HeyFini HeyFini

Privacy Policy

Last updated: August 2026

In short: your baby's sensitive data (breastfeeding, sleep, diapers, weight, etc.) is stored in your own iCloud. We as the provider have no access to it. Only if you explicitly switch it on in the AI chat are selected entries transmitted to the AI provider you choose (section 5.2). There are no ads and no tracking.

1. Controller

Felix Plaschka, Mietenkamer Str. 56, 83224 Grassau, Germany
Email: hello@heyfini.app

2. Baby & tracking data (iCloud)

All entries you log in the app (e.g. breastfeeding/sleep/diaper times, weight, height, head circumference, temperature, growth photos, checkups) are stored locally on your device and in your personal iCloud (Apple) and synced between your devices. Optionally you can share this data with family members via Apple's iCloud sharing. This data is not transmitted to us and is not stored on our servers. The provider is Apple; the Apple Privacy Policy also applies. Legal basis: Art. 6(1)(b) and (f) GDPR or your use of the feature.

3. Account & sign-in (Supabase)

An account is optional and is required for HeyFini Pro and the AI features. If you sign in (via email/password, Sign in with Apple or Google), we process your email address and, where applicable, your name to provide the account and – with your consent – for product information. We do not store any of your child's data with your account – neither name nor date of birth nor health/tracking data; all of it stays on-device/in your iCloud. (Earlier app versions optionally offered to store the child's name and date of birth with the account during onboarding; this collection has been discontinued and stored entries are being deleted.) Account data is stored with our processor Supabase in a data center in the EU. When signing in via Apple or Google, data is processed by those providers (e.g. email). Legal basis: Art. 6(1)(b) and (a) GDPR.

4. Location & weather

For the "What to wear?" feature you can allow location access. Your approximate coordinates are then used to retrieve the current weather from the weather service Open-Meteo (open-meteo.com). We do not store your location. Legal basis: Art. 6(1)(a) GDPR (consent via the system prompt).

5. AI features

On-device import: the optional AI import (recognizing data from images) uses Apple's text recognition and the on-device model "Apple Intelligence". This processing happens exclusively on your device; no content is transmitted to us or third parties.

5.1 AI expert chat (HeyFini Pro)

If you use the AI chat, your entered questions – and, if you attach a photo, that photo – are transmitted to the AI provider you choose to answer them: Anthropic (Claude), OpenAI (ChatGPT) or Google (Gemini). The default provider is Anthropic (Claude); you can change the provider at any time in the settings. Up to the last 20 messages of the current conversation are also sent as context.

5.2 Sharing your tracking data with the AI

This sharing is switched off by default. Without your active consent, not a single tracking entry leaves your device. If you switch it on in the "Data for the AI" sheet, you decide three things yourself:

What is actually transmitted, depending on your selection: date, time, duration, amounts, measurements, ratings and the free-text notes you recorded for those entries, as well as your child's first name, date of birth, age and sex, and your time zone. Photos from the app are not sent – neither growth photos nor photos attached to individual entries; only a photo you attach in the chat yourself is transmitted.

Before asking a question you can use "Show what will be sent" to view the exact text that goes to the provider. While sharing is active, this data block is transmitted again with every message of the conversation. If you switch it off, nothing is sent from the next message onwards.

Health data: the areas temperature, medication, vaccinations and preventive check-ups – and indirectly also sleep, feeding and excretion data – are health data within the meaning of Art. 9 GDPR. They concern your child; the parents' weight area concerns you.

5.3 Consent and withdrawal

You give your consent in two steps: once via the notice dialog before first using the chat, and additionally by actively switching on data sharing. You can withdraw it at any time without giving reasons by switching sharing off; the lawfulness of processing carried out up to that point is unaffected. Legal basis: Art. 6(1)(a) GDPR, and for health data Art. 9(2)(a) GDPR.

5.4 Temporary caching at the AI provider (prompt caching)

To reduce response times and cost, we instruct Anthropic to cache the shared data block for a short time (technically an "ephemeral cache", lifetime of a few minutes from last use). If you ask a follow-up question within that time, the cached block is reused instead of being transmitted again. Afterwards it expires automatically. OpenAI and Google perform comparable short-term caching automatically. Your tracking data is not stored permanently at the AI provider.

5.5 Third-country transfers

Processing by the AI providers may take place in third countries (incl. the USA). Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). With OpenAI (contracting entity: OpenAI Ireland Ltd.) and Anthropic, EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) are in place. Where you transmit health data, we additionally base the transfer to the USA on your explicit consent (Art. 49(1)(a) GDPR). Please note that third countries need not offer a level of data protection equivalent to European law and that US authorities may under certain circumstances demand access to data.

5.6 No AI training, retention

We exclusively use the providers' paid API offerings; your content is not used to train their AI models. The providers store requests only temporarily for abuse monitoring and then delete them: Anthropic does not permanently store chat content by default (deletion within 30 days at the latest), OpenAI up to 30 days, Google up to 55 days – in each case subject to longer statutory obligations.

What we store ourselves: your question and the AI's answer are stored with your account at Supabase (EU) so that you can find the conversation again. The shared data block is not stored – it is only transmitted to answer your question. Uploaded photos are not stored permanently. You can delete the chat history in the app at any time ("Delete history"); it is then removed from our server as well.

Usage counters: to enforce usage limits and prevent abuse, we store per account the number of requests per day and the processing units (tokens) consumed per month. No content is stored with them. Legal basis: Art. 6(1)(b) and (f) GDPR.

The AI provides only general information and does not constitute medical diagnosis or medical advice.

6. Notifications

Reminders (e.g. "next feeding") are scheduled locally on your device. For iCloud sync, Apple may use silent push notifications.

7. No tracking, no ads

We use no ad networks, no analytics/tracking tools and no cookies for advertising purposes.

8. Recipients of your data

9. Retention

Tracking data stays in your iCloud until you delete it. Account data is kept until you delete your account or object to processing. The AI chat history is kept until you delete it in the app or delete your account. The usage counters (requests per day, tokens per month) are removed when the account is deleted. Uploaded photos are not stored permanently after they are answered. The data block shared with the AI is not stored by us at all. The AI providers store requests only temporarily for abuse monitoring and then delete them (see section 5 for details).

10. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection, as well as the right to withdraw consent and to lodge a complaint with a supervisory authority. An email to hello@heyfini.app is enough. You can delete your account directly in the app (Settings → Account); this also removes the AI chat history and the usage counters. To delete only the chat history, use "Delete history" in the AI chat. You can remove the iCloud data yourself in the app at any time.

11. Child's data

The health data logged in the app concerns your child and is logged by you, as the person with parental responsibility, on your own responsibility and stored in your iCloud. If you enable data sharing in the AI chat (section 5.2), you transmit your child's health data to the AI provider. You give the consent required under Art. 9(2)(a) GDPR in exercise of parental responsibility for your child. Before sharing, please use the preview to check which details are transmitted, and involve any other person with parental responsibility where necessary.

12. No automated decision-making

Automated decision-making, including profiling, producing legal effects or similarly significantly affecting you within the meaning of Art. 22 GDPR does not take place. The AI's analyses and the app's predictions (e.g. "next feeding") are non-binding indications without legal effect.

13. Changes

We adapt this privacy policy when the app or the legal situation changes.