Privacy Policy for Heads Up

Last updated: 13 September 2026

The short version

• Heads Up works with no account. Used that way, nothing you type leaves your phone — with one exception, which only happens if you choose it: a feedback message you write and send.
• If you make an account, your reminders are copied to a server so they reach your other devices. Their text is stored in ordinary readable form. It is encrypted in transit and at rest, but it is not end-to-end encrypted, and we can read it.
• There is no analytics, no crash reporting, no advertising and no tracking of any kind. Not reduced — none.
• Voice input is transcribed by your phone's own speech recogniser, which on most Android phones is Google's. Heads Up never receives, stores or sends audio.
• If you send feedback, the message goes to us with your app version, your Android version and whether four notification permissions are on. The app lists all of it on screen before you send. Nothing identifying your phone goes with it.
• You can delete your account and everything on it from inside the app, immediately.

Who we are

Heads Up is made by 57Apps, a one-person operation. For the purposes of the GDPR, 57Apps is the data controller for the information described here. Contact: [email protected].

This policy covers the Heads Up mobile app and the pages on www.57apps.com.

Using Heads Up without an account

This is the default, and it is a complete way to use the app. No sign-in is offered on first launch and none is required for any reminder feature.

Used this way, everything lives on your device:

• Your lists, reminders, notes, tags, due dates and completion history, in a database on the phone.
• Your settings — notification lead times and how often a reminder repeats itself, whether the app asks you in the evening to plan tomorrow, how long completed reminders are kept, your voice input language, and your colour palette and light or dark choice.
• Up to five rolling automatic backups of your reminders and lists, kept in the app's own storage. They are never uploaded anywhere. They live inside the app, so removing the app removes them too.

None of it is transmitted. Uninstalling the app deletes all of it.

The single exception is a feedback message, if you write one and tap Send. That is a deliberate act, it is never automatic, and it is described in full below. Your reminders are not part of it.

Android's own backup used to be a second exception, and is not one any more. Many apps let Android copy their data to your Google account, or hand it to a new phone during setup; Heads Up opts out of both, so the reminder database is never copied to a Google account and never travels to another device that way. The consequence is worth being clear about rather than burying: used without an account, your reminders exist in one place only, and uninstalling the app or losing the phone loses them. A Heads Up account is what carries them anywhere else, and that is described next.

When you sign in

Making an account turns on syncing. From then on, the following is stored on our server:

Your identity

• Your email address.
• If you signed in with Google or Apple, that provider tells us your email address and gives us an account identifier. We do not receive your password, your contacts, or anything else from them.
• A password, if you made one — stored only as a hash, by our authentication provider, never in readable form.

Your reminders

• The text of each reminder and its notes.
• Due dates and times, the timezone the due date was set in, and whether the date is an appointment or a plan.
• Priority, repeat rules, completion state and times, and where you have placed it in the list.
• How you asked to be reminded of it — whether it rings like an alarm, whether it keeps nudging until done, or whether it should stay quiet.
• Your list and tag names, and which of the app's five list colours each list wears.
• Reminder bookkeeping — how many times something has been snoozed, how many times it has been moved to another day, how many nudges it has had today, when it last nudged you and when it will next, and whether it was typed or spoken.
• Which account created each item, and a random identifier for the item itself.

The identifier on each reminder

Every reminder gets a random 128-bit number when it is created, and keeps it wherever it goes — the copy on your phone, the copy in a backup file, the copy on each of your other devices. It is what lets syncing tell "the same reminder, seen twice" from "two reminders".

It identifies the reminder, not you and not your phone. It is not derived from your hardware, it is not an advertising identifier, and it is not shared with anyone.

An earlier version of this page described a random number generated once per installation instead. That is how syncing used to work, and it is not how it works now: the app no longer generates or stores any per-installation or per-device identifier at all. This paragraph is here rather than a silent edit, because a policy that over-claims what it collects is still a policy that does not describe the app.

Sharing a list with someone

Shared lists need an account, and they involve other people's information as well as yours. Three things about them are easy to miss, so they are here rather than in the small print.

