HeyTheo

Reference

Access and privacy

What a connected app reaches, what it never sees, and how to end its access.

How signing in works

You sign in on HeyTheo's own page — never inside the AI app. HeyTheo then gives the app a key of its own, scoped to your account and to nothing else.

That key expires and is renewed quietly in the background while the connection is live. When you disconnect, the renewal stops, so the app is locked out within the hour and cannot come back unless you approve it again.

What it can and cannot do

It can

  • Read and manage your alerts, and read your Inbox
  • Create, change and delete your baskets
  • Read and update your watchlist
  • See your open ideas and your closed history
  • Read and change your strategies and their trade setups

It cannot

  • See your password, or sign in as you anywhere else
  • Reach anybody else's account
  • Change your plan, your billing or your email address
  • Read your conversations with Theo
  • Pull HeyTheo's market data, fundamentals or screener as a feed
It can change things, not just read them. That is the point — it does what you can do. But an AI can misread an instruction, and deleting a basket or a strategy cannot be undone. Connect apps you trust, and be deliberate when you ask one to delete something.

What HeyTheo sees

The request your AI app sends, and nothing around it. We receive “list this person's open ideas”; we do not receive the conversation it came from, and we have no way to read it.

Disconnecting an app

  1. 1
    In HeyTheo, open Settings → Connected apps.
  2. 2
    Find the app. Each is listed by the address it signs in through, with the date you approved it.
  3. 3
    Press Disconnect and confirm.

Access ends within the hour. Nothing in your account is removed — your alerts, baskets and ideas are untouched — and your other connected apps are unaffected.

Deleting your HeyTheo account disconnects every app as part of that, and the permissions behind them are destroyed rather than archived.

Why apps are named by their address

In Connected apps, and on the screen where you press Allow, an app is identified by the web address its sign-in is delivered to — claude.ai, for instance. The name it gave itself is shown underneath, smaller.

That is deliberate. Any app can call itself “Claude”; the address has to be one it registered and can actually receive on. So the address is the part worth trusting, and it is the part we put first.