Where your data lives
All application data — tasks, check-ins, career plans, reports — is stored with Supabase, our database and authentication provider, in the European Union. Every table is protected by per-user row-level security: each account can only ever read its own rows, enforced by the database itself, not just by the application. Supabase is SOC 2 Type II and ISO 27001 certified.
The application is served by Vercel; our API runs as server-side functions there.
Encryption
All traffic between your device and Heedly uses TLS 1.2 or higher. Data is encrypted at rest (AES-256) by our database provider. Calendar tokens — the most sensitive credentials we hold — are stored server-side only and are never sent to your browser.
AI processing
AI features (Adrian, the reports, the career plan, voice) call our own server, which relays the relevant text to OpenAI. The API key never runs in your browser. OpenAI does not use data submitted through its API to train models. A signed Data Processing Agreement with OpenAI is in place, and EU-to-US transfers are covered by Standard Contractual Clauses. Your check-in averages (energy, stress, motivation) and diary entries are included only with your explicit consent, so Adrian can coach you on how your weeks actually go; your sleep hours, your calendar and your email address never are. Withdraw the consent at any time in Settings → AI features.
No client names, by design
Heedly coaches you, not your client work. Lawyers and consultants are asked at onboarding to use matter codes or project code names rather than client names. Heedly never needs to know who your client is to coach you, and every feature works fully without it.
As a second safeguard, client names on your list are swapped for code names before anything reaches the AI, and put back when the answer arrives on your device. Well-known company names are masked the same way. For those names the AI sees only a code such as “Client Kestrel”. Names that are on neither list are sent as written, and voice recordings are sent as audio, which cannot be masked.
What we will never do
We do not sell data. We do not show ads. We do not use tracking pixels, advertising networks or social-media trackers. Inside the app there is no analytics at all; on the public website we use PostHog (EU cloud) and HeyCatch for anonymous page and click statistics, without cookies. Your data is not used to train AI models — not by us, and not by our providers.
Export and deletion
You can delete your account, and everything in it, from inside the app — no email, no waiting period. Data export is available on request at info@heedly.app under Art. 20 GDPR.
Subprocessors
The full, current list of subprocessors — Supabase, Vercel, OpenAI, Stripe, Apple, Resend, PostHog, HeyCatch, and Google/Microsoft where you connect a calendar — is maintained in section 6 of our privacy policy, with the role of each.
Questions
Security or data-protection questions, or anything a procurement or compliance review needs: info@heedly.app. We answer these ourselves, not through a bot.