DRAFT: not yet reviewed by a lawyer; details in [BRACKETS] are still to be filled in.

Privacy Policy

Last updated 2 October 2026 · Version 2026-10-02.2

This policy explains what Heyya stores about you, why, where, for how long, who else receives it, and how you can see, change or delete it. Heyya is a chat and calling app with an AI assistant ("Heyya Assistant") that can browse websites for you. "We" means [LEGAL NAME], who runs Heyya. This is plain-language information, not legal advice.

Short notice

The table below is the same summary you see when you sign up.

• Withdraw consent or delete your account: Settings → Delete account
• Your rights
• Complain (from 13 May 2027 also the Data Protection Board of India)
• हिन्दी में सारांश

1. Who we are and how to contact us

• [LEGAL NAME] ([BUSINESS FORM: SOLE PROPRIETORSHIP / LLP / PRIVATE LIMITED COMPANY]), trading as Heyya, [PRINCIPAL ADDRESS]. Website: [DOMAIN].
• Privacy questions and requests: [PRIVACY EMAIL]

Heyya is offered to adults (18 or over) living in India.

2. What we collect

We collect only what the app needs to work, keep accounts secure, limit costs and meet Indian law.

Your account

• Your email address (used to sign in and so people who know it can send you a message request).
• Your password, stored only as a salted hash (PBKDF2-SHA256, 600,000 rounds). We never store or log the password itself.
• Your recovery code, stored only as a salted hash. It is shown to you once and lets you reset a forgotten password.
• Your plan (free or pro), the time you signed up, when you were last online, your agreement to this policy (version and time), and when you last dismissed the reminder of our rules.
• For a card subscription: the date it renews or ends and whether you cancelled it.
• Login sessions: a SHA-256 hash of each login token and when it was created. The token itself stays on your device.
• A nominee, if you add one (name, relationship, email or phone).

Chats, contacts and calls

• Messages: the chat, sender, text, time, when each message was delivered to and read by each person, edit time and a deleted flag. Messages are not end-to-end encrypted. They are stored as plain text on our server so they can be delivered to your other devices and to the people you write to.
• Contacts, message requests (who asked whom, when, and whether it was declined), blocks, and groups (names, members, roles, join times, read positions).
• Call log: who called whom, audio or video, start, answer and end times, duration and status. Heyya's server never receives or stores call audio or video, and Heyya does not record calls.
• Invites you send: the invite link code, the email address you invited, an optional first message, and when the invite was created and claimed.

Heyya Assistant

• Assistant tasks: the task text you send (up to 4,000 characters), the AI service used, the status, the AI's answer (up to 20,000 characters), token counts and cost.
• Saved memories: short facts about you (up to 200 characters each) taken from finished tasks by the AI, with the task they came from and when they were last used. This only happens if the memory feature is turned on.
• Your own AI service keys, if you save any. They are encrypted on the server and never shown again.
• Connected sites: the sites you signed into through "Connect a site", the time you gave your separate permission to keep each site's login, and the assistant's browser profile for your account (cookies, logins, history and cache of the sites it visited). This profile is a folder on the server computer.
• AI usage counts: one record per AI call (day, time, step or memory, and whether our key or your own key paid for it), used for daily limits.
• Your assistant settings: pinned or removed, whether page screenshots may be sent to the AI, and which AI notices you have read.

Complaints, reports and removed content

• Complaints and reports you send: the ticket number, category, your text, the contact details you give, the dates and the answer.
• When you report a message, a copy of that message; when you report a contact or a group, a copy of the last 20 messages you could see in that chat. This copy lets us check the report.
• Copies of content removed under our rules or a legal order, and the record of that action (who decided, why and when).

