Privacy Policy

1. Introduction

This Privacy Policy explains how Hey Maddie ("Hey Maddie," "we," "us," or "our") collects, uses, stores, and shares information when you text Maddie, use heymaddie.app, create an account, subscribe to a paid plan, or otherwise interact with our services, apply to creator or partnership programs, or participate in promotions such as the Founding Creator Challenge (collectively, the "Service").

By using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service. For the rules that govern your use of Hey Maddie, see our Terms of Service.

2. Who we are

Hey Maddie is a personal AI assistant that lives in your text messages and includes a web dashboard where you can manage money tracking, health tracking, goals, scheduled tasks, your profile, and connected Google services.

3. Information we collect

We collect information you provide directly, information generated through your use of the Service, and information from third-party services you choose to connect.

3.1 Account and contact information

• Phone number (required to text Maddie and to log into the dashboard)
• First name (optional)
• Email address (optional, including addresses you save for task delivery)
• Time zone
• Profile photo and cover preferences, if you upload or select them
• SMS consent status and preferences for proactive follow-up texts

3.2 Messages and conversations

• The content of messages you send to Maddie and messages Maddie sends to you (including text and, where supported, media)
• Delivery metadata such as timestamps, message type, and provider message identifiers
• Scheduled reminders, check-ins, and other outbound texts you ask Maddie to send later

3.3 Dashboard information you enter

• Money: income and expense entries, categories, amounts, budget limits, and savings goals (manual tracking only — we do not connect to your bank)
• Health: weigh-ins, workouts, optional wellness trackers (for example pregnancy, menopause, anxiety, or other conditions you choose to track), check-in notes, and related targets
• Goals: goal titles, descriptions, categories, target dates, progress, and update notes
• Tasks: scheduled reminders, searches, emails, calendar events, and document actions you set up, including instructions and recipient details you provide
• Profile notes: information you ask Maddie to remember about you

3.4 Memory and AI-derived information

To help Maddie remember context over time, we may extract and store durable facts from your conversations (for example preferences, people, schedule details, goals, or other life context you share). We may also maintain a short written summary about you. You can add or edit certain memory notes in your dashboard profile.

3.5 Google account information (optional)

If you connect Google, we store OAuth tokens and your connected Google email address so Maddie can access Gmail, Google Calendar, Google Docs, and Google Drive on your behalf, within the permissions you grant. See Section 7.

3.6 Billing information

If you subscribe to Pro, payment card details are collected and processed by Stripe. We store subscription status, plan type, Stripe customer and subscription identifiers, and related billing dates. We do not store your full card number on our servers.

3.7 Technical and usage information

• Authentication session cookies used to keep you logged into the dashboard
• One-time passcodes for dashboard login (stored in hashed form)
• Task usage counts and activity logs used to enforce free-plan limits and show you what counted as a task
• Basic server logs needed to operate, secure, and debug the Service

We use the Meta (Facebook) Pixel and Meta Conversions API to measure advertising performance and conversion events (such as starting checkout or completing a subscription). These tools may collect technical data such as page views, device/browser information, IP address, and event data related to those actions. When we send conversion events from our servers, we may include hashed contact details (for example email or phone) so Meta can match events more accurately. We also use Google Tag Manager to load and manage measurement tags on the Service. Tags loaded through Google Tag Manager may include advertising or analytics tools you configure there. We do not currently embed Google Analytics directly outside of what you may load via Tag Manager.

3.8 Creator Challenge and partnership applications

If you apply to the Hey Maddie Founding Creator Challenge or related partnership programs, we may collect:

• Full legal name and email address
• TikTok handle and profile URL
• Approximate follower count (if you provide it)
• Application metadata such as submission time, IP address, and consent records for the Official Rules, Affiliate Terms, Privacy Policy, and required disclosure obligations

If you are approved, we may also process referral attribution data (such as link clicks, signups, and qualified paid subscriptions attributed to your creator link), provisional commission and leaderboard information, payout and tax details you submit, and communications related to the promotion.

4. How we use your information

We use your information to:

• Provide, operate, and improve the Service, including Maddie's replies, reminders, dashboards, and memory
• Authenticate you, protect accounts, and prevent fraud or abuse
• Send SMS/iMessage communications related to your account, conversations, reminders, tasks, verification messages, and subscription notices
• Process subscriptions, payments, and billing support through Stripe
• Carry out actions you request with connected Google services
• Enforce our Terms of Service and comply with legal obligations
• Communicate with you about support, security, or material changes to the Service
• Review creator and partnership applications, operate referral and promotion programs (including the Founding Creator Challenge), calculate provisional commissions and rankings, prevent fraud, and process payouts where applicable

We do not sell your personal information. We do not use your conversations to train public foundation models for unrelated third-party products.

5. Artificial intelligence processing

Maddie is an AI assistant. To generate replies, extract memory, schedule follow-ups, run web searches you request, and perform other features, we send relevant content (such as recent messages, memory context, and tool inputs) to artificial intelligence providers that process data on our behalf. Depending on the feature, this may include providers accessed through our AI gateway (for example Google and Anthropic models), OpenAI for embeddings used in memory search, and search providers used when you ask Maddie to look something up.

