Privacy

Hart stores the itineraries you save and write, and nothing else about you that it does not need. There is no advertising, no third-party tracking, and no sale of anything to anyone. Hart keeps its own records of how the app behaves and which parts of it get used — errors, crashes, and the names of the screens you open — so it can be fixed and improved; they stay in Hart’s own database, never identify which itineraries you looked at, and are described below. Hart asks for an email address and a password so your account can be reached from more than one place — and asks for nothing else to identify you.

When you first open Hart it creates an anonymous account so the app works immediately — that account is a random identifier, tied to nothing about you. After the short setup, Hart asks you to add an email address and a password to it.

That is the same account, not a new one. Anything you wrote before adding an email stays exactly where it was; the email is added to the account you already had.

When you add your email, Hart sends a code to it, and entering that code in the app is what confirms the address is yours. If you forget your password, Hart can email a code to the same address, and you use it in the app to choose a new one. Nothing else is recovered that way, so typing that address carefully is what makes it work.

Your email address is used to identify your account, to confirm it when you add it, and to send you a password reset code when you ask for one, and nothing else. Hart does not send marketing, gives the address to nobody but the service that delivers those emails, and does not show it to other people who use Hart.

• Your email address. Used to identify your account when you sign in, to confirm it is yours when you add it, and to send a password reset code when you ask for one. Nothing else.
• An account identifier. A random ID created on first launch. It is attached to everything below.
• That you agreed to the terms. Which version of the terms you agreed to, and when, so that we can show what you agreed to. It is deleted with your account.
• Profile details you choose to enter. A first and last name, a username, a short bio, a city, your taste tags, and a profile picture if you add one. All of it is optional; skipping onboarding leaves it empty.
• Itineraries and saves. The itineraries you write — titles, descriptions, up to six photos, and the places on them, including addresses and notes — and which ones you have saved. Photos are re-encoded before they are uploaded, which removes the location and camera details a phone embeds in them.
• An automatic check of each photo. Every photo you add to a Hart or your profile is checked automatically for sexual, graphically violent or self-harm content, by OpenAI’s moderation model. OpenAI receives the image and nothing else — no name, account or text — does not train its models on it, and keeps it for up to 30 days to watch for abuse of its own service. Each one is also checked against lists of known child sexual abuse images with Microsoft’s PhotoDNA: Hart computes a fingerprint of the photo, which cannot be turned back into the image, and sends Microsoft only that — never the photo, your name, account or text. A photo that matches is taken out of view at once, reviewed by a moderator and reported to the National Center for Missing & Exploited Children, as US law requires. Hart keeps the results. Photos in your private memories are not checked.
• The area you date in. You choose it by dropping a pin on a map, or by tapping “Use my location”, and you pick how far around it to look, from 1 to 30 miles. Hart stores that spot rounded to a grid about 1 to 2 km across — every position in the same square is stored as the same point — together with the radius and the name of the town, and uses them to show you dates near you. The spot and the radius are visible only to you: they are not on your public profile and no one else who uses Hart can see them. The town name is the city on your profile.
• Your approximate area, if you allow location. Hart asks once — during setup, or the first time you look for itineraries near you — and only uses your location while you have the app open. Your exact position stays on your iPhone. When you tap “Use my location”, it is rounded on your iPhone to the grid above before it goes anywhere, and only the rounded spot is stored. To find itineraries near an inspiration, Hart sends only the wider area around you — a square of the map from about 30km to 190km across, depending on how far you choose to look (5 to 50 miles), rounded so that everywhere nearby produces the same one — and your phone does the sorting. That area is used to answer the request and is not saved to your account. If you say no, you drop the pin on the map yourself instead, and you can change your answer in Settings at any time.
• A search index of public itineraries. So that Find Near Me can tell which itineraries follow an inspiration, the text of every public one — its title, description, tags and stops, not their addresses — is turned into a numeric summary, inside the same database, by a model Supabase runs. To check the closest matches, the same text of a public inspiration and of the public itineraries nearest it is also sent to Anthropic, whose Claude model says which are the same kind of evening. Hart keeps the answer, not the text it sent; Anthropic does not train its models on it, and keeps it only for a limited period under its commercial terms. Private itineraries are never indexed or sent, and one you make private leaves the index within a minute. Nothing about you — who is searching, or where — is part of any of it.
• Planned dates. When you plan a date with someone, the date and time and any notes the two of you write together.
• Memories. Private journal entries about dates you finished — a star rating, what you wrote, and any photos you attach.
• Moderation records. If a moderator suspends your account under the terms, when they did and the reason they gave. You are told your account is suspended, in the app. The record is deleted with your account.

