Privacy Policy

What we collect

When you sign in

• Your email address, to send you sign-in codes and identify your account.
• One-time sign-in codes, which we store only in hashed form. They expire after 5 minutes.

What you add to your page

• Your username, name, bio, location, photo, links and posts, including drafts.

When you use HEYHEY

• For each signed-in session: your IP address, your browser's user agent, and when the session started and expires. We use these to keep you signed in and to protect your account.
• Request counters tied to your IP address or account, to limit abuse. They expire within minutes.
• Server logs, such as errors and request details, to keep the service running and fix problems. They're kept for a short time, usually no more than 7 days.
• When you sign in or change your email, a bot check by Cloudflare Turnstile. It reads technical signals from your browser and device to tell people from bots.

We don't collect payment details, contacts, or precise location.

What's public

Your page and published posts are public by design: your username, name, bio, location, photo, links and published posts can be seen by anyone, indexed by search engines, and shown in previews by other sites and apps. Your email address and drafts are never public.

How we use it

• To run HEYHEY: create your account, sign you in, and show your page.
• To keep it safe: prevent spam, abuse and fraud, and enforce our Terms of Service.
• To contact you about your account, such as sign-in codes and important changes. We don't send marketing emails.
• To meet legal obligations.

If you're in the European Economic Area, the UK or Switzerland, our legal bases are: performing our contract with you (running your account and page), our legitimate interests (security, abuse prevention and improving the service), and legal obligations.

Who we share it with

We don't sell or rent your personal information, and we don't share it for advertising.

We use a few service providers that process data for us, under contracts that limit how they use it:

• Cloudflare, for hosting, content delivery, storing photos, sending email, bot protection (Turnstile) and logs.
• PlanetScale, for our database.

Posts can include GIFs from GIPHY. They load straight from GIPHY's servers, so when you view one, GIPHY receives your IP address and browser information, and handles them under its own privacy policy. We don't tell GIPHY which page you're on.

We may also share information:

• if the law requires it, or to respond to valid legal requests;
• to protect the rights, safety or property of our users, the public or HEYHEY;
• as part of a merger, acquisition or sale of assets, in which case this policy keeps applying to your information.

Where it's stored

Our servers and database are in the United States, and our providers may process data in other countries. If you use HEYHEY from outside the US, your information is transferred to and stored in the US. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep it

• Your account and content: until you delete them or your account.
• Sessions: until you sign out or they expire.
• Sign-in codes: until used, or for 5 minutes.
• Abuse counters: a few minutes.
• Logs: usually up to 7 days.

When you delete your account, we delete your profile, links, posts and photos from our live systems right away. Copies in backups are overwritten on a rolling schedule, generally within 30 days. We can't remove copies other sites or search engines made of your public page.

Cookies

We use essential cookies to keep you signed in. Cloudflare may set cookies needed for security and bot protection. We don't use analytics, advertising or tracking cookies.

Your choices and rights

• You can see and change your profile, posts, username and email address at any time, and delete your account in your account settings.
• Depending on where you live, you may have the right to access, correct, delete or get a copy of your personal information, to object to or restrict how we use it, and to withdraw consent. To use these rights, email hey@goodmen.ventures. We'll respond within the time the law requires, and we won't treat you differently for asking.
• If you're in the EEA or the UK, you can also complain to your local data protection authority.
• California residents: we don't sell or share personal information as the CCPA defines those terms, and we don't use sensitive personal information to infer characteristics about you.

Children

HEYHEY is only for people 18 and older. We don't knowingly collect information from anyone younger. If you believe a minor has an account, email us and we'll delete it.

Security

We protect your information with encryption in transit, hashed sign-in codes, and limited access to our systems. No service is perfectly secure, so we can't guarantee absolute security. If you think your account was compromised, contact us right away.

Changes

We may update this policy. If a change matters, we'll tell you before it takes effect, by email or on the site.

Contact