Heard

Privacy Policy

Last updated: 8 September 2026

Heard is a tool for songwriters and producers to manage the music they pitch and the conversations that follow. To do that, it connects to your email. This policy explains exactly what it reads, what it stores, who else sees it, and how to get rid of it.

Who we are

Heard is operated by Ryan Boer, based in the Netherlands. For any question about this policy or your data, write to privacy@heard.example.

What we access, and why

When you connect a Google account, Heard requests two permissions and no others:

  • Read your email (gmail.readonly). Heard reads incoming mail to notice when someone replies to a pitch you sent, to work out what the reply means, and to move that pitch to the right place on your board. Without this, nothing on the board can update itself.
  • Send email as you (gmail.send). Pitches and follow-ups go out through your own mailbox, so replies arrive in your inbox and the conversation stays yours. Heard never sends from its own address on your behalf.

Heard does not request permission to delete your mail, change your account settings, or read anything outside Gmail.

What we store

  • Your account details: name, email address, time zone, and the workspace you belong to.
  • The records you create: contacts, tracks, templates, and pitches.
  • Email that relates to your pitching. We fetch message headers first, and store the full text of a message only once it has been matched to a pitch you sent. Unrelated mail is not retained.
  • Your Google refresh token, encrypted, so Heard can keep working without asking you to sign in repeatedly.

Google Limited Use

Heard’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we do not use Google user data for advertising, we do not sell it, we do not use it to train generalised artificial intelligence or machine learning models, and no human reads your mail except where you have explicitly asked us to help with a problem, where it is necessary for security, or where the law requires it.

Artificial intelligence

Jerry, the assistant inside Heard, uses the Anthropic Claude API to read replies and draft follow-ups. This means the text of matched messages is sent to Anthropic to be processed. Anthropic acts as our subprocessor and does not use this content to train its models. Jerry only ever drafts: nothing leaves your mailbox without your approval unless you have explicitly switched a specific pitch to send automatically.

How your data is protected

  • Everything is stored in the European Union and encrypted in transit and at rest.
  • Your Google refresh token is encrypted with a key that is never stored in the database, so a copy of the database alone cannot be used to reach your mailbox.
  • Every record is isolated to your workspace at the database level, not merely filtered by the application.

Who else sees it

Heard does not sell your data or share it for advertising. It reaches only the providers needed to run the product: Supabase for database and authentication hosting, Anthropic for the assistant, Fly.io for background processing, and Vercel for the website. Each processes data only on our instructions.

How long we keep it

Synced email is retained for 12 months, or until you delete the pitch it belongs to, whichever comes first. Everything else is kept while your account is open. When you delete your account we revoke our access to your Google account, erase your stored mail and your encrypted token within 30 days, and remove the rest of your records.

Your choices

  • Disconnect at any time, from Settings in Heard, or from your Google account permissions. Revoking access there stops Heard reading your mail immediately.
  • Export or delete your data. Ask us and we will provide a copy, or erase everything, within 30 days.
  • Under the GDPR you may also access, correct, restrict or object to our processing, and complain to your data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens.

Changes

If this policy changes in a way that materially affects you, we will tell you by email before it takes effect.