• No phone number. Signing in uses an email address and a password; Hart never asks for a phone number.
• Your password, in readable form. It is handled by Supabase Auth, which stores a hash. Nobody at Hart can read it, which is also why nobody at Hart can tell you what it was.
• No precise location, and no location in the background. Your exact position never leaves your iPhone, Hart never reads it while the app is closed, and it never asks for “Always” access. The spot Hart keeps for you is one you chose on a map, rounded to about 1 to 2 km, not your position.
• No advertising identifiers, and no third-party analytics. Hart contains no advertising SDK, no analytics SDK, and no third-party crash-reporting service. It does keep its own diagnostics, described below.
• No tracking. Hart does not track you across other apps or websites, and shares nothing with data brokers.

Hart records a small amount of information about how the app is behaving, and about which parts of it get used, so that failures can be found and fixed and the app can be made better. It is stored in Hart’s own database alongside everything else, is shared with nobody but the provider that hosts that database, and is never joined with data from anywhere else.

• When something goes wrong. The kind of error and which action it happened during — for example “permission denied, while publishing”. The error message itself is deliberately discarded before this is recorded, because a database message can quote text you typed.
• How long requests take. The name of the request, how many milliseconds it took, and whether it succeeded.
• Crashes and freezes. Reported by Apple’s MetricKit on the next launch: the kind of failure and a short technical reason. No screenshots, and nothing you wrote.

• Which screens you open, and which actions you take. The name of the screen (“feed”, “profile”) and of the action (“save”, “create plan”) — a fixed list, so that we can see which parts of Hart people use and which ones they give up on.
• Whether a search found anything. When you search the feed, Hart records that a search happened and whether it matched at least one itinerary. It does not record what you typed — the record is a single yes or no, with nowhere to put the words. Searches that find nothing are how we notice the catalogue is missing something.

What is not recorded, and cannot be: which itinerary you opened or saved, what you searched for, or anything you have written. Those are not fields these records have — an action is a name from a list and nothing else, so there is no place to put them even by accident.

Each record also carries a random identifier for the app session it came from and the version of the app, so problems can be traced to one release. These records carry your account identifier, so deleting your account deletes them with everything else, and they are automatically deleted after 90 days in any case.

• Hart’s own itineraries are public. The home feed and the Featured tab show itineraries written by us alongside ones people have chosen to publish — never one that is still private.
• Itineraries you write are private unless you choose otherwise. Every Hart you write starts private: only you can see it, plus anyone you send it to as a planned date. You can choose to publish one to the public catalogue, and you can withdraw it again at any time.
• Publishing a Hart publishes its photos and its stops. That means every photo you added and the addresses and notes you wrote on each stop, not just the title. If a photo or a stop shows where you live, do not publish that Hart. Nothing you wrote before this option existed was published — those Harts stayed private, and still are.
• Public Harts can be reported and hidden. Anyone using Hart can report a public Hart, and one that several people report is hidden automatically, photos included, and stays hidden unless Hart restores it. A photo the automatic check flags is taken out of view straight away, with any Hart that uses it, until a person reviews it. Being hidden does not change your setting, and you are told on the Hart itself.
• A planned date is visible to its two participants and to no other user of Hart. Your shared notes are not readable by anybody else who uses Hart.
• Memories and their photos are private to you — with one exception: the star rating. Once at least three different people have rated the same Hart, it shows the average of their ratings, counting each person once. The average never says who rated it or how, and your journal text and photos are never part of it. Photos attached to a memory are stored privately and are not readable by other accounts.
• Your first name, username, city and picture can be seen by people you plan a date with, and, if you publish a Hart, by anyone who can see it. A published Hart is signed with your first name — or your username, if you have not given a first name — and links to a read-only profile, so people know who they are planning with or whose itinerary they are reading. While every Hart you have written is private, that means only the people you plan dates with. Your last name, bio, taste tags and email are never shown to other users. Removing your picture in Profile → Edit profile deletes the image, not just the link to it.
• You can report or block anyone whose profile you can see. Blocking works in both directions: neither of you can accept the other's invitations afterwards. You also stop seeing any Harts they have published. Reports go to us, and are not visible to the person reported — or to you afterwards.
• If you send someone a link, they see the itinerary and your first name so they know who invited them. They do not see your shared notes, your memories or the rest of your profile.
• The people who run Hart can reach what it stores, as the operators of any online service can. They look only when they need to: to answer something you asked, to review a report, to keep Hart working and secure, or because the law requires it.

