Privacy
What we collect, why, and how to get rid of it.
Last updated: 24 May 2026.
Who runs this
HeapThat is a private beta operated by Calvin Dudek, Hamburg, Germany. Reach me at hello@heapit.com or @calvindudek on Telegram. I'm the sole data controller in the sense of Art. 4 (7) GDPR.
What we store
Your Telegram user ID, username, and profile photo URL (from the Telegram login widget). Your email address if you join the waitlist or sign in via Google for the admin role. The content you stash: URLs, text notes, audio files, images, PDFs, and the AI-generated summaries, tags, and transcripts derived from them. Telegram messages from unknown senders are logged anonymously for product analytics (sender ID and message count, no message content).
What we don't store
Telegram messages from unknown senders are not stored beyond a counter for rate limiting. Audio source files are auto-deleted from Vercel Blob 24 hours after transcription unless you mark 'keep original'. We don't sell or share your data with third parties. We don't run third-party analytics or ad trackers.
Third parties
We process content through Google Gemini for summaries, tags, and transcription. We use Firecrawl for article extraction, Zyte as a proxy for YouTube transcripts, and Apify for Instagram embeds. We send transactional email via Resend. Hosting is on Vercel (frontend), Neon Postgres (database), Vercel Blob (file storage), and Google Cloud Run (the YouTube transcript microservice). Each subprocessor has its own privacy policy.
Your rights
Under GDPR you have the right to access, correct, delete, restrict, port, and object to the processing of your data. Email hello@heapit.com to exercise any of these. Account deletion removes all your stashed content and personal data within 30 days.
Retention
Account and stash data are retained while your account is active. Anonymised aggregates (counts, never content) may be retained for product analytics for up to 24 months.