AI outputs can be incomplete or incorrect. Maddie is not a doctor, lawyer, therapist, or financial advisor. Do not rely on Maddie for medical, legal, mental-health, or regulated financial advice.

Health and money information you enter is user-provided tracking data. Hey Maddie is not a covered entity under HIPAA and is not a medical or banking product. Nothing in the Service creates a doctor–patient or fiduciary relationship.

6. Text messaging (SMS / iMessage)

Hey Maddie is designed to communicate with you by text. Message and data rates may apply depending on your carrier plan.

• By texting Maddie or creating an account that includes SMS consent, you agree to receive messages related to your conversations, account, reminders, tasks, verification codes, subscription notices, and similar service communications.
• You may receive proactive check-in texts about open topics from past conversations. These are on by default and can be turned off by asking Maddie to stop texting first, or through the in-product proactive follow-ups control.
• Reply STOP (or similar opt-out keywords we support) to stop SMS from Maddie. Reply START to resume where supported.
• Opting out of SMS may limit or prevent use of features that depend on texting, including dashboard login codes sent by text.

7. Google account connection

Connecting Google is optional. If you connect Google, Maddie may access and use your Gmail, Google Calendar, Google Docs, and Google Drive data only as needed to perform actions you request (for example reading or sending email, creating calendar events, or creating and editing documents), subject to the OAuth permissions you approve.

You can disconnect Google from the dashboard at any time. Disconnecting removes our stored Google tokens for your account. Google's own use of your data is governed by Google's policies.

Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. How we share information

We share personal information only as needed to operate the Service or as required by law, including with:

• Service providers that process data on our behalf, such as hosting and database providers (including Supabase), SMS/iMessage delivery (SendBlue), payment processing (Stripe), AI and search providers used to power Maddie, and cloud infrastructure used to run the Service
• Google, when you connect your Google account and ask Maddie to take actions there, and via Google Tag Manager for tag/measurement loading as described in Section 3
• Meta (Facebook), via the Meta Pixel and Conversions API, for advertising measurement and conversion tracking as described in Section 3
• Professional advisors or authorities, when reasonably necessary to comply with law, enforce our terms, protect rights and safety, or respond to lawful requests
• A successor entity, if we are involved in a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality and notice where required

We do not sell personal information. We use Meta Pixel so Meta can receive limited technical and conversion data to measure and improve our ads. See Section 3 for details.

9. Data retention & security

We retain personal information for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Message history, dashboard entries, memory facts, and related records are generally kept until you delete specific items or request account deletion, or until we delete them as part of our retention practices.

We use administrative, technical, and organizational safeguards designed to protect personal information, including encrypted transport, access controls, hashed login codes, and server-side handling of sensitive tokens. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Profile photos you upload may be stored in a manner that makes the image URL accessible. Do not upload images you are not comfortable storing with your account.

10. Your choices & rights

Depending on where you live, you may have rights to:

• Access or receive a copy of personal information we hold
• Correct inaccurate information
• Delete personal information
• Opt out of certain communications
• Withdraw consent where processing is based on consent

In the product today, you can edit profile details, delete many individual dashboard entries (such as money, health, goals, and tasks), disconnect Google, turn off proactive follow-ups, and opt out of SMS by replying STOP.

To request access, correction, or deletion of your account or broader personal data, email support@heymaddie.app from the phone number or email associated with your account. We may need to verify your identity before fulfilling a request. We will respond within the time required by applicable law.

If you are a California resident, you may have additional rights under the CCPA/CPRA, including the right to know, delete, and correct personal information, and to not be discriminated against for exercising those rights. We do not sell personal information for money. We use Meta Pixel for advertising measurement, which may be considered a "share" under California law; contact support@heymaddie.app to exercise applicable opt-out rights.

11. Children

The Service is intended for adults. Hey Maddie is not directed to children under 18, and we do not knowingly collect personal information from children under 18. If you believe a child has provided us personal information, contact support@heymaddie.app and we will take appropriate steps to delete it.

12. International users

We are based in the United States. If you use the Service from outside the United States, you understand that your information may be processed and stored in the United States and other countries where our service providers operate, which may have different data protection laws than your country of residence.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date. If changes are material, we may provide additional notice (for example by SMS or email, where appropriate). Your continued use of the Service after an update means you accept the revised policy.

14. Creator Challenge

The Founding Creator Challenge is a United States–only promotion for approved TikTok creators. It is governed by the Official Rules, Affiliate Terms, and this Privacy Policy.

Public leaderboard data is limited to information we choose to publish (such as a creator display name and qualified signup counts). We do not publish private application details, payout information, email addresses, or internal fraud flags.

Referral links may use cookies or similar technologies to attribute signups to a creator, as described in the Challenge materials. Customers who subscribe through a creator link are also subject to this Privacy Policy as Hey Maddie users.

Creator Challenge questions: partnerships@heymaddie.app.

15. Contact us

For privacy questions or requests, contact us at: