Privacy Policy

1. Who is responsible

Lasse Kumm operates HeadOS and is the controller for the processing described here.

Lasse Kumm Am Langenberg 8 21445 Wulfsen Germany Email: privacy@heados.app

“HeadOS”, “we” and “our” refer to Lasse Kumm. This policy covers the HeadOS app, Cleo and related support. The separate Website Privacy Notice covers visits to heados.app.

2. The closed beta

The closed beta is free and open to adults aged 18 or older, by invitation. We charge no subscription and collect no payment details. We do not sell personal data and do not show advertising.

We do not train AI models with your content. Anthropic's commercial terms prohibit training on our content. OpenAI's API data sharing is switched off for our organisation. ElevenLabs' “Improve the models for everyone” setting is switched off for our workspace.

A beta is a test. During this beta we record every conversation in full so that we can find faults and improve Cleo (section 6). You agree to this before your first conversation (section 5). If you do not agree, you cannot take part in the beta.

3. What we process

Account: email address, password (stored as a hash by Supabase Auth), user ID, sign-in and email-verification records, profile photo, chosen voice, language and app settings.

Setup answers: first name, chosen life area, selected concerns including anything you type under “Something else”, minutes per day and duration you spend on the concern, mood, and your twelve Life Wheel ratings (Work, Finance, Growth, Mission, Community, Family, Friendship, Relationship, Recreation, Spirituality, Mind, Body).

Setup progress: current step, completed steps, the first time each page was shown, the first time its Continue button was used, and how often each page was visited or left with Back. This is not a screen recording, and it contains no passwords, codes or keystrokes.

Content you provide: your voice in conversations and Captures, transcripts of it, text Captures, Goals and the answers you give while creating them, feedback, and photos you add to your profile, to People cards or to a Goal.

Generated information: Cleo's replies, conversation summaries, Threads, Actions, People notes, Patterns, Life Phase text, Life Domain ratings and profile items about you (“Me”). Together this forms a profile of you. That is profiling under the GDPR. We use it only to personalise Cleo for you. We also create embeddings, which are numerical representations of your text used for search. Embeddings are personal data.

Technical records: IP address, device model, iOS and app version, session and request IDs, push token, timestamps, error codes, audio and token volumes, and the cost of each request.

Correspondence: emails and attachments you send us.

4. How your data moves

Conversation with Cleo. Your voice travels through LiveKit to a voice agent running on Cloudflare. Soniox turns it into text. Anthropic's Claude Haiku writes Cleo's reply, using the conversation so far and saved information about you. ElevenLabs turns the reply into speech. We do not record the audio of your conversations. We save the transcript.

After a conversation. Claude Haiku analyses the full transcript and creates a summary, Actions, People notes, Patterns, Threads, Life Phase text and Life Domain ratings. OpenAI creates embeddings of the transcript and of the generated text. Some of these results are saved automatically before you see them. Others wait for your review.

Captures. Spoken Captures stream directly from your iPhone to Soniox. If live recognition fails, the app uploads the recording to private Supabase storage, Soniox transcribes it there, and the recording is removed once the Capture is saved or discarded. Claude Haiku cleans up the text and sorts it into your memory. OpenAI creates embeddings.

Goals. Claude Haiku reads your answers and relevant profile items to give suggestions while you create a Goal.

Cleo is an AI system. Its voice does not mean that a person is speaking or listening.

5. Sensitive information and your consent

Reflections regularly touch on health, sex life, sexual orientation, religion, beliefs or political opinions. The GDPR calls these special categories of personal data. We may process them only with your explicit consent.

Before your first conversation the app asks for your consent on one screen, with the choice to agree or decline. By agreeing you explicitly consent to the following, including for sensitive information:

Your voice, text and saved information are processed and stored as described in sections 3 and 4.

During the beta, your conversations and their analysis are recorded in full and evaluated to find faults and improve Cleo, as described in section 6.

Sensitive information in your words reaches the providers in section 8 like any other content, including the AI providers Anthropic, OpenAI and ElevenLabs outside the EU.

We save the time and version of your consent, and we confirm your participation by email. Your consent is needed to take part in the closed beta. When HeadOS opens to the public, full diagnostic records will become optional.

You can withdraw your consent at any time by writing to privacy@heados.app. Settings in the app has a link to this address. We stop the processing within two working days. Withdrawal ends your participation in the beta, because HeadOS cannot work without this consent. We then delete your account as described in section 11. Withdrawal does not make earlier processing unlawful.

