Last updated: July 2026
Heia is built to be data-minimal: your entries belong to you. This policy honestly describes what the app stores — and what it does not.
Frederik Rock (Neura Labs) Schwanthalerstr. 99 80336 Munich, Germany Email: kontakt@getheia.app
All entries (feeds, sleep, diapers, …), child profiles, settings, tips history and reminders are stored locally first. Without an account they never leave your device.
If you create an account (email code sign-in), your email address plus household, child-profile and entry data are stored on Supabase servers in Frankfurt, Germany (EU) so all caregivers see the same state. Legal basis: contract performance (Art. 6(1)(b) GDPR). Server-side, entries are only accessible to your own household (row level security).
Only with your explicit consent do we send anonymous usage events (e.g. "screen viewed", "entry logged" — never content, names or health values) to our own database (Supabase, Frankfurt). No third-party analytics are used. The identifier is a random install ID with no link to your person; on revocation (settings) it is discarded and buffered data is deleted. Legal basis: consent (Art. 6(1)(a) GDPR).
Reminders (e.g. medication) are scheduled locally on your device only. No third-party push services are used and no data is transmitted for them.
Heia shows a single muted ad banner at the bottom of the overview and browsing screens (home, reports, history, calendar, growth, milestones) — never while logging, never on the running sleep timer, never with sound and never between 8 pm and 7 am. Ads are served by Google AdMob (Google Ireland Ltd.). With your consent, ads may be personalized; this processes device information, advertising identifiers (on iOS the advertising ID "IDFA", if you allow it in Apple's "App Tracking" prompt) and your IP address (coarse location). We also use the Meta (Facebook) SDK to measure which ad led to an install of Heia; device and usage information may be transmitted to Meta (Meta Platforms Ireland Ltd.). This processing only takes place with your consent (Google UMP consent and the iOS "App Tracking" prompt; Art. 6(1)(a) GDPR). If you decline, the app stays fully usable and you only see non-personalized ads. You can withdraw consent at any time (iOS: Settings → Privacy → Tracking). The one-time purchase "Heia Plus" removes all ads permanently. We do not sell data.
On your device: Your entries, child profiles and settings stay on your device until you delete them or uninstall the app. Uninstalling removes all local data. We keep nothing beyond that.
On the server (only with an account): While your account exists, your household, child profile and entry data remain stored so every caregiver sees the same picture. If you delete your account in the app under Account → “Delete account”, this data is completely and irreversibly removed from our servers within 30 days.
Deleted entries: When you delete a single entry it is first only marked as deleted and stays under “Recently deleted” for 30 days so you can restore something removed by accident. After that it is erased permanently. The marker is also technically necessary so the deletion reaches every device in your household.
Anonymous usage statistics: Only with your consent, never linked to your account or your child. These events are deleted automatically after 14 months. If you withdraw consent, we stop sending immediately.
Ads: We store no advertising data ourselves. Retention at Google AdMob and Meta is governed by their own privacy policies.
Email address: Used only for the code sign-in and deleted together with the account.
We count how often the pages of this website are opened and how often the store buttons are clicked. This runs without Google Analytics, without third parties and without cookies: nothing is stored on your device and no identifier is issued that could recognise you on a later visit. We therefore see page views, not visitors.
Stored per view: the page path (without query parameters), the referring domain (e.g. "google.com" – not the specific address), any campaign parameters (utm_*), the browser language and a coarse screen class (phone/tablet/desktop). No IP addresses, no identifiers, no personal data. Legal basis is Art. 6(1)(f) GDPR (legitimate interest in knowing whether the site does its job); with no personal reference the interference stays minimal. If your browser sends "Do Not Track" or a Global Privacy Control, we measure nothing at all. Storage is in the EU (Supabase, Frankfurt), same as the app.
You have the right to access, rectification, erasure, restriction, data portability and to withdraw consent (Art. 15–21 GDPR). You can edit and delete entries directly in the app; delete your account including all server data directly in the app under Account → "Delete account". You may also complain to your data-protection authority.
If data processing changes, we will update this policy and point it out in the app.
This is the English version. The German version is the legally binding one. The imprint is required by German law and is only available in German.