delete the stored tokens, the connected email address, your calendar list and selection and the granted permissions, and ask Google to revoke Heym's access. You can also revoke Heym's access in your Google account:https://myaccount.google.com/permissions

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

Transfer to third countries: Google is certified under the EU-U.S. Data Privacy Framework.

19. Data processing agreements

We have concluded data processing agreements (DPAs) pursuant to Art. 28 GDPR with every processor named in this privacy policy who processes personal data on our behalf. These agreements ensure that our processors only process personal data on our instructions and that they implement appropriate technical and organizational measures to protect your data.

20. International data transfers

Some of our processors are based outside the EEA. We safeguard your data through the following measures:

21. Retention periods and deletion

• Account data: until you delete your account
• Content data (tasks, goals, etc.): until deleted by you or upon account closure
• Deleted content (trash): 30 days after deletion, then permanently removed
• Payment data: 10 years pursuant to German commercial and tax retention obligations (§ 147 AO, § 257 HGB)
• Error logs (Sentry): 90 days
• Rate-limit data (Upstash): a few hours
• Analytics data (PostHog): anonymized after 24 months
• Google Calendar connection (tokens, calendar selection): until you disconnect Google Calendar or close your account
• Google Calendar events:never stored on our servers; held in your browser's memory only while the calendar is open and discarded within a few minutes of leaving it

22. Your rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR): you may request information about the personal data we process.
• Rectification (Art. 16 GDPR): you may request correction of inaccurate data.
• Erasure (Art. 17 GDPR): you may request deletion of your data, subject to statutory retention obligations.
• Restriction (Art. 18 GDPR): you may request restriction of processing.
• Data portability (Art. 20 GDPR): you may receive your data in a structured, commonly used and machine-readable format.
• Objection (Art. 21 GDPR): you may object at any time to processing based on Art. 6 (1) (f) GDPR.
• Withdrawal of consent (Art. 7 (3) GDPR): any consent granted may be withdrawn at any time with effect for the future.

To exercise your rights, please contact: privacy@heym.app

23. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Competent is the supervisory authority of the German federal state in which we are based, or the authority at your place of residence or the place of the alleged infringement.

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44, 40102 Düsseldorf
Kavalleriestraße 2–4, 40213 Düsseldorf
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de

24. Automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

25. Changes to this privacy policy

We reserve the right to adapt this privacy policy to reflect changes in applicable law or in our service or data processing. The current version is always available on this page. For material changes we will notify you separately.