Your setup answers are saved to our database in Ireland while you go through setup, before you reach the consent screen. If you register, they stay in your account. If you do not, they are deleted after 24 hours (section 10). No AI provider receives them before you agree.

6. Diagnostics, product feedback and human access

Full diagnostic records. We send every conversation to LangSmith, a tracing service, in full. This includes the instructions given to the AI, saved information about you, your words, Cleo's replies, the analysis results, identifiers, timings and errors. We remove passwords, tokens and keys. We do not remove names or other details. These records are not anonymous.

We use them to find faults, to check whether Cleo's replies and analyses are correct, and to improve Cleo's instructions. We do not use them to train AI models. Improving Cleo's instructions means that we change the written rules Cleo follows, based on what we learn from reading these records.

Product feedback from your conversations. After each conversation, the analysis picks out statements you make about HeadOS itself, such as criticism and wishes, and stores them with a reference to the message. We read these to improve the app. Feedback you send yourself is stored in the same place.

Setup analysis. We use the setup progress records from section 3 to see where people get stuck during setup.

Who reads your content. Lasse Kumm is the only person with access to production data. He reads conversation records when investigating a fault or checking quality. We do not monitor conversations continuously.

Operational logs. Separately, our services write technical logs without conversation content, such as error codes and timings.

7. Why we process data and our legal bases

Your account, sign-in, setup answers and progress needed to resume setup, showing your data in the app, and support: Article 6(1)(b) GDPR, performance of our agreement.

Conversations, Captures, transcription, memory, analysis, embeddings, Goal suggestions, full diagnostic records and product feedback from your conversations: your consent, Article 6(1)(a) and Article 9(2)(a) GDPR.

Operational logs, abuse prevention and setup analysis: Article 6(1)(f) GDPR. Our legitimate interest is a secure, working service and a setup that people can complete. You can object by writing to privacy@heados.app.

Information about other people in your account: Article 6(1)(f) GDPR, see section 13.

Handling privacy requests and legal duties: Article 6(1)(c) GDPR. Keeping limited records to establish or defend legal claims: Article 6(1)(f) and, where sensitive data is involved, Article 9(2)(f) GDPR.

Storage on your device: saving setup state and app data is strictly necessary for the service you asked for, section 25(2) no. 2 TDDDG.

8. Who receives your data

The Service Providers page names every provider, what it does, what it receives and where it processes data. Each provider receives only what its task requires. For example, ElevenLabs receives the text to be spoken, not your account. That text can still contain personal details, including sensitive ones.

Providers process your data on our behalf under a data processing agreement. Apple also processes data for its own distribution, TestFlight, push and operating-system services.

We give data to authorities or advisers only where the law requires it or where we need it to defend legal claims.

9. Where your data goes

Your saved account data is stored by Supabase in Ireland (region eu-west-1).

Processing is not limited to Europe. Anthropic, OpenAI, Soniox, ElevenLabs, LiveKit, Cloudflare and Resend process data in the United States or on global infrastructure. For Anthropic, our workspace is set to the United States with global routing. For Soniox, our project is set to the United States.

These transfers rely on the European Commission's Standard Contractual Clauses in each provider's data processing agreement. ElevenLabs also relies on the EU–US Data Privacy Framework where it applies. The Service Providers page links each agreement. You can ask for a copy of the clauses at privacy@heados.app.

10. How long we keep data

Account and saved content (transcripts, Captures, Goals, memory, photos): until you delete them or your account.

Accounts that never finish registration, with their setup answers: deleted 24 hours after creation.

Temporary analysis inputs and trace buffers at Supabase: 7 days.

Prompts and model responses stored with our usage records at Supabase: 7 days.

Usage records without content (model, token counts, cost): until your account is deleted.

Call transcript in the Cloudflare session store (Durable Object and the D1 database “heados-agent-analytics”): 7 days from the start of the call. The record without transcript (session ID, duration, turn counts, token volumes, costs) is kept until your account is deleted.

Minutes and cost per conversation in your account: until your account is deleted.

Embeddings stored with your content: deleted with that content. Goal-flow search embeddings: until the flow or your account is deleted.

LangSmith full diagnostic records: 14 days. If we attach a record to a dataset or an evaluation, LangSmith extends that record to 180 days.

