Heft is made by Quietflare and is in a small, invite-only test. This page says what it keeps, where, and who can read it. Questions or requests: contact@quietflare.net.
The person responsible for your data (the controller under the GDPR) is the person named in the Impressum. Contact: contact@quietflare.net.
Heft keeps your account and what is in your Heft to give you the service you signed up for (Art. 6(1)(b) GDPR). It keeps IP addresses for one hour and short request logs to stop abuse and keep the service running, which is a legitimate interest (Art. 6(1)(f) GDPR). It keeps your invite request because you agreed to it (Art. 6(1)(a) GDPR). You can withdraw that at any time by writing to contact@quietflare.net.
You do not have to give Heft any data. Without an email address we cannot send you an invite, and without an invite code you cannot sign in.
Heft keeps the email address you gave, what you said you're learning, and when you agreed to be emailed. It is used once, to tell you when there's a place. Your request is deleted when you are invited, and after twelve months at the latest. Write to contact@quietflare.net and it is deleted sooner. The person running Heft gets a phone notification that someone asked. It is sent through ntfy.sh and carries no email address and nothing you typed. An invite that is never used is deleted thirty days after it runs out.
When you hand in a written answer, Heft compares it with your assistant's model answer using an AI model. The model receives the question, the marking points, the model answer and your answer. It does not receive your name or email address. The check is done by Jev, a model run by TypeSafe AI (api.typesafe.ai), which receives those four things. Heft has no other AI of its own.
Heft never sells your data, shows ads or uses it to train anything.
On Cloudflare's servers (Workers, D1 and KV). Cloudflare, Inc. (USA) runs them as Heft's processor under a data processing agreement. Your data can be processed outside the EU, including in the USA. Cloudflare is certified under the EU-US Data Privacy Framework. Cloudflare keeps short request logs for a few days to run the service, and the database keeps a restore history, so deleted data can remain in that history for up to 30 days before it is gone for good.
Email you send to contact@quietflare.net, and the invite email you get from it, goes through Zoho Mail (Zoho Corporation B.V.), on Zoho's servers in the EU.
Heft keeps your account and what is in it until you delete it.
The app keeps a copy of what you open, your chosen paper and theme, and answers waiting to be sent, so it works offline. Signing out clears it.
Please do not put health details or other sensitive information about yourself or other people into your Heft.
Under Me, then Your data, you can see what Heft keeps, download all of it as one file, delete one subject or delete everything. Deleting takes effect at once. You have the right to see, correct, delete and receive your data, to have its use restricted and to object to its use. For any of these, write to contact@quietflare.net. You can also complain to a data protection authority, for example the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.
Last changed 12 November 2026. Impressum