Security and technical data

• The security log: sign-ups, sign-ins (successful and failed), blocked attempts, password and recovery-code events, sign-outs, account deletion, data downloads, consent changes, connected-site changes and operator actions, with the time (India time), your account number and your IP address. It never holds passwords, messages or task text.
• The deleted-account record: when an account is deleted we keep only its email address, the dates it was created and deleted, and its account number, for 180 days, as Indian IT rules require.
• Security counters for sign-in, sign-up, password reset, promo code and contact lookup limits: keyed hashes (HMAC) of your email address and IP address with a time. They never contain the address itself.
• Your privacy switches (last seen and online, read receipts).
• The server console shows each web request's method, path (without the part after "?") and status code; request contents (passwords, messages, task text, keys) are never logged. The server console shows no IP addresses. The security log above is kept in the database, not in the console.

We do not use analytics, advertising, trackers, third-party fonts or your location.

3. Sensitive data

• Passwords and recovery codes are stored only as PBKDF2 hashes.
• Logins of sites you connect are stored only with your separate permission, given each time you connect a site. You can remove one site ("Forget this site" in Settings) or all of them ("Disconnect all sites").

4. Why we use it

• Running your account, chats, groups and calls.
• Doing the assistant tasks you ask for.
• Safety and abuse prevention: reports, moderation, limits on sign-ups and sign-ins.
• Security: the security log required by CERT-In directions.
• Billing for Heyya Pro.
• Answering your complaints and requests.
• Complying with Indian law: the IT Rules, CERT-In directions, and court and government orders.

We rely on your consent; you can withdraw it by deleting your account. Heyya is offered only to adults living in India, as the Terms say.

5. Who receives what

AI services (only when you give Heyya Assistant a task)

• Google Gemini (the default, generativelanguage.googleapis.com) receives, at every assistant step: your task text, the address of the page the assistant has open, up to 60 buttons, links and fields on that page with short labels, the list of its earlier actions in the task, and a full screenshot of the page. If you connected a site, the screenshots and page text can show your account pages, for example your email address or inbox.
• If a Gemini model is busy or unavailable, the same request goes to the next Google Gemini model in this fixed list: gemini-3.8-flash, gemini-3.6-flash, gemini-3-flash-preview, gemini-3.1-flash-lite-preview.
• Google keeps requests, screenshots and replies for up to 55 days to detect misuse, and authorised Google staff may review flagged content.
• Anthropic (api.anthropic.com) receives the same, screenshots included, only when we configure it and you pick it. Anthropic deletes it after 30 days by default.
• OpenRouter (openrouter.ai) receives the same without screenshots, only when we configure it and you pick it, and passes it to a company that hosts the chosen model (by default deepseek/deepseek-chat).
• If you turn off "Send page screenshots to the AI" in Settings, no screenshots are sent to any AI service.
• When the memory feature is on, up to 5 saved facts about you are added to the task text, and after a finished task the task text and the answer are sent once more to pick out new facts.
• The AI services do not receive Heyya's own records of your chats, contacts or calls. They do receive whatever the assistant's browser shows them.
• Before your first task with each AI service, Heyya shows you a notice saying exactly this, and the task only runs after you tap "I understand".
• If you saved your own key for that AI service, the request runs on your account with that service. Otherwise it runs on ours.

Free-tier AI keys. Heyya is in testing on Google's free Gemini service: Google may use requests and screenshots to improve its products, and human reviewers may read them. That would include screenshots of pages you are signed into. Heyya will move to the paid service before it opens to the public.

Websites the assistant visits

The assistant's browser runs on our server and visits the sites the AI chooses for your task, from the server's internet connection, using the cookies of the sites you connected. Those websites see these visits as they would see any browser. Heyya Assistant never opens banking, payment, wallet, tax or government websites.

Payments (only when card payments are on)

Stripe receives your Heyya user number, the price and the return addresses, and tells us your subscription status. You type your card details on Stripe's own page; Heyya never sees them. Heyya stores the Stripe customer and subscription identifiers so a cancellation or failed payment can end the pro plan.

Calls

• To set up a call, your browser contacts Google's STUN server (stun.l.google.com), which sees your device's public IP address.
• The person you call sees your IP address while the call is set up, unless you turn on "Relay calls through the server" in Settings. That option appears only when a TURN relay server is running; the relay then carries the call's encrypted audio and video.
• Call audio and video go directly between the devices (encrypted by the browsers) or through that relay. They never pass through or get stored on Heyya's server.

