Privacy Policy

Who we are

Hey Nellie is operated by Hey Nellie App Pte. Ltd. ("Hey Nellie", "we", "us"), a company registered in Singapore. This policy covers our website at https://heynellie.app and the Hey Nellie mobile app. We handle personal information under Singapore's Personal Data Protection Act 2012 and other privacy laws that apply where we offer the service.

Information we collect

We collect information you choose to give us, including:

• Account details, such as your name, email address, profile information, and password. Passwords are stored in hashed form, not as readable text.
• Household information, such as household members, relationships, addresses, routines, and information about children that a parent, guardian, or other authorised account holder chooses to add.
• Content you create or upload, including tasks, reminders, lists, calendar events, notes, messages, voice recordings, photos, and documents.
• Messages and requests you send to Nellie, along with the relevant household context needed to respond.
• Communications you send to us, including support requests and feedback.

When you use the website or app, we may also collect limited technical information needed to operate, secure, and improve the service, including:

• Device and app information, such as device model, operating system, app version, browser type, and IP address.
• Push notification tokens, if you enable notifications.
• Authentication, diagnostic, security, and service logs.

How we use it

We use personal data to:

• Provide and personalise Hey Nellie, including creating reminders, tasks, lists, calendar events, summaries, and household updates from your requests.
• Keep information in sync for the household members with whom you choose to share it.
• Send reminders, notifications, and important service messages.
• Provide support, diagnose problems, prevent misuse, and protect the service and its users.
• Send product news or marketing only where you have chosen to receive it. You can opt out at any time.

We do not sell your personal information.

How AI processing works

Nellie's production AI processing is provided through Amazon Bedrock within Hey Nellie's secured AWS environment. To respond to a request, we send Bedrock only the information reasonably needed for that request. This may include your message, a voice recording or image to be understood, a document you ask Nellie to read, and relevant tasks, lists, events, or household context.

Amazon Web Services processes this information for us as a contracted service provider. AWS states that Amazon Bedrock does not use customer prompts and outputs to train AWS models and does not share them with the model providers. We do not send live customer content through public consumer AI-chat accounts or through tools used for our internal model testing. Internal model testing uses test or synthetic data.

The app asks for your permission before your content is used for AI processing. You can withdraw that permission by emailing hello@heynellie.app, although features that depend on AI will then stop working for you.

AI suggestions are generated from the information available to the app and may be incomplete or incorrect. Please review important dates, school information, medical details, travel plans, and other sensitive information before relying on a suggestion.

Google Calendar and Google user data

If you choose to connect Google Calendar, Hey Nellie asks Google only for read-only access to your calendars (the calendar.readonly permission). We use it to show your Google events inside Hey Nellie and to let Nellie answer questions about your schedule, such as what is on tomorrow. We never create, change, or delete events in your Google Calendar.

Hey Nellie's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

In plain terms: we only use your Google Calendar data to provide the calendar features you asked for. We do not use raw, aggregated, or derived Google user data to create, train, or improve any generalised AI or machine learning models. We do not sell it, do not use it for advertising, and do not share it with anyone except as needed to provide the feature, with your consent, for security purposes, or where the law requires.

You can disconnect Google Calendar at any time from the Calendar options in the app. When you do, we delete the imported events from Hey Nellie. You can also remove Hey Nellie from your Google Account at myaccount.google.com/permissions.

Documents and sensitive family information

Documents and photos you upload are private by default. They are available to you and to household members with whom you choose to share them, as well as to authorised Hey Nellie personnel and contracted providers only where access is needed to operate, secure, or support the service.

When you ask Nellie to work with a document, its relevant contents may be processed through Amazon Bedrock. This can let Nellie summarise information, find a date, create a reminder, or help you prepare a concise overview to discuss with a doctor, school, insurer, or other professional. Nellie is not a medical, legal, or financial professional, and its summaries should always be checked against the original document.

Private files are encrypted in transit and at rest, are not placed in a public storage bucket, and are accessed through authenticated, short-lived links. Please only upload information you have the right to use and share.

Who we share it with

We disclose personal information only where needed to provide or protect Hey Nellie, where you direct us to share it, or where the law requires it. Recipients may include:

• Household members you invite or choose to share content with.
• Amazon Web Services, which provides our production hosting, private file storage, and Amazon Bedrock AI processing.
• MongoDB Atlas, which provides managed database infrastructure connected privately to our AWS environment.
• Firebase Cloud Messaging, operated by Google, which delivers push notifications. Notification content and device tokens may be processed for this purpose.
• Email, support, security, and infrastructure providers that help us operate the service.

We may also share information if required by law, or to protect Hey Nellie, our users, or the public.

Where your data is stored and processed

Our production application servers, private document storage, and Amazon Bedrock AI processing run in the AWS US East (Northern Virginia) region in the United States. This means your personal information may be stored and processed outside the country where you live.

Other contracted providers may process information in the United States or in other countries where they operate. Privacy protections and government access rules can differ between countries. We use contractual, access-control, encryption, and network safeguards appropriate to the service and take reasonable steps required by applicable law before disclosing personal information overseas.

How long we keep it

We keep personal information only for as long as it is needed to provide the service and meet legitimate legal, security, accounting, and dispute-resolution requirements.

If you delete your account in the app or ask us at hello@heynellie.app, we disable the account, revoke active sessions, remove household access, and begin deleting files owned by that account. Deleted or replaced file versions are configured to expire from storage within 30 days. Limited records and protected backup copies may remain for longer where reasonably required for security, legal compliance, fraud prevention, billing, or service recovery, after which they are deleted or de-identified.

Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct it, or ask us to update it.
• Ask us to delete it.
• Object to or restrict certain processing, and receive a portable copy.
• Withdraw consent - for marketing emails, or for AI processing by emailing hello@heynellie.app.

Email hello@heynellie.app to make a request. We may need to verify your identity before acting. If you have a privacy complaint, please contact us first so we can investigate and respond. You may also contact Singapore's Personal Data Protection Commission or the relevant privacy regulator where you live, where local law gives you that right.

How we protect your information

We use layered safeguards including HTTPS encryption in transit, encryption at rest for private files, application-level encryption for selected sensitive fields, hashed passwords, authenticated access, household permission checks, private network connections, short-lived file links, restricted production access, and security logging.

No online service can promise that a breach or unauthorised access will never happen. You should use a strong, unique password, keep your device secure, review who belongs to your household, and tell us immediately at hello@heynellie.app if you suspect unauthorised access.

If a data breach occurs, we will investigate, contain it, and notify affected people and relevant regulators where required by applicable law, including where a breach is likely to result in serious harm.

Children's privacy

Hey Nellie currently requires a person to be at least 16 to create an account independently. A parent, guardian, or other authorised account holder may add information about children to organise family life. That information is protected and processed in the same way as other household content.

Please only add information about children or other people when you have a proper reason and the right to do so, keep it limited to what is useful, and delete it when it is no longer needed. If you believe a child has created an account or information has been added improperly, email hello@heynellie.app.

We may introduce child accounts in the future. Before doing so, we will assess the child-privacy laws that apply, introduce age-appropriate safeguards and parental or guardian authorisation where required, and update this policy to explain how those accounts work.

Changes to this policy

We will update this page when our practices change. The "Last updated" date at the top reflects the most recent revision. For substantive changes we will give signed-up users a heads-up by email.

Contact us

Questions, feedback, or requests: hello@heynellie.app.