jessie logojessie

jessie – Privacy Policy

Last updated: 3 August 2026

jessie ("we", "us") is a to-do app that helps you capture tasks by voice, by sharing, and from emails you forward to your personal jessie address. This policy explains what data we process, where it is processed, and what rights you have. It applies to the jessie app and to this website (getjessie.app). If anything is unclear, write to us — we will help.

1) Who we are (data controller)

jessie — operated by Andri Heeb
Email: support@getjessie.app
Postal address: Andri Heeb, c/o F2BII E-Commerce#195, Hintergoldingerstrasse 30, 8638 Goldingen, Switzerland

We process your data under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU GDPR.

2) Where your data lives

Your content — tasks, notes, and attachments — is currently stored and processed in the EU (Ireland), and AI processing of your content currently runs in the EU (Frankfurt). A few supporting services (sign-in, push notifications) are provided by US companies; details and safeguards are in sections 4 and 5. This section describes where processing happens today; if it changes materially, we will update this policy.

3) What we process and why

a) Account & sign-in

  • Email address, name, and session tokens, managed by our sign-in provider WorkOS.

Purpose: sign you in and keep your account secure. Legal basis: performance of contract.

b) Your tasks, notes & attachments

  • The content you save in jessie: tasks, notes, due dates, statuses, and attached files.

Purpose: the core function of the app. Legal basis: performance of contract.

c) Voice capture

  • When you capture a task by voice, transcription happens on your device where your device supports it — the audio does not leave your phone. Where on-device transcription is not available, audio is sent to a speech-to-text provider for transcription only and is not stored by us. The resulting text is processed like any other task content.

Purpose: turn your voice input into tasks. Legal basis: performance of contract; consent (microphone permission).

d) Forwarded emails

  • You can create a private address like u_…@in.getjessie.app and forward emails to it — manually or via a forwarding rule you set up. We never access your mailbox; we only receive what you forward.
  • Forwarded emails are classified and, where actionable, turned into tasks. We keep the extracted task, not a permanent full-text copy of the email in your task list.

Purpose: turn emails you choose to forward into tasks. Legal basis: performance of contract.

e) AI processing

  • To extract tasks, suggest details, and power capture features, your relevant content is processed by large language models. This processing currently runs in the EU (Frankfurt). We do not use your content to train AI models.

Purpose: the smart-capture features of the app. Legal basis: performance of contract.

f) Usage analytics

  • We collect product usage events (e.g. which features are used) via PostHog, hosted in the EU (Frankfurt). We do not record your screen (no session replay), and we do not track you across other companies' apps or websites.

Purpose: understand and improve the product. Legal basis: legitimate interest.

g) Crash reports & feedback

  • Crash diagnostics and the feedback you send in-app are processed by Sentry on servers in Germany.

Purpose: reliability and support. Legal basis: legitimate interest; consent (feedback you submit).

h) Push notifications

  • Reminders and notifications are delivered via Apple's push service (APNs).

Purpose: deliver the notifications you enable. Legal basis: performance of contract; consent (notification permission).

i) Website visitors

  • When you visit getjessie.app, our hosting provider Vercel processes technical data such as your IP address and browser type in server logs (see section 6 for retention).
  • We measure how the website is used — pages viewed, scrolling, and clicked links — via PostHog, hosted in the EU (Frankfurt). PostHog stores a random identifier in your browser (cookie/local storage) to distinguish visits. There is no session replay, no advertising trackers, and no cross-site tracking.
  • If you sign up for the beta from the website, sign-up is handled by WorkOS as described in section a).

Purpose: operate, secure, and improve the website. Legal basis: legitimate interest.

j) Partner referrals

  • Beta access is handed out through partner organisations. The invitation code on the flyer you used is stored with your account, and your account is added as a member of the organisation representing that partner at our sign-in provider WorkOS.
  • We derive only aggregate figures per partner from this (how many registrations, how many active accounts). Partner organisations get no access to your account, your content, or your identity.

Purpose: understand which partners testers reach us through. Legal basis: legitimate interest.

4) Our processors

We use the following providers under data-processing agreements:

  • Convex — database and file storage for your content — EU (Ireland)
  • Amazon Web Services — AI processing (language models) — EU (Frankfurt)
  • PostHog — usage analytics — EU (Frankfurt)
  • Sentry — crash reports and feedback — Germany
  • WorkOS — sign-in and session management — USA
  • Forward Email — receiving emails forwarded to your jessie address — USA
  • Apple — push notifications (APNs) — global
  • Vercel — hosting of this website — global

We do not sell your data and do not share it with anyone except these processors, or where the law requires it.

5) International transfers

Sign-in data (email, name, sessions) is processed by WorkOS in the USA, and push notifications are delivered through Apple's global infrastructure. Where data is transferred outside Switzerland/the EEA, we rely on Standard Contractual Clauses and, where available, the EU–US / Swiss–US Data Privacy Framework.

6) Retention

  • Your content (tasks, notes, attachments): until you delete it, or until your account is deleted — in the app where available, or on request by email.
  • Forwarded emails: processed to extract tasks; not kept as permanent full-text copies in your task list.
  • Analytics and crash data: kept only as long as needed for the purposes above.
  • Server logs: typically up to 30 days unless needed for security investigations.

7) Security

We use TLS in transit, encryption at rest where supported by our providers, access controls, and least-privilege practices. No method of transmission or storage is 100% secure.

8) Your rights

You have the right to access, rectify, delete, restrict, object to, and port your data, and to withdraw consent at any time. You can also complain to a supervisory authority — in Switzerland the FDPIC, in the EU your local data protection authority.

To exercise your rights, email support@getjessie.app. We may need to verify your identity.

9) Children

jessie is not directed at children under 16. If you believe a child has provided us data, contact us and we will delete it.

10) Changes to this policy

We will post updates here and adjust the "Last updated" date. We will announce material changes in-app or by email.