• Inviting someone stores the address you typed, and emails them. The address is saved on our server so the invitation can be found when that person signs in — including if they have no account and never make one. We also send one email to it, telling them the name of the list and the address of the person who invited them, so they know what it is and who it is from. It goes through the same email provider as our sign-in codes (see Who else is involved). The person who invited you can send that same email again, at most once a day, until you accept or decline. The address stays until someone on the list cancels the invitation or the invited person responds to it. If you have been invited to a list and would rather your address were not there, email us and we will remove it.
• Everyone on a shared list can see everyone else's email address, including the addresses of people who have been invited but have not yet accepted. This is how the members screen shows you who you are sharing with. Consider it before accepting an invitation from someone you would rather not give your address to.
• Any member can complete anything on the list. Only the person who added a reminder, or the list's owner, can change its text or delete it. The owner can remove members and delete the list, which removes it for everyone.

Deleting things, and what stays

Deleting a reminder

It disappears from your devices immediately. On the server the row is marked as deleted rather than removed, because that is how your other devices find out it is gone. Its text stays on the server in that state for up to thirty days. A job runs every night and removes marked-deleted rows once they are thirty days old; deleting your account removes them at once.

The "keep completed reminders" setting

Your choice of 30 days, 90 days or forever removes old completed reminders. If you are signed in, that removal is sent to the server too, so the reminder leaves your account and your other devices as well as the phone it was purged from — it is marked deleted there, and cleared by the nightly job above. An earlier version of this page said the server's copy was left alone. It was not, and the app's own Settings screen said the same wrong thing; both now say this.

Voice input

The microphone is used only while you have voice input open, and only if you grant the permission.

• Heads Up never records, stores or transmits audio. It asks your phone's speech recogniser for text and receives text.
• That recogniser is a part of your operating system, not part of this app. On most Android phones it is Google's, and it may send your audio to Google to transcribe it. When it does, that is covered by Google's privacy policy, not this one. We have no access to it. Some devices and settings do the transcription on the phone instead; your Android settings control that.
• Adding a reminder through Google Assistant works the same way — the Assistant transcribes it entirely outside the app and hands Heads Up the finished text.
• Typing always works. Nothing in the app requires the microphone.

Feedback you send

Settings has a Send feedback form. It is the only way the app sends us anything you wrote that is not a reminder, and it works whether or not you have an account — most people who have something to say about a reminders app have never signed in, and requiring an account would mean not hearing from them.

Nothing is sent until you tap Send. There is no background reporting, no automatic error submission, and nothing is queued to go later. If a send fails, the message stays on the screen and the app says so.

What a message contains

• The text you typed.
• An email address, only if you fill in the optional "if you want a reply" field. When you are signed in it starts filled in with your account address, and you can clear it or change it.
• The app's version and build number.
• Your operating system's version — for example "Android 16 (API 36)".
• Whether four notification permissions are on, off, or not applicable on your phone: notifications, exact alarms, full-screen alarms and battery optimisation. These are what explain why a reminder did not arrive, which is the thing feedback is most often about.
• Your account, if you are signed in. The server takes this from your session rather than the app sending it, so it cannot be faked — and because you would otherwise have no way of noticing it, the form lists it with everything else.

The app shows you that entire list on the form, before you send. If it is not on that list, it is not in the message. Your reminders, notes, list names and tag names are not sent, and neither is any identifier of your phone.

What is deliberately not collected

No device identifier, no installation identifier, no advertising identifier, and no record of your IP address — not even a hashed one. That is a choice with a cost: it means there is no per-person limit on how much feedback can be sent, and the protection against someone abusing the form is that we can switch the form off, not that we can identify them. We would rather carry that than start keeping a record of who is connecting from where.

What happens to it

• It is stored in the same database as sync, described under Who else is involved — hosted by Supabase, in the United States.
• It is used to answer you and to fix the app. It is not shared, not sold, not used for advertising and not used to train anything.
• You can see what became of it. Settings → Your messages lists what this phone has sent and its status, along with any reply. That works without an account because the app keeps a random ticket for each message on your own device — clearing the app's data loses those tickets, and with them the ability to look a message up.
• Messages are kept while they are still useful — while the bug is open, or the request is still on the list. Ask us to delete one at any time.

