Little Heads UpAccount settings

Data and privacy

How we handle your data

Last updated September 27, 2026.

This page describes the current pilot's data handling. The full Privacy Policy and Terms of Service are being finalized; this information does not claim legal certification or replace those documents. Paid subscriptions remain disabled.

What we collect

Your account email and authentication information are handled by Supabase Auth. The workspace stores your app names and origins, monitoring settings, event identifiers and labels, timestamps, selected status/error categories, reported payment amounts and estimated AI usage, outcome summaries, cases, investigation notes and email preferences.

Labels, notes and identifiers can identify people if you put personal information in them. Use opaque references. Do not submit passwords, secret keys, payment card details, prompts, message contents, form values, health information or other sensitive personal information in monitoring events or notes.

What the browser collector observes

The embedded collector can report coarse JavaScript errors, same-origin fetch failures, tagged form steps and actions you choose to track. It does not capture form values, request/response bodies, raw exception messages, stack traces or page recordings. Its random session identifier is held in memory. The Little Heads Up workspace separately stores authentication session information in browser local storage to keep you signed in.

We have not installed advertising pixels in the pilot. Hosting and other infrastructure providers may process connection metadata, such as IP addresses and request information, independently of the event fields we store.

Why we use it and which services help

We use data to authenticate accounts, operate monitoring, investigate cases, send enabled alerts, support users and protect the service.

We do not sell your monitoring data, use it to build advertising audiences, or use it to train AI models. The service does not currently send monitoring data to a generative AI model. “Install with your AI” is a prompt for your own coding assistant; anything you share with that assistant is subject to its separate terms. Hosting regions, international transfer arrangements and provider backup/log retention are still being reviewed for the full policy.

Retention

Raw events are eligible for cleanup after 30 days. The cleanup runs hourly in bounded batches, so an operational backlog can delay removal. This is not a promise that every record disappears exactly on day 30.

Cases, notes, outcome summaries, configuration and delivery records currently remain until removed through account/data administration; they have no separate automatic age-based purge. Account, security, billing and provider records may have different retention requirements. Database cleanup does not erase delivered emails or every provider backup or log.

Your choices and requests

In Settings, you can change email preferences, download selected account/workspace data, request a data copy, request account deletion and check the request status. A request is queued for manual review; it does not immediately delete an account or cancel a subscription.

A download is collected over an interval rather than as one database snapshot. It excludes credentials, internal billing/delivery identifiers and provider-held emails, payment details, logs and backups. A larger or more specific request can be handled through the request process.

Contact hi@littleheadsup.com for access, correction, deletion or privacy questions. We may ask for enough information to verify your authority. Do not email passwords, API keys or payment details. If you are an end user of an app monitored by a customer, contact that app's operator first so they can identify the relevant records.

Monitoring limitations

Monitoring depends on the events your app reports and working infrastructure. Events and alerts may be delayed, incomplete or missed. Missing alerts do not prove that an app is healthy. Cost figures rely on estimates supplied by your app, not verified provider invoices. Keep independent backups and an incident-response process; monitoring is not a substitute for them. Alerts do not automatically repair applications, stop spending, refund payments or retry customer work.