Recordings of failed Captures: on your iPhone until transcription succeeds or you discard them; at Supabase until the Capture is saved or discarded.

Anthropic: deletes prompts and replies within 30 days. Content that Anthropic's automated safety systems flag as a possible breach of its usage policy can be kept for up to 2 years, and the safety scores for up to 7 years. Anthropic keeps data longer where the law requires it. Zero Data Retention is not active.

OpenAI embeddings: up to 30 days for abuse monitoring. Zero Data Retention is not active.

ElevenLabs: keeps the submitted text and generated audio in its history until they are deleted, and up to 30 days in backups after that. Zero Retention Mode is not active for our account.

Soniox: keeps no audio or transcript from real-time transcription, under its published policy. It keeps operational metadata.

LiveKit: carries audio in real time and does not record it for us. It keeps connection metadata.

Resend: keeps the emails it sends for us, including verification codes and your beta confirmation, for 30 days.

Record of your consent (time, version and language): until your account is deleted. After that we keep it with the records of privacy requests, for up to 3 years.

Backups: our Supabase project has no automatic backups. Files you exported and your own device backups are in your control.

Support emails: 90 days after the matter is closed.

Records of privacy requests: up to 3 years after closure, without journal content.

11. Deleting your account

In the app, go to Settings and tap “Request account deletion”. You do not need to email us. You can also write to privacy@heados.app.

We get back to you by email within 24 hours. Your account stays usable until the deletion is done. We delete your account within 14 days and confirm by email. This removes your sign-in, all your rows in our database, your call records at Cloudflare and your photos and recordings in storage.

What remains after that: copies at providers until the periods in section 10 end. LangSmith records end after 14 days. We delete extended LangSmith records by hand when we process your request. Files you exported are yours to remove, including any “deleted” folder and your own backups. Uninstalling the app does not delete your account.

12. Local files and device permissions

The app keeps a cache on your iPhone and writes a readable copy of your data to “HeadOS Data” in Documents, or to a folder you choose. If you choose iCloud Drive or another provider, that provider stores the copy and anyone with access to that folder can read it. This copy does not contain everything we hold, such as diagnostic records.

Microphone: for conversations, Captures and voice feedback. Photos: when you choose a profile picture or Goal image. Notifications: for reminders. Calendar: to add Actions you choose. Face ID: to unlock the app. HeadOS receives only the yes-or-no result, never your face data. Contacts and camera: not used in this beta. iOS requires a camera description because a built-in voice component contains camera code.

13. Information about other people

You will talk about other people. HeadOS stores that. The analysis automatically creates People cards from your conversations and Captures, with names, relationships, notes and qualities. You can also add People and photos yourself.

Those people have not agreed to this. Your consent covers you, not them. We keep People cards private to your account, and they are not visible to anyone else. Please leave out health, sexual, religious or political details about others and details of criminal matters. You can edit or delete any People card.

Someone mentioned in a user's content can write to privacy@heados.app to exercise their rights. We correct or delete information about them where the law requires it, and we protect the account holder's confidentiality when we respond.

Social Journal sharing and contact matching are switched off in this beta.

14. AI-generated information

Cleo's suggestions, summaries, Patterns and profile items are generated by AI and can be wrong. They are not medical diagnoses. We do not use them to make automated decisions with legal or similarly significant effects on you (Article 22 GDPR). You can correct or delete them in the app, or ask us to.

15. Security

Connections to our services are encrypted in transit. Supabase stores our database encrypted at rest. HeadOS is not end-to-end encrypted: the services that run Cleo must read your content to process it. Row-level security separates accounts in our database. See the Security and AI page.

16. Your rights

You have the right to access, rectification, erasure, restriction and data portability, the right to object to processing based on legitimate interests, and the right to withdraw consent. Write to privacy@heados.app. You need no special form. We answer within one month. If we need longer, we tell you why within that month, and the extension is at most two more months.

You can complain to a supervisory authority, including where you live or work. The authority for HeadOS is: Die Landesbeauftragte für den Datenschutz Niedersachsen https://www.lfd.niedersachsen.de/beschwerde

17. End of the beta and changes

Moving from the beta to the regular app does not start a paid subscription and does not add a new purpose. We ask again wherever new consent is needed. If HeadOS closes, we tell you at least 30 days in advance, give you time to export your data, and then delete it.

We update this policy when processing changes and notify you in the app or by email about material changes. The date at the top identifies this version.

Privacy contact: privacy@heados.app