Last updated: 23 October 2026. This app helps families share the organisation around their children and around relatives they help care for.
Die Software Zimmerer Matthias Gattringer e.U.
Owner: Matthias Gattringer
Lobmeyrgasse 5/2/42, 1160 Vienna, Austria
Contact: office@heyshary.com
You enter the data yourself: names and dates of birth of the children and, if you add any, of relatives, optionally health data (allergies, blood type, vaccinations), insurance and emergency contact details, tasks, appointments, shopping and meal plans, birthdays, medication entries, clothing sizes as well as, optionally, photos of documents. Each device gets a random access token; there is no account and no password.
You may voluntarily store a recovery address (email). It serves one purpose only: getting you back into your household if all devices are lost. We use it for nothing else, we do not pass it on, and we store it encrypted. You can remove it in the app at any time. Without this voluntary entry we process no email address of yours at all.
The processing serves solely to synchronise this data between the devices of one household and to send reminders. The legal basis is your consent and the performance of the function you asked for (Art. 6(1)(a)/(b) GDPR). Health data (Art. 9 GDPR) is processed only on your explicit entry.
This website loads no third-party fonts. The font it uses is delivered directly from our server in Austria, and no data is transferred to Google or to any third party in the process.
If you send something through "More - Report a problem" in the app, we process your text, the contact address you voluntarily provide, your support ID and the app and system version of your device. The text is stored encrypted and additionally emailed to our support mailbox so we can react to it. We delete the report once the matter is settled. Please do not write health data into it that we do not need in order to help.
So that a change reaches your device quickly, our server sends an empty wake-up signal to the app. It contains no text, no sound and no hint about the content. It only tells your device to fetch the new state, which the app then fetches from us.
This signal is delivered through Firebase Cloud Messaging by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and on iPhone additionally through the Apple Push Notification Service by Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland. Your device receives a random token for this, which we store for as long as that device belongs to your household. If it leaves the household or is deleted, the token goes with it.
Your reminders are created on your device. The app schedules them itself from the data it holds; we do not send them to you. Google and Apple therefore learn neither what you are reminded of nor that you are reminded at all.
The basis is performance of our contract with you (Art. 6(1)(b) GDPR): a shared state between two devices is the function heyshary exists for. Processing in the USA is possible and relies on the European Commission's standard contractual clauses.
heyshary is sold through the App Store (Apple) and Google Play. The purchase contract is with the respective store, not with us. We only learn that a purchase took place and what kind of access it covers, but no payment details, no address and no name. How Apple and Google process your data is set out in their own privacy policies.
So that you find out when a newer version is available, the app asks for the current version number at startup.
The basis is our legitimate interest in you not running an outdated version (Art. 6(1)(f) GDPR).
When you dictate something, your device's speech recognition converts it to text. Depending on the device and its settings, this happens on the device itself or on the manufacturer's servers, meaning Google (Android) or Apple (iPhone). We cannot influence this, and we are not told which one happened.
What may reach the manufacturer is the speech itself. If you would rather avoid that, type instead of dictating. Either way, we only receive the finished text, exactly as if you had typed it.
You can also use heyshary on a computer at heyshary.com/web. There is no password: the browser shows a QR code, you scan it with the app on your phone, and the browser is signed in as one of your devices.
Dictating in the browser uses the browser's own speech recognition. Chrome and Edge send the speech to Google or Microsoft for this, Firefox does not support it. Here too: if you would rather avoid that, type.
The basis is the performance of our contract, meaning that you can use heyshary where you want to (Art. 6(1)(b) GDPR). The key in the browser is strictly necessary for this.
Under "More" you can also show your appointments in your phone calendar. This is off until you turn it on yourself. We then create a secret link that your calendar provider fetches regularly: Google from its own servers, the iPhone from the device or through iCloud.
What reaches the calendar provider: title, start, end and place of your household's appointments, plus the name of the child, relative or pet an appointment belongs to. Notes are not included. What the provider does with this is governed by its terms, not ours.
You can end the subscription in the app at any time or create a new link. The old link then returns nothing. For this we only store the link and the time it was last fetched. The legal basis is your consent (Art. 6(1)(a) GDPR).
Under "More" you can show one of your own calendars, for example from Google, Outlook or iCloud, inside heyshary. This is off until you enter a calendar address yourself. We then store only that address, encrypted, and when it was last fetched. Our server fetches the appointments from the calendar provider when needed, shows them to you and keeps them in memory for at most 15 minutes. They are not stored in our database.
The calendar you add is only visible on the device where you added it, not to the others in your household. You can remove it at any time, and we then delete the address. The legal basis is your consent (Art. 6(1)(a) GDPR).
Under "More" you can choose a place for weather tips. This is off until you search for a place yourself. For the search, our server sends the search term to OpenStreetMap's place search (Nominatim, OpenStreetMap Foundation, United Kingdom). We then store the place name and the coordinates rounded to 0.1 degrees (an area of about ten kilometres), encrypted and for the whole household. Our server fetches the forecast for these rounded coordinates from the Norwegian weather service MET Norway (api.met.no) and keeps it in memory for 30 minutes. Neither service ever sees your device, your IP address or an address, and your children's names and ages never leave our server: the clothing tips are worked out by our server itself. You can turn weather tips off at any time, and we then delete the place and coordinates. The legal basis is your consent (Art. 6(1)(a) GDPR).
Our server keeps access logs, as every web server does. They contain the date and time, the address requested, the status code, the referring page and the browser or app identifier. The IP address is stored truncated: the last part is removed, so the device can no longer be identified. Logs are deleted automatically after 30 days and serve only operations and troubleshooting.
To prevent mass guessing of access links, the server also remembers briefly, in memory, how many requests come from one IP address. This is never written to disk and disappears by itself. The basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).
The data is held on a server in Austria and is transmitted exclusively encrypted (HTTPS). Each household sees only its own data. There is no advertising.
In addition, the content is stored encrypted in the database (AES via Fernet): names, appointments, tasks, shopping, packing and meal lists, notes, gift ideas, allergies, blood type, vaccinations, medication, and insurance and ID details. The key is not kept in the database. Only what the server has to calculate, sort or compare with stays unencrypted: dates and times, dates of birth (for the age-based reminders), sex, height and weight from the growth chart, categories, status and technical identifiers (for vaccinations from the schedule, this includes the reference to the schedule entry). Uploaded documents are stored encrypted as well.
The data stays stored until you delete it. In the app, under "More - Delete all data", you can remove the entire household including all content and files at any time and permanently. A single child or relative is deleted from the profile's edit form; what goes with it and what stays without the name is described under Delete your data.
Access, rectification, erasure, restriction, data portability and objection under the GDPR. Please use the contact address above.
If you believe we are not processing your data lawfully, you can lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
The German version at heyshary.com/privacy is the authoritative one.