Privacy Policy

• Account: email address and password (stored encrypted by our login provider), or your Google account details if you sign in with Google.
• Profile: name, @handle, photo, banner, bio, links, country, favourite forms and genres. Your date of birth (to check you're 16 or older) and optional phone number are private: nobody else can see them.
• Your writing: published works, drafts and projects in Draftspace (chapters, character and place sheets, notes, boards, timeline, images, saved versions), comments, stories and direct messages.
• Activity: who you follow and block, likes, saves, shares, reads, notifications, writing goals and words written per day.
• Analyzer: when you run it, the text you chose is sent to our AI provider to be read, and the notes it returns are saved to your account. Your verdicts on the notes (useful / wrong) are saved too.
• Support and feedback: messages you send us and answers you give in our feedback questions.
• Technical data: pages visited, device and browser type, approximate country, and error reports when something breaks. We use this to keep Heda working and to understand how it's used — not to build an advertising profile.
• Payments: if you buy a pass, Paddle processes your payment. We receive the pass, its status and your country, never your card details.

• To provide Heda (your account, publishing, Draftspace, messages, the Analyzer, passes): necessary to perform our agreement with you.
• To keep it safe (spam and bot protection, copy-paste checks, reports and moderation, error alerts, preventing abuse): our legitimate interest in a safe, working platform.
• To improve it (anonymous usage statistics, feedback answers): our legitimate interest; you can object at any time.
• To build our own analyzer (keeping the passages the Analyzer read): only with your consent, see below.
• To follow the law (taxes on payments, answering lawful requests from authorities): legal obligation.

Heda never uses AI to write for you, and we never sell or give your writing to anyone to train their AI.

The Analyzer sends the text you chose to Google's Gemini API, on a paid plan where Google does not use it to train or improve its models. Google may keep it for a short time only to detect abuse.

Mood tags: when you publish a work, a sample of its text is sent the same way to suggest 1–3 moods.

Helping us build our own analyzer (optional): we'd like to build Heda's own analyzer one day, so we don't depend on another company. If you say yes, we keep the passages the Analyzer read together with your verdicts on its notes, and may use them to train and test an analysis model that runs on our own servers — one that only reads and points things out, like today. This is off unless you turn it on, you're asked clearly, and you can switch it off in Settings at any time; when you do, we delete the passages we kept from you.

Other people see what you choose to show: your public profile, your published works (according to the visibility you pick), comments, stories and messages you send them. Drafts are only visible to you and co-writers you invite.

Our providers process data for us, under contracts that oblige them to protect it and use it only on our instructions:

• Supabase — database, accounts and file storage (servers in Ireland, EU)
• Vercel — hosting of the website
• Render — hosting of our server for the Analyzer (Frankfurt, EU)
• Google — Gemini API for the Analyzer and mood tags; Google sign-in if you use it
• Resend — sending emails (confirmations, password resets, support replies)
• Sentry — error reports
• Cloudflare — Turnstile check that you're not a bot when signing up
• Paddle — payments for passes (as merchant of record, Paddle is also responsible for that data itself)

Some of these companies are based in the United States. When data leaves the EU, it's protected by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

We never sell your data and never share it with advertisers.

We only use what's needed for Heda to work: a cookie that keeps you signed in, and your own settings (like dark mode) stored in your browser. Our usage statistics don't use cookies and don't follow you across other websites. That's why there's no cookie banner.

• Your account and content: until you delete them or your account.
• Stories: 24 hours. Old saved versions of drafts: according to your pass (for example 7 days on Free).
• When you delete your account, your data is deleted at once from the live service and disappears from backups within about 30 days.
• Usage statistics and error reports: up to 14 months. Support messages: up to 2 years.
• Payment records: as long as tax law requires (kept by Paddle).

You can, at any time:

• see and correct your data (most of it directly in your profile and Settings);
• download your work (export any project as PDF, Word or a complete .heda file) and ask for a copy of your data;
• delete your account (Settings) or ask us to delete specific data;
• object to or restrict some uses, and withdraw any consent you gave (like the AI data option) without affecting what happened before;
• complain to AEPD (Agencia Española de Protección de Datos), www.aepd.es.

To use these rights, write to maddiewilson002@gmail.com. We answer within one month.

Every table in our database has access rules checked by the database itself, so one person can never read another's drafts, private details or pass. Connections are encrypted, private images use expiring links, and secret keys stay on our servers. No system is perfect: if a breach ever puts your data at risk, we'll tell you and the authorities as the law requires.

Heda is for people aged 16 and over. If we learn that someone younger has an account, we delete it.

If we change this policy in an important way, we'll tell you in the app before it applies. See also our Terms of Service.