Privacy policy

Who is responsible

Odd Hours AB (company reg. no. 559602-5824) runs Hedda (meethedda.com) and is the controller of your personal data. Questions and requests: support@meethedda.com.

What data we hold

Your email address and the name you choose. If you sign in with Apple, the address may be a forwarding address from Apple, and we also keep a key from Apple so the sign-in can be disconnected when you delete your account.

Your photos, what you write or say as your idea, the designs, and comments and pins in shared projects.

Your purchases: which pack you bought, Apple’s purchase ID and how many designs you have left. Apple handles the payment and your card details; we never see them.

Reports you send, and, if someone reports a comment or design in a project, the comment’s text or which design it was. This phone’s notification address if notifications are on, and usage statistics if you said yes to them.

Technical data: the phone’s IP address when the app fetches something from the server, the language you chose, your notification choices, and short logs for fixing problems at Supabase, deleted after a few days.

On the website: your email address and the page language if you join the waitlist, and your IP address when the page is shown.

The app

Only you, and people you invite, see a project. Someone you invite sees its photo, designs and comments, and your name: the one you choose under Account, otherwise a made-up one like CozyLamp. Never your email address. If someone reports a comment or design, the Hedda team sees what was reported, to review it.

To make designs, your photo, any reference photos and what you wrote or said go to the Hedda server (Supabase, EU) and on to OpenAI in the US, which writes the instructions, checks automatically that the idea is for your home, and makes the designs. OpenAI keeps them for up to 30 days and doesn’t use them to train its models. The designs come back to your phone. Signed in, your projects are also kept with your account, in the EU. When you start signing in, the account is created, and it becomes yours once you enter the code; if the code is never entered, it is removed after 30 days.

Your photos are used only to make your designs and, if something is reported, to review it. Never for ads, and never in our marketing without asking.

Sign-in codes and reminders about an unused account are emailed through SMTP2GO, from its servers in the EU.

If you talk instead of typing, speech is turned into text on the phone where it can be, otherwise by Apple’s speech service. Hedda keeps only the words.

Notifications and the Live Activity go through Apple. Apple gets a short line such as “Your designs are ready” or “Anna commented on Our garden”: a name and a project’s title at most, never a comment, photo or description. Hedda keeps this phone’s notification address with your account so it can send them; it is removed when you turn notifications off or sign out.

Usage statistics (which screens and steps are used in the app, the look and goal you pick, and the phone model and app version) are sent only if you said yes when the app asked, and are then kept by PostHog in the EU, linked to your account once you’re signed in. Until then nothing of it is stored on the phone. Never your photos, what you write or your email. Change it at any time in the app’s settings.

If the app crashes or a screen goes wrong, a crash report goes to Sentry, kept in the EU, so we can fix it: what went wrong in the code, and technical details such as the app and iOS version, the phone model and its free memory. Nothing is sent when nothing goes wrong. It never includes your photos, what you write, your email, your account, an id for your phone or your IP address. This is our legitimate interest in an app that works; reports are deleted within 90 days.

If someone you invited buys their first pack, we note who invited whom to give the invite gift, and Apple’s id for the buyer’s Apple Account (which doesn’t say who they are), so the gift is given once per person. The one who invited is only told that the gift came, never who bought or what. If the buyer deletes their account, only that Apple id and the date stay, so the gift isn’t given again.

Your first design is free, one per phone. To make that work, Hedda asks Apple (DeviceCheck) whether the phone has already had its own. Apple keeps a single mark for Hedda per phone, which doesn’t say who you are, and Hedda keeps nothing about the phone. Made without signing in, the project belongs to the phone’s own account, with no email.

The website

No cookies, and nothing is stored on your computer or phone. Vercel counts visits and measures how fast the page loads (Vercel Web Analytics and Speed Insights), without cookies and without recognising you from one day to the next.

If you join the waitlist, we keep your email address and the page language, with Supabase in the EU. We email you once to confirm, and then only when the app launches. The emails are sent through SMTP2GO, from its servers in the EU.

The website is hosted by Vercel, which sees your IP address in order to show the page.

Why we may use your data

Making designs, keeping projects, sharing them, charging for packs and giving the gift when you invite are needed to give you the service you chose (the contract, under the terms of use).

We use notifications and usage statistics only if you said yes to them in the app, and we email you from the waitlist only if you confirmed your address (consent). You can change your mind at any time.

We review reports and keep shared projects and the invite gift free of abuse to protect the people who use Hedda, we keep Apple’s id for the Apple Account of whoever got the gift as the one invited so it’s given only once, and we count visits to the website and, as daily totals from our own database, how often the app is opened, a photo is added, an example is opened, the packs are shown and designs are started, and how many sign in, buy and invite (with no account, id or anything stored on the phone), to make Hedda better (legitimate interest).

How long we keep it

Projects, photos and designs are kept as long as your account exists. If you haven’t used Hedda for two years we delete your projects and photos, and the account unless you have unused designs left (if you do, the account and those designs stay). First we email you 30 and 7 days before, and opening Hedda once keeps everything. If you made your free design without signing in and haven’t opened Hedda for a year, we delete it, with the photo, without a reminder, since we have no email to write to. Delete a project and its photos are removed from the server as soon as the phone is online; what you wrote as your idea stays with your account until you delete it. Delete your account and everything is removed straight away, except designs you made in someone else’s shared project, which stay there without your name, and reports about something you posted in someone else’s project and, if you got the gift as the one invited, Apple’s id for your Apple Account (see below). OpenAI keeps it for up to 30 days.

The waitlist is kept until the app has launched and we have emailed you, or until you ask us to remove you. An unconfirmed address never gets the launch email and is removed once the app has launched.

Reports are kept for up to 12 months to handle them and prevent repeated abuse, even if the person who posted what was reported deletes their account. Then they are deleted. If you delete your own account, reports you sent are removed, and so are reports in your own projects.

If you got the gift because someone invited you, Apple’s id for your Apple Account and the date are kept as long as the offer exists, even if you delete your account, so the gift isn’t given again. Nothing else is kept with it.

Who helps us

Supabase (the server and database, in the EU), OpenAI (makes the designs, in the US), PostHog (usage statistics, in the EU), Sentry (crash reports, in the EU), SMTP2GO (sends the emails, in the EU) and Vercel (the website) process data on our behalf, as processors.

Apple sends notifications and the Live Activity, and handles purchases and Sign in with Apple. For purchases and sign-in, Apple is responsible for its own data.

Outside the EU

Apple, OpenAI, PostHog, Sentry, Vercel and Supabase are US companies, and OpenAI makes the designs in the US. Transfers to the US are covered by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses. SMTP2GO is a New Zealand company, and the European Commission has found that New Zealand protects personal data adequately.

Your rights

You have the right to object to what we do on the basis of legitimate interest, and to have your data restricted or moved. You can export your projects yourself in the app, under Privacy.

You can find out what we hold about you, have it corrected or have it deleted. Delete your account in the app under Settings, and your projects and photos are removed from the server, and your usage statistics are deleted at PostHog too (it can take a few days). To leave the waitlist, email us.

You have these rights wherever you live. If you think we get it wrong, you can complain to the Swedish Authority for Privacy Protection (imy.se) or to the data protection authority in your country.