Hosting and email

• Hosting provider: [HOSTING PROVIDER] ([HOSTING COUNTRY]). It runs the server that holds everything above.
• Email provider: none. Heyya sends no email.

Other people in Heyya

• Anyone who knows your email address can send you a message request with one first message. They cannot see when you are online, call you or keep writing until you accept.
• Your contacts and the members of your groups see your email address, and (if you share it) your last seen and online status and read receipts.
• If someone invited you: the email address they typed and their optional first message are kept until 30 days after the invite was used or expired.

Authorities

Government agencies or courts, only when Indian law requires it, for example a written order under the IT Rules or the IT Act (requests go to [LEGAL EMAIL]).

We never sell your data. No ads, analytics or trackers.

6. Transfers outside India

Google (and Anthropic or OpenRouter if used) and Stripe may process data outside India. Google acts under its data-processing terms on its paid service; Stripe under its own terms. No country is restricted by the Government of India for such transfers today.

7. Your rights and how to use them

• See and take your data: Settings → Download my data gives you a JSON file with your account, settings, contacts, blocks, requests, chats with the messages you can see, call log, assistant tasks, memories, connected sites, AI usage, sent invites, your complaints and reports, your nominee, your own security-log entries and the list of who receives your data. Saved AI keys appear only as "saved", never their value.
• Correct your data: to change your email address, write to [PRIVACY EMAIL].
• Delete your account: Settings → Delete account (asks for your password). This removes your account and every record about you: your one-to-one chats (for both people), your messages in groups, your call log, assistant history, memories, AI keys, sessions, counters and the assistant's browser profile. An active paid subscription is cancelled with Stripe first. It cannot be undone. Afterwards we keep only the deleted-account record, complaints and the security log, for the periods in section 8.
• Delete parts: in a chat, "Delete for me" (any message), "Delete for everyone" (your own messages, within 48 hours), "Clear chat", "Leave group" and "Block". In the Calls tab, delete single calls or clear the log. In Task history, delete single tasks; in Settings, "Delete assistant task history". In "What Heyya remembers", delete one or all memories. In Settings, "Forget this site" for one connected site.
• Control sharing: Settings → "Last seen and read receipts"; "Send page screenshots to the AI" (text-only assistant); "Disconnect all sites"; "Relay calls through the server" (when offered).
• Security: Settings → Change password, Get a new recovery code, Sign out everywhere.
• Withdraw consent: delete your account. Data already sent to an AI service while you used the assistant is governed by that service's terms.
• Nominee: Settings → Account → Nominee. You can name someone who can use these rights for you if you die or cannot act yourself. The Indian data protection law gives this right from 13 May 2027; Heyya offers it now.
• Complain: use the Contact page or Settings → Help & legal → Make a complaint.
• Guardians of persons with disabilities who need to act for them can ask through [PRIVACY EMAIL].

Response times

• Acknowledgement: at once on screen with a ticket number (at most 24 hours for a complaint by email or phone).
• Complaints are resolved within 7 days.
• Requests about your data are answered within 30 days.

If you are not satisfied

• For decisions about content, you can appeal to the Grievance Appellate Committee (gac.gov.in) within 30 days of our decision.
• For consumer complaints: the National Consumer Helpline (consumerhelpline.gov.in, 1915).
• From 13 May 2027, you can complain to the Data Protection Board of India after using our grievance process.

8. How long we keep it

An automatic clean-up runs when the server starts and every 24 hours.

Login sessions

30 days after you sign in, or earlier when you log out, use "Sign out everywhere", or change or reset your password.

Security counters

24 hours.

Invites

Invite links expire 7 days after they are made. An invite record is deleted 30 days after it was claimed, or 30 days after it expired.

Assistant tasks

180 days, then deleted (a task that is still running is kept until it ends). When you delete a task, its text and answer are erased at once; an empty record (time, AI service, status) stays for 2 days so the daily limits cannot be reset by deleting.

Call log

365 days after the call started.