Hart's data lives in a Postgres database, with authentication and file storage, operated by Supabase on Amazon Web Services in the United States. Hart’s emails — the code that confirms your address and password reset codes — are sent through Resend, which receives the address the code is going to and the message itself. Anthropic receives the text of public itineraries and inspirations, as described above, to check which match. OpenAI receives the photos you add to a Hart or your profile, as described above, to check them, and Microsoft receives a fingerprint of each, not the photo, to check it against known child sexual abuse images. Geoapify receives place searches, as described below.

This website is served by Cloudflare, and the photos on it load from Supabase’s storage, so both see the IP address of anyone who visits, as any web host does. Its typefaces come from Google Fonts, which means your browser asks Google for them and Google sees your IP address too. Email you send to support@usehart.app is received by Cloudflare and delivered to Gmail, where it is stored, and our replies to it are sent through Resend. The website sets no advertising or analytics cookies.

These providers handle data in order to provide their service to Hart.

When you look up a place while building a date, what you type in that field is sent by Hart’s server to Geoapify, which searches OpenStreetMap’s open map data. It is the search text and the rounded spot and radius you chose on the map — never your position, even if you have allowed location, and never who you are. When you choose a spot, Hart names its town the same way: the rounded spot goes from Hart’s server to Geoapify. Both requests come from Hart’s server, not your phone, so Geoapify does not see your IP address or your account for them. Neither is sent to Apple or Google. Nothing about a lookup is stored except the name, address, location and kind of the place you choose to keep in your own itinerary, and the town name on your profile. Where the place data comes from is listed on the credits page.

The map you drop the pin on is drawn by your iPhone from map tiles that it downloads from Geoapify, made from OpenStreetMap data. Like any map, that means Geoapify sees your iPhone’s IP address and the part of the map you are looking at while you use it — not your account, and not the pin until you save it, which goes only to Hart. Hart’s app does not keep a copy of the tiles. The map is not Apple Maps or Google Maps.

Hart does not sell your data, and does not share it for advertising. Apart from the providers above, it discloses information only:

• when the law requires it, such as a valid subpoena or court order;
• when it is needed to protect somebody’s safety, to investigate abuse of Hart or a breach of its terms, or to defend Hart against a legal claim;
• to report apparent child sexual exploitation to the National Center for Missing & Exploited Children, as US law requires; and
• if Jinxed LLC is merged, acquired or sells its assets. Your data would then pass to the new owner, bound by this policy, and you would be told before it became subject to a different one.

• Your account and what you write are kept until you delete them, or delete the account.
• Records of how the app is used are deleted after 90 days, as described above.
• An account that never got started — one that never added an email, never finished setup and has nothing in it — may be deleted after 30 days without use.
• Backups. Supabase keeps backups of the database for a limited period, so something you delete stays in them until they expire.
• Longer, when it has to be. Hart may keep information longer when the law requires it, or while it is needed to deal with a report, a legal claim or a risk to somebody’s safety.

You can see and change most of what Hart stores about you in the app, and delete all of it as described below. To ask for a copy of your data, to correct something the app does not let you change, or to ask any other question about it, email support@usehart.app. We will answer within 30 days.

Hart does not track you across other apps or websites, so it does nothing different when your browser sends a Do Not Track or Global Privacy Control signal: there is no tracking for it to switch off.

Open Hart and go to Profile → Delete account. That permanently removes your profile, the itineraries you wrote, your saves, your planned dates, and your memories and their photos. It cannot be undone.

Deleting the app from your iPhone is not the same thing. It leaves your account and everything in it on the server — you can sign back in later and find it again, which is the point of having an email on the account. If you want your data gone, delete the account rather than the app.

You must be 13 or older to use Hart, and you confirm that you are when you agree to the terms. If you are under 18, you need a parent’s or guardian’s permission. Hart is not directed to children and does not knowingly collect personal information from anyone under 13. If you believe a child under 13 has an account, tell us at the address below and we will delete it.

If this policy changes in a way that affects what Hart collects or who can see it, the date at the top of this page will change with it, and for a significant change Hart will tell you in the app or by email before it takes effect.

Hart is operated by Jinxed LLC, a New Jersey limited liability company.

Questions about any of this, or about your data, go to support@usehart.app.