jessie logojessie

jessie – Privacy Policy

Last updated: 27 September 2026

jessie ("we", "us") is a to-do app that helps you capture tasks by voice, by sharing, and from emails you forward to your personal jessie address. This policy explains what data we process, where it is processed, and what rights you have. It applies to the jessie app and to this website (jessie.do). If anything is unclear, write to us — we will help.

1) Who we are (data controller)

jessie — operated by Andri Heeb
Email: support@jessie.do
Postal address: Andri Heeb, c/o F2BII E-Commerce#195, Hintergoldingerstrasse 30, 8638 Goldingen, Switzerland

We process your data under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU GDPR.

2) Where your data lives

We use Convex to store your tasks, notes, and attachments, and Amazon Web Services for server-based task extraction. Our providers may process data outside Switzerland/the EEA. We have not yet verified all production processing locations. The providers and their roles are listed in section 4.

3) What we process and why

a) Account & sign-in

  • Email address, name, and session tokens, managed by our sign-in provider WorkOS.
  • We also record the version and time of the legal acknowledgement given during website signup in your WorkOS account metadata.

Purpose: sign you in and keep your account secure. Legal basis: performance of contract.

b) Your tasks, notes & attachments

  • The content you save in jessie: tasks, notes, due dates, statuses, and attached files.

Purpose: the core function of the app. Legal basis: performance of contract.

c) Voice capture

  • When on-device transcription succeeds, your voice recording stays on your device. If on-device transcription is unavailable, fails to start, or returns no text, the recording is sent through our servers to OpenAI for transcription. We do not retain these recordings on our servers. The transcript is processed like other task content. Server transcription may involve processing outside Switzerland/the EEA.

Purpose: turn your voice input into tasks. Legal basis: performance of contract; consent (microphone permission).

d) Forwarded emails

  • You can create a private jessie address and forward emails to it — manually or via a forwarding rule you set up. We never access your mailbox; we only receive emails sent to your jessie address.
  • Forwarded emails are classified and, where actionable, turned into tasks. We store the task together with details about the source email, such as the sender, subject, and receipt date. These details are stored on our servers and synced to your devices. Deleting the task deletes them too, and undoing the deletion restores them. The email text is not stored with the task, but it may be stored in processing records while AI classification runs; retention is described in section 6.
  • When you keep, dismiss, restore, or permanently delete a task suggested from an email, we record that choice together with the sender's address and the subject, so we can suggest senders you may want to block. These records are stored separately and are not deleted with the task.

Purpose: turn emails you choose to forward into tasks. Legal basis: performance of contract.

e) AI processing

  • To extract tasks, suggest details, and power capture features, your relevant content is processed by large language models. Server-based task extraction uses Amazon Web Services; voice transcription is described separately in section c). We do not use your content to train AI models.

Purpose: the smart-capture features of the app. Legal basis: performance of contract.

f) Usage analytics

  • We collect product usage events (e.g. which features are used) via PostHog. We do not record your screen (no session replay), and we do not track you across other companies' apps or websites.

Purpose: understand and improve the product. Legal basis: legitimate interest.

g) Crash reports & feedback

  • Crash diagnostics and feedback are processed by Sentry. Feedback you submit includes your message, any image you attach, your account name and email address so we can reply, and app/device details.

Purpose: reliability and support. Legal basis: legitimate interest; consent (feedback you submit).

h) Push notifications

  • The app schedules reminders on your device. Server-sent badge updates pass through Expo's push service and Apple's push service (APNs). These updates contain a push token and badge count.

Purpose: deliver the notifications you enable. Legal basis: performance of contract; consent (notification permission).

i) Website visitors

  • When you visit jessie.do, our hosting provider Vercel processes technical data such as your IP address and browser type in server logs (see section 6 for retention).
  • We measure how the website is used — pages viewed, scrolling, and clicked links — via PostHog. PostHog stores a random identifier in your browser (cookie/local storage) to distinguish visits. There is no session replay, no advertising trackers, and no cross-site tracking.
  • If you sign up for the beta from the website, sign-up is handled by WorkOS as described in section a).
  • The introduction video is delivered by UploadThing. Loading the video sends technical request data, including your IP address, to that provider.

Purpose: operate, secure, and improve the website. Legal basis: legitimate interest.

j) Partner referrals

  • Beta access is handed out through partner organisations. The invitation code on the flyer you used is stored with your account, and your account is added as a member of the organisation representing that partner at our sign-in provider WorkOS.
  • We use the partner code and registration and activity data to measure referrals, including aggregate registration and active-account counts per partner. Partner organisations get no access to your account, your content, or your identity.

Purpose: understand which partners testers reach us through. Legal basis: legitimate interest.

4) Our processors

We use the following providers:

  • Convex — database and file storage for your content
  • Amazon Web Services — AI processing (language models)
  • PostHog — usage analytics
  • Sentry — crash reports and feedback
  • WorkOS — sign-in and session management
  • Forward Email — receiving emails forwarded to your jessie address
  • Apple — push notifications (APNs)
  • Vercel — hosting of this website — global content delivery network; processing may occur outside Switzerland/the EEA
  • OpenAI — fallback voice transcription
  • Expo — push delivery of badge updates
  • UploadThing — delivery of the website introduction video

We do not sell your data and do not share it with anyone except these processors, or where the law requires it.

5) International transfers

Our providers may process account data, task content, recordings sent for transcription, notification data, and website request data outside Switzerland/the EEA. Contact support@jessie.do for information about processing countries and applicable transfer safeguards. We are still verifying these details for our production services.

6) Retention

  • Your content (tasks, notes, attachments): deleting a task in the app hides it from your lists, but its stored record and linked attachments can remain on our servers. There is currently no automatic permanent deletion of these task records. To request permanent deletion of your content or account, email support@jessie.do.
  • Forwarded emails: source details are deleted together with their task and otherwise follow the content retention described above. Records of these choices (section 3d) are not deleted with the task. Tasks suggested from an email that you dismiss go to the Inbox Trash. 30 days after dismissal, they are removed automatically together with their email details and can no longer be restored; as with other deleted tasks, the stored records can remain on our servers. Email text may remain in AI processing records after processing finishes or fails. We have not yet verified a maximum retention period for these records in production.
  • Analytics and crash data: kept only as long as needed for the purposes above.
  • Server logs: used to operate the service and investigate security issues. We have not yet verified the retention periods configured with our hosting providers.

7) Security

We use TLS in transit, encryption at rest where supported by our providers, access controls, and least-privilege practices. No method of transmission or storage is 100% secure.

8) Your rights

You have the right to access, rectify, delete, restrict, object to, and port your data, and to withdraw consent at any time. You can also complain to a supervisory authority — in Switzerland the FDPIC, in the EU your local data protection authority.

To exercise your rights, email support@jessie.do. We may need to verify your identity.

9) Children

jessie is not directed at children under 16. If you believe a child has provided us data, contact us and we will delete it.

10) Changes to this policy

We will post updates here and adjust the "Last updated" date. We will announce material changes in-app or by email.