Privacy Notice

Phone by Heart is operated by PHONE BY HEART LLC ("we", "us"). For the personal data described below, PHONE BY HEART LLC is the data controller. Contact: phonebyheart@phonebyheart.com.

Phone by Heart was built to help you remember the people who matter — not to mine your data. We never sell your contacts, phone number, or gameplay history.

Account info (email, display name, avatar) — to create and identify your account. Legal basis: contract performance.

Login credentials (password hash, OAuth tokens) — to authenticate you securely. Legal basis: contract performance.

Contacts you add (names, phone numbers, optional notes and avatars) — to power the games and reminders you use. Legal basis: contract performance.

Verified mobile number (only if you opt in to Heart Reach) — to send you the SMS reminders you scheduled. Legal basis: consent.

Gameplay data (scores, streaks, Heart Coin balance, completed Pursuits) — to save your progress and power leaderboards. Legal basis: contract performance.

Support messages and feedback — to respond to you and improve the App. Legal basis: legitimate interests.

Device & usage data (browser, OS, IP address, crash logs, basic analytics) — to keep the App stable and prevent abuse. Legal basis: legitimate interests.

We share personal data only with the categories of recipient listed below, and only as needed to operate the App:

• Hosting & database: Supabase (database, authentication, file storage).
• SMS delivery: Twilio — receives your verified phone number and the message body strictly to deliver Heart Reach reminders.
• AI voice generation: ElevenLabs — receives the reminder script (no contact identifiers) to produce audio.
• Payment processor (Stripe): Stripe Payments Europe, Ltd. processes payments and acts as merchant of record for subscriptions and Heart Coin packs, including tax compliance, fraud screening, and invoicing.
• Professional advisers (legal, accounting) where strictly necessary.
• Authorities where we are legally required to disclose (e.g. court order).

We do not sell your data to advertisers, share your contacts with anyone, or run third-party advertising trackers inside the App.

If you opt in to Heart Reach reminders, you consent to receive automated reminder text messages from Phone by Heart at the mobile number you verify. Consent is not a condition of any purchase.

Message frequency: varies based on your reminder settings (daily, weekly, or monthly). Message & data rates may apply.

Opt out: reply STOP to any reminder text to unsubscribe immediately. Reply HELP for help, or email phonebyheart@phonebyheart.com.

No third-party sharing: mobile phone numbers and SMS consent records collected for Heart Reach are never sold, rented, or shared with third parties or affiliates for marketing or promotional purposes. Numbers are shared only with our SMS delivery provider (Twilio) strictly to transmit the reminders you requested.

We keep your data while your account is active. When you delete your account, we remove your personal data within 30 days, except where retention is required by law (for example, payment records held by our Merchant of Record for tax purposes). Aggregated, anonymized analytics may be kept indefinitely.

We use appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), encryption at rest for stored data, row-level security on our database, and least-privilege access controls. No system is perfectly secure; in the unlikely event of a breach affecting your data, we will notify you in line with applicable law.

You have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Delete your account and associated personal data;
• Restrict or object to certain processing;
• Receive a copy of your data in a portable format;
• Withdraw consent (e.g. unsubscribe from Heart Reach reminders) at any time.

To exercise any of these rights, email phonebyheart@phonebyheart.com. We aim to respond within 30 days.

Our service providers are based in the United States. If you access the App from outside the US, your data may be transferred to and processed in the US. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for those transfers.

We use a small number of strictly necessary cookies and similar local-storage entries to keep you signed in and remember your preferences (theme, sound, volume). We do not run third-party advertising or marketing cookies. You can clear these at any time via your browser settings.

Phone by Heart is not directed to children under 13. We do not knowingly collect personal data from children. If you believe a child has signed up, contact us and we'll remove the account.

We'll notify you in the App of any material changes. Continued use after a change means you accept the updated notice.

Privacy questions? Email phonebyheart@phonebyheart.com.