Privacy Policy
Version draft-2026-11-08
Draft. The final wording for this page is still being written. Sections marked "to be written" say what they will cover.
Hyfo keeps what you add so it can show it back to you. We don't sell your data, and there are no ad trackers inside the app.
Who we are and how to reach us
To be written: the business name, contact email, and effective date.
What we collect
To be written: account details (email), what you add (tasks, notes, journal, habits), calendar links you connect and the events they bring in (which can include other people's names, like meeting attendees), and basic device and log data.
How we use it
To be written: only to run the features you use. Never for advertising.
Analytics
We use Vercel Web Analytics, which sets no cookies and only counts visits in aggregate. Page addresses are trimmed before they are counted, so nothing personal (like an Area name or a date) is sent.
Who helps us run it
To be written: the list of service providers (hosting, database, email) and what each one handles.
How long we keep it
To be written: the retention schedule, including that backups expire within 6 months.
Your choices and rights
You can export everything or delete your account at any time from the Account page. Deleting removes your data right away; copies in backups expire on their own.
To be written: access, correction, appeal, and how to make a request by email.
Children
Accounts are only for people 18 and older. We don't knowingly collect data from children.
Do Not Track and Global Privacy Control
To be written: how the site responds to these signals.
AI
To be written: whether any AI features process your content, and a statement that your data isn't used to train AI models.
Security and breaches
To be written: how data is protected and how you'd be told about a breach.
State privacy rights
To be written: state-specific sections (California, Connecticut and others).
Questions? Contact email coming soon.