Privacy Policy

Last updated September 23, 2026

This is a translation of the Portuguese version, provided for your convenience. If the two differ, the Portuguese version prevails.

This policy explains what data Heeey (heeey.click) processes and why. The data controller is Carlos Santos, who runs Heeey. Contact for any privacy matter: contato@heeey.click.

1. Data we process

• Email, when you create an account, to send you the sign-in link and identify the account.
• Board content (drawings, text, uploaded images, title and version history).
• The name and cursor color you choose, shown to the people on the same board.
• Usage data: pages visited and app events (for example, “account created”), tied to a random identifier, never to your email. We don't record sessions or what you type.
• Technical data, such as IP address and browser, logged by our hosting providers for security.

We don't sell data and we don't use advertising cookies.

2. Purposes and legal bases

• Running the service (account, saving and syncing boards): performance of a contract.
• Security, abuse prevention and usage metrics to improve the product: legitimate interest.
• Meeting legal obligations and responding to requests from authorities: legal obligation.

3. Who we share it with

We use these providers to run Heeey, and they only process data following our instructions:

• Supabase: database, sign-in and image storage.
• Vercel: hosting for the website and the API.
• Vercel AI Gateway: only when you use search by meaning, the titles and text of your boards are sent to the AI model to find the results.
• PostHog: the usage metrics described above.

Some of these providers are outside Brazil (for example, in the United States). These transfers follow the LGPD (Brazil's General Data Protection Law) and the GDPR, with data protection contractual clauses.

Remember: anyone with a board's link can see it (see the Terms of use).

4. Storage in your browser

We use the browser's local storage (localStorage) to keep you signed in, remember your theme and language, and keep guest boards and copies for offline use. This information stays on your device.

5. How long we keep it

We keep your data for as long as your account exists. Deleted boards go to the trash and you can delete them permanently. When you ask us to delete your account, we delete your data within 30 days, except what the law requires us to keep.

6. Your rights

Under the LGPD (and the GDPR, if you are in the European Union) you can ask for confirmation of and access to your data, correction, portability, deletion, information about sharing, and object to processing based on legitimate interest. Write to contato@heeey.click; we reply within 15 days. You can also complain to Brazil's data protection authority (ANPD) or to the data protection authority in your country.

7. Children

Heeey is not directed at people under 16, and accounts can't be created below that age. If you are responsible for a child who created an account, contact us to have it deleted.

8. Security

Data travels encrypted (HTTPS) and the database enforces row-level access rules: each person can only read their own boards or the boards whose link they received.

9. Changes

If this policy changes in a meaningful way, we'll let you know in the app or by email.