HeyAlexSMS Opt-In

Privacy Policy

Last updated: August 2026

Who we are

HeyAlex is a personal capture service. You text one number and HeyAlex saves reminders, ideas, tasks, and calendar events for you, and answers questions you text in. HeyAlex is a registered trade name of Behemoth Ventures, LLC, which owns and operates this website and the HeyAlex SMS service.

What we collect

  • Your account email address (used to sign in).
  • Your mobile phone number, which you enter and verify during onboarding.
  • The content of the messages you text to HeyAlex, and the replies we send you, so we can save and show them back to you in the app.
  • If you choose to connect Google Calendar, the access tokens needed to create the calendar events you ask for.

How we use it

We use this information only to provide the service: matching your incoming text to your account, classifying and storing your captures, answering your questions, sending the reminder alerts you scheduled, and syncing calendar events you requested. We do not use your data for advertising or profiling.

Sharing

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Phone numbers and SMS consent are never sold, rented, or shared with third parties for marketing.

We do rely on infrastructure providers strictly to operate the service: a cloud database and application host for storing your account and captures, an SMS carrier (Twilio) to deliver and receive your text messages, an AI provider (Anthropic) to classify messages and generate answers, and Google Calendar if you connect it. These providers process data on our behalf only.

SMS messaging

You opt in by entering your number in the app and confirming a 6-digit verification code. Message frequency varies based on your usage. Msg & data rates may apply. Reply HELP for help or STOP to cancel at any time. Details are on our SMS Opt-In & Consent page.

Google user data, scopes & Limited Use

Connecting Google Calendar is optional. When you connect it, HeyAlex requests a single, narrow scope: https://www.googleapis.com/auth/calendar.events. That scope is used only to read your existing events (so the app can show your day and warn you about overlaps) and to create, update, or delete the specific events you ask HeyAlex to schedule or reschedule. HeyAlex does not request access to your Gmail, Drive, Contacts, Photos, or full calendar settings, and does not create, delete, or share calendars.

You can disconnect Google Calendar at any time in Settings, which deletes the stored tokens immediately, and you can also revoke access from your Google Account permissions page. Calendar data pulled in for display is cached only as long as needed to render your views and is deleted with your account.

HeyAlex's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. We do not use, transfer, or sell Google user data — raw, aggregated, or derived — to develop, train, or improve any generalized or foundational AI/ML models, and we do not transfer Google user data to any third-party AI/ML service for those purposes. Any AI features in HeyAlex run only on the text you explicitly send to HeyAlex, on a no-training basis, and the AI provider is contractually prohibited from training on that data.

How we protect your data (security measures)

  • Encryption in transit: all traffic to the app, our database, and Google APIs uses HTTPS/TLS 1.2+.
  • Encryption at rest: the database and backups are encrypted at rest (AES-256).
  • Extra protection for sensitive tokens: Google OAuth access and refresh tokens are additionally encrypted at the column level with an application key (pgp_sym_encrypt) that is stored separately from the database, so tokens are unreadable even to someone with raw table access. Tokens are never sent to the browser and never logged.
  • Per-user isolation: every table enforces row-level security so a signed-in account can only read and write its own rows.
  • Least privilege access: only the requested narrow scope is used; server-side secrets are held in an encrypted secret store, and administrative access is limited to the operator of Behemoth Ventures, LLC using multi-factor authentication.
  • Deletion: disconnecting Google removes the stored credentials, and deleting your account permanently removes your captures, tokens, and synced calendar references.

Data retention & deletion

Your captures are kept until you delete them. You can remove your phone number in Settings at any time, which stops all messaging. To delete your account and all associated data, email support@heyalex.app from your account address and we will erase it.

Contact

Questions about this policy? Email support@heyalex.app.