> ## Documentation Index
> Fetch the complete documentation index at: /help/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy and your data

> What Heym stores about you and why, where it's stored, who can see it, how to get a copy or delete it, and how to use your privacy rights under the GDPR.

Heym is run by Heym GbR in Cologne, Germany, and stores your data in the EU. This page summarizes what the [privacy policy](https://heym.app/privacy-policy) says about your data and what you can do with it in the app. The privacy policy is the binding text: its German original applies, and the English version is a translation.

## What Heym stores and why

| Data | What it is | Why |
| - | - | - |
| Account | Your email address, name, photo and time zone | To give you an account and sign you in |
| Your content | Everything you create: tasks, projects, goals, habits, notes, life areas, labels, Pomodoro sessions, the files you upload and your settings | Storing it is what Heym is for |
| Payments | Billing details and payment history, held by Stripe | To bill your Pro subscription |
| Usage and technical data | Access times, device and browser, IP addresses, error messages | To run Heym reliably, keep it secure, and fix bugs |

When you sign in with Google or Apple, Heym receives your name and email from them (and your photo from Google). With Apple you can hide your email, and Heym then only gets Apple's forwarding address.

Card details go straight to Stripe and are never stored on Heym's servers.

## Where your data is stored

* **Your account and content:** in a database and file storage run by Supabase in the EU (Paris, France).
* **The web app:** on Vercel, whose servers for Heym are in the EU (Paris, France). Requests pass through the nearest location of Vercel's and Cloudflare's networks first.
* **Error reports:** at Sentry, in the EU (Germany).
* **Payments:** at Stripe, in the EU.
* **Emails** (sign-in links and codes, sharing invitations, task assignments and account deletion notices): sent through Resend, in the USA.

Some of these providers are US companies. The privacy policy lists each one and the safeguard used, such as the EU-U.S. Data Privacy Framework or the EU's standard contractual clauses. Heym has a data processing agreement with every provider that handles personal data for it.

## Who can see your data

* **You.** Your content is in your account, behind your sign-in. To add a second step to signing in, turn on [two-factor authentication](/help/your-account.md#turn-on-two-factor-authentication).
* **People you share with.** When you share a life area, goal or project, the people you invite see it and what's in it, except your habits, which are never shared. They also see your name, email address and photo. See [Share with others](/help/sharing.md).
* **The services that run Heym**, like Supabase, Vercel and Stripe, process data on Heym's behalf under data processing agreements.

When something goes wrong in the app, Sentry records technical details about the error. For 10% of sessions, and every session with an error, it also records a replay of clicks and navigation, with sensitive text you type masked. To opt out of replays, write to [privacy@heym.app](mailto:privacy@heym.app).

On a shared computer, log out when you're done. Heym keeps a copy of your lists in the browser so pages open quickly, and clears it when you log out.

## Get a copy of your data

Heym has no export button. To get a copy of your data, write to [privacy@heym.app](mailto:privacy@heym.app). Under the GDPR you have the right to receive your data in a structured, commonly used, machine-readable format.

## Delete your data

* **Single items:** delete them in the app. Deleted tasks and notes go to Trash first. See [Undo and Trash](/help/undo-and-trash.md).
* **Your whole account:** in **Settings** → **Account**, use **Delete account…** under **Danger zone**. After a 30-day wait, your account and all its data are erased, in line with the privacy policy. Payment records are the exception: German commercial and tax law requires keeping them for 10 years. See [Delete your account](/help/your-account.md#delete-your-account).

Canceling Pro doesn't delete anything: your account moves to the Free plan and your data stays yours.

## Your rights

Under the GDPR you can ask Heym for access to your data, to correct it, to delete it, to restrict how it's used, and to receive a copy. You can also object to processing based on legitimate interests and withdraw any consent you gave. Write to [privacy@heym.app](mailto:privacy@heym.app).

You can also complain to a data protection authority: the one for North Rhine-Westphalia, where Heym is based, or the one where you live. The privacy policy has the contact details.

## Cookies and browser storage

* Heym only sets cookies the app needs to work: one keeps you signed in, and a few small ones remember your language, the page Heym opens first, the last page you had open and whether you've finished setting up Heym.
* Your theme and some display choices, like how a list is laid out, are saved in your browser.

## Related

> [card] [Your account](/help/your-account.md)
>
> Two-factor authentication and deleting your account.

> [card] [Share with others](/help/sharing.md)
>
> What the people you share with can see.

> [card] [Contact support](/help/contact.md)
>
> For questions that aren't about privacy.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.