Privacy Policy

1. The short version

HeyJenni is a focus room. To run it we store your account, your task list, your notes, your focus sessions, and your conversations with Jenni.

We do not sell your data and we do not sell your conversations. You can delete your account and everything in it at any time from your settings.

This policy explains what we keep, why, and who else touches it. If anything here is unclear, write to hey@heyjenni.com.

2. Who is responsible

HeyJenni is the data controller for the information described here. You can reach us at hey@heyjenni.com.

3. What we collect

Information you give us:

• Account: your email address, and a password hash if you did not sign in with Google. If you use Google, we receive your email, name, and profile picture.
• Profile: a display name and an avatar, if you set them.
• Your work: tasks, parked thoughts, and completed focus sessions.
• Chats: the messages you send to Jenni and her replies.
• Settings: your room preferences.
• Payments: what you bought and when. Card details go to our payment provider, and we never receive them.

3.1 What we collect automatically

• Usage: which pages you opened, when a timer started or finished, and similar product events.
• Technical: IP address, browser, and device type, from ordinary server logs.
• Anti-abuse: a one-way hash of your IP address, used to stop one person from claiming guest messages over and over. We do not keep the raw address for this purpose.

3.2 If you are not signed in

As a guest, your tasks and parked thoughts are saved in your browser and never reach our servers.

Guest messages to Jenni do reach us, because the model has to answer them. They are kept with a short-lived anonymous token, not with your identity.

4. Why we use it

• To run the service: show your list, count your sessions, and let Jenni answer with context about what you are working on.
• To keep it safe: detect abuse, enforce limits, and respond to reports.
• To handle payments and give you what you bought.
• To improve the product, using aggregate numbers rather than reading individual chats.
• To contact you about your account, security, or a payment.
• To meet legal obligations.

5. Legal bases (GDPR)

• Performance of a contract: running the service and handling your purchases.
• Legitimate interests: keeping the service secure, preventing abuse, and understanding usage in aggregate.
• Consent: optional analytics and any marketing email. You can withdraw consent at any time.
• Legal obligation: tax records and responding to lawful requests.

6. How Jenni processes your messages

When you send a message, we send it to an AI model provider along with recent context: the last few messages, whether a timer is running, and the title of your active task.

The provider generates the reply and returns it. We ask providers not to use this content to train their models.

We store the conversation so Jenni can keep context between sessions. You can delete it at any time in your settings, without deleting your account, and deleting your account removes it as well.

7. Who else sees your data

We use service providers to run HeyJenni. Each one only receives what it needs to do its job:

• Supabase: database, accounts, and file storage.
• Cloudflare: hosting, content delivery, and bot protection on sign-up.
• DeepSeek and OpenAI: generating Jenni's replies and moderating content.
• WayForPay: processing payments.
• Google: sign-in with Google, and website analytics.
• Mixpanel: product analytics.

7.1 Other disclosures

• When the law requires it, or to respond to a valid legal request.
• To protect the rights or safety of our users or the public.
• To a buyer, if the service is ever sold or merged. We would tell you first.

8. Where your data lives

Our providers operate in the United States and the European Union, so your data may be transferred outside your country.

Where data leaves the EEA or the UK, the transfer relies on Standard Contractual Clauses or another lawful mechanism.

9. How long we keep it

• Account, tasks, sessions, and chats: while your account exists.
• Parked thoughts: archived automatically about a week after you write them, then removed.
• Server logs: a short period, then deleted.
• Payment records: as long as tax and accounting law requires, usually several years.
• After you delete your account: removed within 30 days, except records we must keep by law.

10. Your rights

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, limit how we use it, or object to a particular use. You can also ask us to send your data to another service.

The fastest route is your settings, where you can edit your profile, download a copy of your data, clear your conversation with Jenni, and delete your account. For anything else, write to hey@heyjenni.com. We answer within 30 days.

If you are in the EEA or the UK, you can complain to your local data protection authority.

10.1 If you are in California

You can ask what personal information we collected about you, ask us to delete it, and ask us to correct it.

We do not sell or share personal information as those terms are defined by the CCPA, and we will not treat you differently for exercising your rights.

11. Keeping it safe

Traffic is encrypted in transit. Access to production data is limited to the people who need it.

No system is perfectly secure. If a breach affects you, we will tell you and the relevant authority as the law requires.

12. Cookies

We use a small number of cookies and browser storage keys. The Cookie Policy lists each one and what it does.

13. Children

HeyJenni is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has an account, write to hey@heyjenni.com and we will remove it.

14. Changes to this policy

We may update this policy. The date at the top shows when it last changed. If a change is significant, we will tell you before it takes effect.

15. Contact

Questions about privacy go to hey@heyjenni.com.