Privacy and your data

Heym is run by Heym GbR in Cologne, Germany, and stores your data in the EU. This page summarizes what the privacy policy says about your data and what you can do with it in the app. The privacy policy is the binding text: its German original applies, and the English version is a translation.

​

What Heym stores and why

When you sign in with Google or Apple, Heym receives your name and email from them (and your photo from Google). With Apple you can hide your email, and Heym then only gets Apple’s forwarding address. Card details go straight to Stripe and are never stored on Heym’s servers.

​

Where your data is stored

• Your account and content: in a database and file storage run by Supabase in the EU (Paris, France).
• The web app: on Vercel, whose servers for Heym are in the EU (Paris, France). Requests pass through the nearest location of Vercel’s and Cloudflare’s networks first.
• Error reports: at Sentry, in the EU (Germany).
• Payments: at Stripe, in the EU.
• Emails (sign-in links and codes, sharing invitations, task assignments and account deletion notices): sent through Resend, in the USA.

Some of these providers are US companies. The privacy policy lists each one and the safeguard used, such as the EU-U.S. Data Privacy Framework or the EU’s standard contractual clauses. Heym has a data processing agreement with every provider that handles personal data for it.

​

Who can see your data

• You. Your content is in your account, behind your sign-in. To add a second step to signing in, turn on two-factor authentication.
• People you share with. When you share a life area, goal or project, the people you invite see it and what’s in it, except your habits, which are never shared. They also see your name, email address and photo. See Share with others.
• The services that run Heym, like Supabase, Vercel and Stripe, process data on Heym’s behalf under data processing agreements.

When something goes wrong in the app, Sentry records technical details about the error. For 10% of sessions, and every session with an error, it also records a replay of clicks and navigation, with sensitive text you type masked. To opt out of replays, write to privacy@heym.app. On a shared computer, log out when you’re done. Heym keeps a copy of your lists in the browser so pages open quickly, and clears it when you log out.

​

Get a copy of your data

Heym has no export button. To get a copy of your data, write to privacy@heym.app. Under the GDPR you have the right to receive your data in a structured, commonly used, machine-readable format.

​

Delete your data

• Single items: delete them in the app. Deleted tasks and notes go to Trash first. See Undo and Trash.
• Your whole account: in Settings → Account, use Delete account… under Danger zone. After a 30-day wait, your account and all its data are erased, in line with the privacy policy. Payment records are the exception: German commercial and tax law requires keeping them for 10 years. See Delete your account.

Canceling Pro doesn’t delete anything: your account moves to the Free plan and your data stays yours.

​

Your rights

Under the GDPR you can ask Heym for access to your data, to correct it, to delete it, to restrict how it’s used, and to receive a copy. You can also object to processing based on legitimate interests and withdraw any consent you gave. Write to privacy@heym.app. You can also complain to a data protection authority: the one for North Rhine-Westphalia, where Heym is based, or the one where you live. The privacy policy has the contact details.

​

Cookies and browser storage

• Heym only sets cookies the app needs to work: one keeps you signed in, and a few small ones remember your language, the page Heym opens first, the last page you had open and whether you’ve finished setting up Heym.
• Your theme and some display choices, like how a list is laid out, are saved in your browser.

​

Related