If you delete your account

Your feedback is the one thing that is not destroyed with it. The link to your account is removed and the reply address is erased, so what is left is a message with nobody attached to it. The reason is plain enough: a bug report is why a fix exists, and erasing the person should not erase the reason. If you would rather the message went too, say so and we will remove it.

Permissions

Heads Up asks for no location, no contacts, no camera and no access to your files. No permission is used to collect anything.

Who else is involved

• Supabase hosts the database and handles sign-in. They process your data on our instructions.
• Mailtrap delivers the few emails Heads Up sends: the code that confirms a new account, the code that resets a password, and an invitation to a shared list. They see the address the email goes to and what it says, and nothing else about you.
• Google, if you use Sign in with Google; and indirectly, as described above, through your phone's speech recogniser.
• Apple, if you use Sign in with Apple. Not offered on Android.
• GitHub Pages serves this website, and sees the usual request logs including IP addresses.

There is no analytics, no crash reporting, no advertising, no attribution and no telemetry in this app. No third-party SDK of that kind is present in it. Nothing about how you use Heads Up is measured or sent anywhere. The version you install writes no diagnostic logs at all, and crashes are not reported to us — if the app breaks and you do not tell us, we do not find out. The only technical information we ever receive is the short list attached to a feedback message you choose to send. This website sets no cookies, runs no analytics and makes no third-party requests — the typeface it uses is served from the same domain as the page.

We do not sell your data, and we do not use it to train anything.

Where your data is

The server is in the United States (AWS us-east-1, Northern Virginia). If you are in the UK or the European Economic Area, your information is transferred there and is handled under the European Commission's Standard Contractual Clauses, which is the basis our hosting provider operates on.

How long it is kept

Your reminders stay on the server while your account exists, including the marked-deleted rows described above. Deleting your account removes all of it. We do not keep backups of your content beyond what our hosting provider retains for operational recovery, which is measured in days.

Feedback messages are kept for as long as they are still useful — while the bug is open, or the request is still under consideration — and are not tied to your account once it is deleted. Ask us and we will remove one sooner.

Deleting your account

In the app: Settings → Account → Delete account. It is immediate and it cannot be undone. It removes your account, your reminders, your lists, your tags, your marked-deleted rows and any invitations sent to or by you.

Three things are worth knowing before you do it. Reminders you added to lists you share with other people are deleted too — they were yours. A shared list that you own is not destroyed: it passes to whoever joined it first, so the other people on it keep their reminders. And any feedback you sent is kept, with the link to your account removed and the reply address erased — a bug report is why a fix exists, and erasing you should not erase the reason. Ask us if you want the message gone as well.

If you cannot open the app, email [email protected] from the address on the account. Full instructions are on the account deletion page.

Children

Heads Up is not directed at children under 13, and we do not knowingly create accounts for them. The app does not ask your age. If you believe a child has made an account, email us and we will remove it.

Your rights

Depending on where you live, you may have the right to see what we hold about you, correct it, have it deleted, take a copy elsewhere, or object to how it is used. Deletion is self-service in the app; for anything else, email us and we will answer within 30 days.

Where the law asks us to name a basis for processing: syncing your reminders is us performing the service you asked for; the microphone is your consent, which you can withdraw in your phone's settings; keeping the service running and unabused is our legitimate interest.

If you are in the EEA or UK and are unhappy with our answer, you can complain to your national data protection authority.

Security

Traffic is encrypted with TLS. Data is encrypted at rest by our hosting provider. Passwords are hashed, never stored in readable form. The database enforces, per row, that only members of a list can read it — that rule lives in the database rather than in the app, so a bug in the app cannot bypass it.

What we do not claim: end-to-end encryption, or that any system is impossible to breach.

Changes to this policy

If what the app does changes, this page changes with it and the date at the top moves. For anything that materially widens what we collect, we will say so in the app rather than only here — quietly editing this page is how the previous version came to be wrong.

Contact

[email protected]