Privacy Policy

heuretika makes local-first software for researchers. We apply the same idea to this website: collect as little as possible, keep it for as short a time as possible, and never sell it.

The short version

• Our apps don't send your documents anywhere. Your files stay on your computer.
• The website collects only what the waitlist needs: your email, the product you're interested in, your language, a few optional answers, where you came from, and a scrambled (hashed) version of your IP address to stop spam.
• No analytics, advertising or social-media trackers, and no tracking cookies. If you arrive through a link with a referral code, we store that code with your sign-up (details below).
• We never sell or rent your data, and we only share it with the few providers that help us run the site.
• You can unsubscribe, see, correct or delete your data at any time by writing to hello@heuretika.com.

Who is responsible

The controller of your personal data is Alex Ojeda Copa (heuretika), Cochabamba, Bolivia. Contact for anything about privacy: hello@heuretika.com. Since heuretika is a one-person business, the person who reads that inbox is the person who answers for your data.

Our apps

Academic Studio and our other apps are local-first: your documents, notes, references and projects stay on your device, and the apps don't send them to us. The apps have no telemetry.

In the future, paid apps will contact our servers for two things only: to activate or check a licence, and to look for updates. That will involve the licence key, the app version and operating system, and the IP address your connection uses, never the content of your files. We'll update this policy, and the app will tell you, before that starts.

What the website collects, and why

What	Why	Legal basis	How long
Waitlist sign-up: email address, the product you chose (or heuretika in general), your language, and, if you answer them, your role (e.g. PhD student, librarian) and the writing tool you use now. We also record that you gave consent and when, and, if the page you signed up on was reached through a link with a referral code or campaign tags (?ref=, utm_…), that code and the name of the website that sent you.	To email you about that product: launch, early access, founding price, important updates. Your optional answers help us decide what to build first.	Your consent.	Until you unsubscribe or ask us to delete it. At the latest, we delete it 24 months after the product you chose launches, or 36 months after you signed up, whichever comes first.
Where you came from: a referral code (ref), campaign tags (utm_source, utm_medium, utm_campaign) and the domain of the website that linked to us, if any.	To know which channels bring people to the waitlist, so we spend our time where it works.	Our legitimate interest in understanding our own reach, within the consent you give when you sign up.	Kept with your sign-up and deleted with it.
Anti-abuse: a one-way, salted hash of your IP address (we never store the address itself), and a bot check by Cloudflare Turnstile, which receives your IP address and technical browser signals.	To stop spam, fake sign-ups and attacks.	Our legitimate interest in keeping the list clean and the site secure.	We delete the hash after 90 days. Cloudflare's own retention is described in its Turnstile privacy addendum.
Server logs: IP address, browser, page requested, date and time.	Security and fixing errors.	Our legitimate interest in running a secure site.	Deleted automatically as the logs rotate by size, usually within a few weeks.
Emails you send us.	To answer you.	Our legitimate interest in replying (or steps you ask us to take before a purchase).	As long as the conversation needs, and no more than 24 months after it ends.

When sales open, a purchase adds one more category:

What	Why	Legal basis	How long
Purchase data we receive from our reseller: name, email, country, product, order number, price, licence key, and company name or tax ID if you give them. Your card or bank details stay with our reseller; we never see them.	To deliver and manage your licence, provide support and handle refunds, and keep the records the law requires.	Performance of our contract with you, and our legal obligations.	While your licence is in use, and afterwards for the period required by tax and accounting law.

A hashed IP address is still personal data under some laws (such as the EU's GDPR), so we treat it as such.

We don't use your data for profiling or automated decisions, and we don't combine it with data from other sources.

Who we share it with

Only with providers that help us run the site, and only what each one needs:

• Hostinger: hosts our server and database. The server is located in Campinas, Brazil.
• Cloudflare, Inc.: provides the Turnstile bot check. Cloudflare processes these signals on our behalf to detect bots, and also, as an independent controller, to improve Turnstile. See Cloudflare's Turnstile Privacy Addendum.
• Email providers: the service that forwards hello@heuretika.com and our mailbox provider receive the messages you send us. If we use an email delivery service to send waitlist emails, we'll name it here before the first mailing.
• Our reseller (Merchant of Record): from the moment sales open, it is the Merchant of Record for our orders and the independent controller of the data you give it at checkout. We will name it and link its privacy notice here before sales open.
• Professional advisers (such as an accountant or lawyer), under a duty of confidentiality, and authorities when the law requires it.

We never sell, rent or trade your data, and we don't share it with advertisers.

Where your data is processed

We operate from Bolivia, our server is in Brazil, Cloudflare works through a global network, and our reseller processes data in the countries listed in its own notice. These countries may not offer the same level of protection as the one where you live. Where it applies, our providers' data processing terms include safeguards such as the European Commission's standard contractual clauses. Wherever you are, we apply this policy in full.

Cookies and similar storage

We don't use analytics, advertising or social-media cookies. This is everything the site stores in your browser:

Name	What it does	How long
NEXT_LOCALE	Remembers the language you're reading the site in.	Until you close the browser or change language
theme (local storage)	Remembers whether you chose light or dark mode.	Until you clear it
Cloudflare Turnstile	May use strictly necessary browser data while it checks that you're human.	During the check
Session cookie of the admin panel	Only for the people who run the site and log in to it. Visitors never get it.	Until logout or expiry

Your rights

Wherever you live, you can ask us to:

• tell you what data we have about you and give you a copy, including in a reusable format;
• correct it;
• delete it;
• stop or restrict a use of it, or object to it;
• withdraw your consent at any time (for example, by unsubscribing). This doesn't affect what we did before.

Write to hello@heuretika.com from the address you signed up with. We'll answer within 15 days, and always within the time required by the law that applies to you. If we need to confirm your identity, we'll ask only for what's needed.

You can also complain to a data protection authority: in the EU/EEA, the authority of your country; in the UK, the ICO; in Brazil, the ANPD. In Bolivia, the Constitution protects your right to know, object to, correct or delete data about you through the acción de protección de privacidad. We'd appreciate the chance to fix things first.

Security

The site only works over an encrypted connection (HTTPS). We store a hash of your IP address, never the address itself. Access to the waitlist is limited to the person who runs heuretika and to the administrators of the server it runs on. No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities that the law requires us to notify.

Children

The site and the waitlist are not meant for people under 16, and we don't knowingly collect their data. If you think a child has signed up, write to us and we'll delete it.

Changes

If we change this policy, we'll update the date at the top. If a change matters (for example, a new kind of data or a new provider), we'll email people on the waitlist before it applies. We'll never use data we already have for a new purpose without asking you first.

Contact

Alex Ojeda Copa (heuretika), Cochabamba, Bolivia — hello@heuretika.com