privacy

the short version

i keep what you put into heycapy so it can remind you. i don't sell it, i don't run ads, and i don't use trackers or analytics. a few other services see parts of it so the app can work, and they're listed below. if you share a bucket, the people in it see what's in it. you can download everything or delete your account any time.

what i keep

• your email, and the name you give capy if you set one.
• a username heycapy picks for you (you can change it), and the pixel avatar you draw, so people you share a bucket with can see who did what without seeing your email.
• your past usernames and when you changed them, so an old name stays yours for 30 days and the app knows how many changes you have left.
• your timezone, which your browser tells the app, so reminders reach you on your own clock.
• your buckets and items: titles, notes, dates, custom fields, settings and the history of reminders sent.
• your chats with capy, from the app and from telegram, so capy remembers the conversation.
• how you get notified: your telegram chat, ntfy address, webhook links and the browser or phone you allowed push on.
• the connections you set up, like your own ai key, your email server login or a webhook secret. heycapy only uses them to do what you asked, and they're stored encrypted (see how i protect it).
• credits and usage: your credit balance and what each ai call cost, in numbers (tokens and cost). not what you wrote.
• a login cookie. it keeps you signed in for 30 days. it's the only cookie, and it isn't used for tracking.
• error logs. when something breaks, the app saves the error so i can fix it. i only look at your data when i need that to find a problem.

i don't keep your voice recordings. the audio is sent to be turned into text and then it's gone from my side. i don't see or store your card details either. payments go through dodo payments, and i only get a confirmation that you paid.

how i protect it

• always over https. everything between you and heycapy is encrypted in transit.
• your keys and logins are encrypted. your ai keys, voice key, email server login and webhook secrets are encrypted with aes-256 before they're saved. the key that unlocks them is kept outside the database.
• the disk is encrypted. the database lives on an encrypted disk at the hosting provider.
• your login cookie is locked down. scripts on a page can't read it.
• backups. every night heycapy saves a copy of the database and keeps the last 7. the hosting provider also takes a daily snapshot of the disk and keeps it for 5 days. both stay with the same hosting provider.

to be straight about it: your items and chats aren't encrypted one by one inside the database. they're protected by the encrypted disk and by access to the server being limited to me.

who else sees it

these services handle parts of your data so heycapy can work:

• fly.io hosts the app and the database, in frankfurt, germany.
• resend sends the emails that come from heycapy itself: your sign-in codes, and a thank-you when you send feedback. it sees your address and the text of the email. your reminder emails go through your own email account, never through resend.
• google (gemini) is the ai behind capy when you use credits. to answer, it gets your message, the recent conversation and the parts of your buckets and items that capy needs, plus your voice recording if you talk to it. if you add your own ai key, that company gets the same instead, under your own account with them.
• dodo payments takes your payment, adds taxes and keeps its own payment records, as the law requires.
• the channels you turn on: telegram, your ntfy server, the push services of your browser (google, apple or mozilla), and any discord, slack or other webhook you add. each one only gets the reminders you send to it.

i don't sell or rent your data to anyone, and nobody else gets it unless the law forces me to.

shared buckets

when you share a bucket or join someone else's, the people in it see:

• your username and avatar, never your email.
• the place your timezone is in and your local time, so they know when a reminder reaches you.
• whether you have reminders set up.
• everything in the bucket, including the items you add, the ones assigned to you, and your name on items you delete.

they don't see your other buckets, your chats with capy, your settings or how you get notified. only the owner sees the bucket's own settings and webhook links.

a shared bucket belongs to its owner:

• if you leave it, the items you added stay in it.
• if you delete your account, the items you added to someone else's bucket stay there and become the owner's.
• if the owner deletes the bucket, everything in it goes, your items too, after 30 days in the trash.
• anyone in the bucket can download it whole with download my data, items other people added included.

how long i keep it

• your data stays while your account exists.
• a bucket you delete sits in the trash for 30 days, and then it's gone.
• error logs are kept for 14 days.
• nightly backups keep the last 7 copies, so deleted data is out of the backups within 7 days.

your choices

• take it with you: tweaks → account → download my data gives you one file with your buckets, items, settings, notification history and chats. buckets you share or joined come whole, with everyone's items. keys and passwords are never in it.
• delete it: tweaks → account → delete account removes everything. if you own a bucket other people are in, remove them or delete the bucket first. if you still have credits, use them first, because there's no refund for them.
• skip the ai: adding items by hand never sends anything to an ai company.

this website

heycapy.xyz has no analytics, no ads and no cookies. it keeps your light or dark choice in your browser, and its fonts are served from the site itself. the feedback form on the about page sends your message, and your email if you add one, to me by email. i don't put it in a database.

questions

i do my best to keep your data safe, but no service can promise it's perfectly safe. if you have a question or want something fixed, email me at arvindchoudhary.in.connect@gmail.com, or send a message from the about page and put your email in the box so i can reply. if i change anything that matters here, i'll email you a few days before, like i do for the terms.