Short version: We collect as little as possible. Guests leave almost no trace. Registered members share an email and a few profile details. We do not sell your data. Advertising and analytics cookies only load if you accept them. You can delete your account and data at any time, and you can change your cookie choice whenever you like.
Heeyyo ("we", "us", "the Platform") is an anonymous chat, video and messaging platform operated from Belgrade, Serbia. We are the data controller for the personal data described in this Policy. This Policy explains what data we process, why, on what legal basis, who we share it with, how long we keep it, and the rights you have.
Because we offer our service to people in the EU/EEA and UK, the EU General Data Protection Regulation (GDPR) and the UK GDPR apply to that processing. Heeyyo is established outside the EU/EEA; under Article 27 GDPR we are appointing an EU representative, and until that appointment is published you can reach us directly on any data-protection matter at the contact below.
Privacy contact: hello@heeyyo.com
We do not link guest sessions to a real identity. Guest nickname data is kept only in your own browser session and is cleared when the session ends.
If you register using "Continue with Google" or "Continue with Facebook", that provider sends us a limited set of data so we can create your account — typically your email address, a provider account identifier, and (where available) your display name and profile picture. We do not receive your password. Your use of those providers is also governed by their own privacy policies.
To keep early conversations lively, some chat participants are AI characters operated by Heeyyo (for example our hosts), not real people. When you talk to an AI host, the text of those messages is sent to our AI provider (Anthropic) to generate a reply. We do not send your email or account identity to the AI provider for this purpose, and these messages are not used to make any decision that has a legal or similarly significant effect on you. Please avoid sharing sensitive personal information with AI hosts.
Under the GDPR we must have a legal basis for every use of your data. The table below sets out what we do and why.
| What we do | Legal basis (GDPR Art. 6) |
|---|---|
| Run the Platform and provide chat, video, private messaging and profiles to registered members | Performance of a contract (Art. 6(1)(b)) |
| Let guests use the public chat without an account | Legitimate interests (Art. 6(1)(f)) — providing the service you came for |
| Authenticate accounts, keep sessions secure, and prevent spam, fraud and abuse | Legitimate interests (Art. 6(1)(f)) — security and integrity of the service |
| Moderate content and act on reports of abuse or illegal content | Legitimate interests (Art. 6(1)(f)) and, where applicable, legal obligation (Art. 6(1)(c)) |
| Process token purchases and keep transaction records | Performance of a contract (Art. 6(1)(b)) and legal obligation for accounting/tax (Art. 6(1)(c)) |
| Send service emails (e.g. sign-in, password reset, account notices) | Performance of a contract (Art. 6(1)(b)) |
| Send marketing or product-update emails | Consent (Art. 6(1)(a)) — you can unsubscribe anytime |
| Load analytics and advertising cookies/pixels (Meta, TikTok) | Consent (Art. 6(1)(a)) — only after you click "Accept" |
| Respond to legal requests and protect our legal rights | Legal obligation (Art. 6(1)(c)) / legitimate interests (Art. 6(1)(f)) |
We do not sell, rent, or trade your personal data, and we do not carry out automated decision-making that produces legal or similarly significant effects on you (GDPR Art. 22).
We use three categories of storage and tags:
localStorage / sessionStorage used to keep you signed in and to remember your nickname, theme and cookie choice. These are required for the site to work and do not need consent.You can change your decision at any time using the Cookie Settings link in the footer, which re-opens the consent banner.
We use a small number of trusted service providers ("processors") to run Heeyyo. They process data only on our instructions and under contract. We do not share your data with anyone else for their own marketing.
| Provider | What it does | Location | Privacy policy |
|---|---|---|---|
| Supabase | Database, authentication and file storage (your account and content live here) | EU / US | link |
| Vercel | Website hosting, CDN and privacy-friendly analytics | US | link |
| LiveKit | Real-time video and audio for private rooms and streams (not recorded) | US | link |
| Brevo | Sending account and (with consent) marketing emails | EU (France) | link |
| Anthropic | AI model that powers replies from our AI hosts | US | link |
| CoinGate / NOWPayments | Crypto payment processing for token purchases (no card data reaches us) | EU | link |
| "Continue with Google" sign-in and web fonts | US | link | |
| Meta (Facebook) | "Continue with Facebook" sign-in and, with consent, the Meta Pixel | US | link |
| TikTok | With consent, the TikTok advertising Pixel | US / EU | link |
| Web3Forms | Delivers abuse/report submissions to our team by email | US | link |
We may also disclose data where we are legally required to do so, or to protect the safety of our users and the public.
Some of our providers are located outside the EU/EEA, including in the United States. Where we transfer personal data internationally, we rely on appropriate safeguards under GDPR Chapter V — primarily the European Commission's Standard Contractual Clauses and, where applicable, the providers' certification under the EU–US Data Privacy Framework. You can request more information about these safeguards using the contact details below.
We keep data only as long as we need it, and our servers automatically delete most content on a short schedule:
If you are in the EU/EEA or UK, you have the following rights over your personal data. These rights are also offered to all Heeyyo users regardless of location.
To exercise any of these rights, email hello@heeyyo.com. We aim to respond within 30 days and will not charge you for reasonable requests. If you believe we have mishandled your data, you have the right to lodge a complaint with your local data protection authority (in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection; in the EU/EEA, your national authority; in the UK, the ICO).
We protect your data with industry-standard measures including encrypted connections (HTTPS), hashed passwords via our authentication provider, row-level database access controls, and trigger-based protection of sensitive account fields. No system is ever completely secure; if you discover a vulnerability or suspect a problem, please tell us at hello@heeyyo.com.
Heeyyo is strictly for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn that a minor has used the Platform, we will delete their data and ban the account.
We may update this Policy as the Platform evolves. We will change the "Last updated" date above, and for material changes affecting registered members we will send an email notice. Continued use after an update means you accept the revised Policy.
For privacy questions, to exercise your rights, or to report a concern: