Legal

Privacy policy

This policy covers heylabapp.com (including heylabapp.web.app) and heylabapp products that use this domain. German version: Datenschutzerklärung. Legal notice: Impressum.

1. Controller

No data protection officer is appointed.

2. Your rights

You may request access, correction, deletion, restriction, portability, and object to processing based on legitimate interests. You may withdraw consent for the future. You may complain to a supervisory authority; for us that is the Berlin Commissioner for Data Protection and Freedom of Information (datenschutz-berlin.de).

3. This website

The site is hosted on Google Firebase Hosting. Each visit creates connection data needed to serve the page: IP address, time, URL, referrer, browser and device. Legal basis: GDPR Art. 6(1)(f) — operating and securing the site. Data may be processed in the United States. Google participates in the EU-US Data Privacy Framework. Logs are kept only as long as needed for hosting.

We set no cookies and store nothing on your device — no cookies, no local storage, no pixels, no fingerprinting, and no analytics of any kind. Details, and why there is no consent banner, are on the cookies page.

4. Fonts

Typefaces are served from this domain, from /fonts/. Loading a page therefore sends no request to Google or any other third party. Until September 2026 the fonts were loaded from Google Fonts, which disclosed your IP address to Google on every visit; that has been removed.

5. Email

Mail to hello@heylabapp.com is processed to answer you. Legal basis: Art. 6(1)(b) or (f). Cloudflare Email Routing forwards it to our inbox. We keep messages until the request is done, longer only where law requires.

5a. The subscribe field

The subscribe field on the home page is not connected to a mailing tool and does not transmit anything by itself. It opens a pre-addressed message in your own email program; nothing leaves your device until you press send there. There is a tick box next to it, and it is unticked by default — ticking it is your consent under Art. 6(1)(a) GDPR for us to keep your address for one purpose only: a short note when something ships.

If you do send that mail, we store the address and nothing else. We do not profile you, sell the list, or use it for anything but launch notes. You can withdraw at any time by replying with “stop” or writing to hello@heylabapp.com; withdrawal takes effect for the future and does not affect what was lawful before. If we later move to a hosted mailing service, we will name it here and switch to confirmed (double) opt-in first.

6. Overlap sign-in callback

/overlap/auth/callback is a static page that reopens the Overlap app after sign-in. The website does not keep an account there. App data is processed in Overlap (section 7).

7. Overlap app

Overlap is a shared leave calendar. If you create an account we process:

• Email and sign-in (magic link, Sign in with Apple, or Google)
• Calendars, members, time off, trips, and content you enter
• Booking mail you forward to a calendar address at in.heylabapp.com, including attachments
• A push token if you allow notifications

Purpose: providing the app. Legal basis: Art. 6(1)(b). Processors include Supabase (database and auth), Postmark (inbound mail), and Apple or Google if you use their sign-in. Data is kept while the account exists. Email us to delete it.

metiscale is a separate product with its own policy at metiscale.com/datenschutz.

8. No automated decisions

We do not make GDPR Art. 22 automated decisions.

9. Changes

We will update this page if the services or the law change. The version published here is the current one.

Last updated: 7 September 2026