Privacy Policy

Last updated: 13 June 2026

This is a courtesy translation. The German version is legally binding.

This website (heijo.app) provides information about the product “Heijo”, which is in development, and offers the option to join a waitlist. We take the protection of your data seriously and comply with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Controller

The controller responsible for data processing on this website is:

Full provider details in the imprint.

2. The essentials

• This website sets no cookies for analytics or marketing and uses no tracking.
• Fonts are served from our own server — no data is transferred to Google Fonts or other external providers.
• We only store the data you actively give us through the waitlist form — and only with your consent.
• Waitlist data is stored within the European Union.

3. Visiting the website (server log files)

Our website is hosted by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). When you visit the site, Cloudflare, acting as our processor, processes technically necessary connection data in order to deliver and secure the site. This includes in particular:

• the requesting IP address,
• date and time of access,
• the requested address (URL) and the HTTP status code,
• the browser and operating system used (user agent).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functional provision of the website). A data processing agreement (Art. 28 GDPR) is in place with Cloudflare. As Cloudflare is a US company, processing may also take place in the USA; this is safeguarded by the EU Standard Contractual Clauses and/or certification under the EU-US Data Privacy Framework (Art. 44 et seq. GDPR).

4. Waitlist

When you join the waitlist, we process:

• your email address,
• the time you signed up and a technical source marker (which form),
• the version of the consent text you agreed to.

Purpose: to notify you once Heijo is available, and possibly a few closely related messages around launch.

Legal basis: Art. 6(1)(a) GDPR (your consent, given by ticking the checkbox and submitting the form).

Storage & processor: the waitlist is run via Supabase (Supabase Inc., 970 Toa Payoh North, Singapore); the database server used for us is located in the European Union (Frankfurt region, Germany). A data processing agreement under Art. 28 GDPR is in place with Supabase.

Retention: we store your email address until the launch notification and a short period afterwards, at most until you withdraw your consent. You can withdraw at any time, informally, by email to hello@heijo.app; we will then delete your data promptly. Withdrawal does not affect the lawfulness of processing carried out up to that point.

5. Cookies & tracking

This website itself uses no cookies and embeds no analytics, advertising or tracking services. No usage profiles are created.

For technical security reasons, our hosting provider (Cloudflare) may set a strictly necessary cookie (e.g. to defend against automated attacks). Such a cookie serves solely security and proper operation and is exempt from consent under § 25(2) TDDDG (German Telecommunications-Digital-Services Data Protection Act). A cookie banner is therefore not required.

6. Fonts

We use the “Newsreader” typeface, served locally from our own server. No connection to third-party servers (such as Google Fonts) is established when loading the page; in particular, no IP addresses are transmitted to third parties for this purpose.

7. Encryption (SSL/TLS)

For security reasons this website uses TLS encryption. You can recognise an encrypted connection by the “https://” in your browser's address bar.

8. Your rights

You have the following rights regarding your data:

• Access to the data stored about you (Art. 15 GDPR),
• Rectification of inaccurate data (Art. 16 GDPR),
• Erasure (Art. 17 GDPR),
• Restriction of processing (Art. 18 GDPR),
• Data portability (Art. 20 GDPR),
• Objection to processing (Art. 21 GDPR),
• Withdrawal of a given consent with effect for the future (Art. 7(3) GDPR).

An informal message to hello@heijo.app is enough.

9. Right to lodge a complaint

Regardless of the above, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the one for your habitual residence or the one responsible for the controller:

10. Changes to this policy

We will adapt this privacy policy whenever data processing changes (e.g. when new features are added). The version published on this page at the time applies.