Message requests

A request nobody answered is deleted after 90 days, together with the requester's unanswered chat and its message. A declined request is deleted 90 days after it was declined, together with the requester's one-person chat and its message.

Messages everyone removed

A message that every member of a chat has deleted for themselves or cleared is deleted from the server.

AI usage counts

35 days.

Payment event records

30 days (Stripe event identifiers, used to ignore repeated notifications).

Assistant browser profile

Deleted 180 days after it was last used, when you choose "Disconnect all sites" (or forget the last connected site), or when you delete your account.

Security log

365 days (1 year), on the server in [HOSTING COUNTRY].

Deleted-account record (email, sign-up and deletion dates, account number)

180 days after deletion.

Content removed under our rules or a legal order, with its record

180 days (longer only if a court or authority requires it).

Complaints and reports

3 years after they are closed; the copy of reported messages is erased 180 days after closing.

Accounts found to belong to someone under 18

Closed at once and deleted.

Nominee

Until you remove it or delete your account.

Site-login permissions

Until you forget the site.

Google's abuse-monitoring copies

Up to 55 days (on Google's side).

Backups

Only if backups are set up. The included backup tool keeps the 14 most recent copies by default; deleted data stays in older backups until they are replaced.

Kept until you delete them

Your account, messages (a message deleted for everyone keeps no text), contacts, blocks, groups, saved memories and saved AI keys.

9. What is stored on your device

Heyya sets no cookies. In your browser's local storage it keeps:

• your login token (heyya_token), your user number and email address;
• your chat list (with your contacts' email addresses and each chat's last message) and the last 50 messages of up to 20 chats, so chats open instantly and work offline;
• messages waiting to be sent, drafts, a pending invite link, and the time of your last assistant task;
• a "pending logout": a login token from a logout made while offline, kept only until the server confirms that session is ended;
• the renewal date of a subscription reminder you closed (heyya_renew_dismissed), so the same reminder does not come back;
• your ringtone, language and call-relay settings.

Everything except the ringtone, language and call-relay settings is removed when you log out or when your session ends. The app's offline cache holds only the app's own files and these legal pages, never your data. The browser asks for your camera and microphone only when you start or answer a call. Log out on shared devices.

10. Security

• Hashed passwords (PBKDF2-SHA256, 600,000 rounds), hashed login tokens and recovery codes, and encrypted saved AI keys.
• Limits on failed sign-ins, sign-ups, password resets and promo code guesses, kept across server restarts, and daily limits on AI use.
• The security log described in section 2.
• A strict Content Security Policy (the app loads nothing from other sites), and HTTPS with HSTS on the public server.
• Message requests: strangers cannot call you, see when you are online or keep messaging you until you accept.
• On every site, Heyya Assistant waits for your tap before paying, buying, sending, deleting, accepting terms or typing a password or card number. On sites you connected it also asks before every typing step and every submit click. Other sensitive steps elsewhere are blocked unless you allow them for that one task. It never solves CAPTCHAs.
• We report qualifying cyber incidents to CERT-In within 6 hours.

If a breach affects your data we will tell you and, from 13 May 2027, the Data Protection Board, as the law requires. No system is perfectly secure.

11. Children

Heyya is only for people aged 18 or over who live in India. By creating an account you confirm that you are 18 or over. Heyya does not check your age at sign-up. If we learn that an account belongs to someone under 18, we close it and delete its data. If you think someone under 18 is using Heyya, please contact us.

12. Moderation and the law

• We can remove content or disable accounts and groups that break the Terms or the law.
• We act on complaints about private or sexual images (including morphed ones) and impersonation within 2 hours, on other requests to remove unlawful content within 36 hours, and on court or government orders within 3 hours.
• We answer lawful requests from authorities within 72 hours of a written order.

13. Changes to this policy

The version at the top changes whenever this policy changes. When it changes, Heyya asks you to read and agree to the new version. Every 90 days Heyya also reminds you of our rules, with links to this policy.

14. Languages

This policy is in English, with a Hindi summary below. The English text prevails if they differ.