Privacy policy

Who we are

Heed is a social meditation log at heed-app.com, run by Lars de Graaff in the Netherlands. Questions or requests about your data: email larsdgraaff@gmail.com.

What we collect

Account: your email address and a password (handled by our auth provider, stored hashed). Profile: a username, and optionally a display name and bio. Sessions: when you meditated, for how long, which app you used (if any), and an optional note you write. Social activity: who you follow, likes, comments, blocks, and reports. Technical basics: standard server logs kept by our hosting providers, and a little data stored on your own device (your session, and, if you connect Apple Health, a sync token and the list of sessions already synced).

Two things are emailed to the person who runs Heed (Lars): a notification when a new account is created (username, email, display name), and the content of any report you send, together with your username. Reports are therefore not anonymous to us.

We do not run ads, we do not use tracking or analytics cookies, and we never sell your data.

Apple Health

If you use the Heed iPhone app and choose to connect Apple Health, Heed reads only your Mindful Minutes (start time, duration, and the app that recorded them), and only after you grant permission on Apple's own consent screen. This is used for one thing: logging those sessions in your Heed feed. To do that, those sessions are sent to Heed's own server and stored in the Heed database like any other session, and they are shown to other people according to the sharing setting you choose when you connect (everyone, followers only, or just you). Health data is never used for advertising and never shared or sold. You can disconnect at any time in the app, and deleting your account removes the sessions we stored. Separately and only if you turn it on, Heed can save the sits you do with its own timer to Apple Health as Mindful Minutes; nothing else is ever written to Health.

Who can see what

Heed is a social feed, so sessions are visible to others by default. You are in control: you can make your account private (only approved followers see your sessions), choose who sees sessions imported from Apple Health, choose visibility when you log a session by hand, delete any session, and block anyone. Your email address is never shown to other users.

Where your data lives

Your data is stored with Supabase (database and authentication, hosted in Frankfurt, EU). The website runs on Vercel, our API runs on Railway, and account emails (such as login codes) are sent via Resend. These providers process data on our behalf to run the service.

How long we keep it

For as long as you have an account. You can delete your account yourself at any time under Profile, Edit profile, Delete account: this permanently removes your profile, sessions, comments, likes, and follows.

Your rights

Under the GDPR you can ask for access to, correction of, or deletion of your personal data, and you can object to processing. Most of this you can do directly in the app; for anything else, email us. You also have the right to complain to the Dutch data protection authority (Autoriteit Persoonsgegevens).

Age

Heed is not intended for children under 16.

Changes

If this policy changes, the new version appears on this page with a new date. Last updated: 26 August 2026.