Privacy
Vea (veaos.app) is a weekly check-in you keep for yourself. This page says, in plain words, what happens with your data. Last changed 22 October 2026.
Who is responsible
Vea is made in the Netherlands by one independent developer, as a small project. That developer is responsible for your data (the "controller" in privacy law) and is reachable at the address below. Questions or requests about your data: [email protected]. Vea is free for now; once it charges money, this page will also give a Chamber of Commerce (KvK) number and a business address.
What is stored, and where
- Your account: your email address, and what you put in Vea: your weeks, notes, habits, goals, experiments and settings. It is stored by Supabase in Frankfurt, Germany (EU), under your own account. Only you can read it: the database gives your rows only to you when you're signed in.
- Health information: what you add can be about your health, like your sleep, weight or mood, a sick week, or a note about how you feel. That is a special kind of data in privacy law, so Vea asks you: after setup, or the next time you open Vea if you already used it. You can change your answer at any time. With a yes, you can connect Apple Health: the iPhone app reads only the kinds you pick, on your phone, and saves them as the week's number. Nothing else from Apple Health leaves your phone. With a no, Vea won't ask about your health: Apple Health stays off, the health picks in setup (like sleep, steps and weight) are taken out, and a week you marked as "sick" becomes a rest week. A backup you restore loses its Apple Health numbers too. What you type or import yourself after a no is your own choice; Vea stores it like anything else you write, and you can remove it at any time.
- End-to-end encryption is optional, in Account settings. With it on, your data is scrambled on your device before it leaves it. Only your passkey or recovery code can open it, so Vea, Supabase and the backups only hold scrambled data.
- Reminders, if you turn them on: one row per device with where to send the reminder, your time zone, and the day and hour you chose. Nothing you wrote.
- In your browser: a copy of your account for offline use (not with end-to-end encryption on), your draft setup, and the lines you add in the website's try-out, kept for two weeks until you join. None of it leaves your browser; signing out or clearing the site's data removes it.
- Crash reports: when something breaks on veaos.app or in the iPhone app, Vea sends a short report: the error message, the file and line, and the page's name. Never what you wrote, never your account. Email addresses and long numbers are removed from the message.
Why we may use it
- Your account and what you write: to run Vea for you, as agreed in the Terms.
- Health information: Vea itself collects it only after your explicit consent, which is your yes to that one question. What you type or import after a no is your own choice and is stored as your own writing. Vea keeps your answer with its date. You can change it at any time in Account settings → Health information. When you take back your yes, Vea stops reading Apple Health and deletes what it got from there. What you typed yourself stays until you remove it or delete your account, or ask us to help. Copies in the monthly backups are gone within 12 months.
- Crash reports: to find and fix bugs, which keeps Vea working for you (a legitimate interest).
Your email address is used to sign you in (a sign-in link or an invitation) and for a few important messages about your account, such as a price change at least 30 days before it happens, or if Vea ever stops. No newsletters, no advertising.
Who else handles it
- Supabase stores your account (Frankfurt, EU).
- Cloudflare runs the website, the nightly backups, the crash reports and the forwarding of mail to [email protected] (EU and US).
- Resend sends the sign-in and invitation emails (US).
- Apple keeps your Apple Health data on your phone; Vea only reads what you allow.
They only process data to do this for Vea, under a data processing agreement. Cloudflare and Resend are American companies: where data goes to the US, it's protected by the EU's standard contractual clauses in those agreements, and Cloudflare is also certified under the EU-US Data Privacy Framework. Nobody else gets it.
How long it's kept
- Your account: until you delete it. Deleting removes everything from the database at once.
- Nightly backups: 35 days. One backup a month is kept for 12 months, so a deleted account is gone from all backups within a year.
- Crash reports: 60 days.
- Reminder rows: until you turn reminders off or delete your account.
What is not done
No analytics, no trackers, no advertising, no selling or sharing of data. The site loads nothing from other websites. Nobody reads your check-ins: support looks at a problem only when you ask, and only at what is needed.
Your rights
- See and download all your data: Account settings → Export backup.
- Change or delete it: in the app, or delete your whole account in Account settings.
- Take back your consent for health information at any time: Account settings → Health information (see above).
- Ask us anything about your data: [email protected]. We answer within a month.
- If you think we handle your data wrongly, you can complain to the Dutch privacy authority, the Autoriteit Persoonsgegevens.
Age
Vea is for people of 16 and older.
Changes
If this page changes in a way that matters, we'll tell you in the app first. The date at the top shows the latest version.
Support
Something broken, confusing or missing? Email [email protected], or use Send feedback in Account settings. One line is enough.