Privacy Policy

Effective November 8, 2026 · Operated by Hey AI, Inc.

This Privacy Policy explains what personal information Hey AI, Inc. ("Hey AI," "we," "us") collects when you use the hey.ai website, the Hey Cleanup browser extension, the Hey iPhone app, and any related services (collectively, the "Services"), how we use that information, who we share it with, and the rights you have over it.

If you do not agree with this Policy, please do not use the Services. Questions? Email privacy@hey.ai.

1. Who we are

Hey AI, Inc. is a Delaware corporation. The Services read the data exports you choose to import from platforms such as Facebook, Instagram, Google, and Amazon, write reports about them, answer your questions about your own history, and draft posts and messages in your own voice (Write). A Chrome extension, Hey Cleanup, can remove the Facebook, Instagram, and LinkedIn posts and comments you approve (Section 16).

Character features. Hey also includes AI characters, such as coaches and companions, that text and call you, and a Kids mode. These are no longer offered to new users. People who already use them, mostly in the Hey iPhone app, can keep doing so, and this Policy covers them too. Characters can be given access to your Apple HealthKit data and calendar events with your consent (Section 7).

Data controller. For users in the European Economic Area, the United Kingdom, and Switzerland, Hey AI, Inc. is the data controller for personal information processed through the Services.

How to reach us about privacy: privacy@hey.ai.

2. Information we collect

You give us

• Account & identity: your phone number if you sign in by SMS, or your Google details if you sign in with Google (see "From other services" below), both through Firebase Authentication; display name; an email address for notices if you give us one; and any optional profile details you add.
• Your requests to Hey: the questions you ask, the reports you start, the drafts you ask for in Write with the tone and settings you choose, and the cleanup criteria you describe, along with the items you approve or keep.
• Memories: short facts Hey saves from your conversations so its answers and Write drafts can use them. You can turn memories off for a draft in Write.
• Character setup (if you use characters): the characters you created or hired, goals you set, reminders, scheduled call times, and the cadence you chose.
• Conversation content: the messages you exchange with Hey's assistant and, if you use them, the text messages, voice messages and voice calls you exchange with characters. This includes message text, audio captured during calls, and transcripts generated from that audio.
• Child profiles (Kids mode, Hey iPhone app): if you enable Kids mode — after giving parental consent — the child's first name (or nickname), age, and optional details you choose to add: interests, an optional photo (stored privately and served only to your signed-in account), names of trusted adults in the child's life (e.g., their dentist or teacher) used to personalize calls, and free-text notes. See Section 8.
• Billing: subscription tier and status. Payment instruments (card numbers, etc.) are entered directly into Stripe and we never see them — we only see a token, the last four digits, and billing status.
• Voice-clone audio (earlier clones only): Hey no longer creates voice clones. If you created one earlier, we hold the reference audio you uploaded or recorded so a text-to-speech provider can synthesise a voice that resembles it (Section 7).
• Support communications: messages you send us by email or in-app feedback.

We collect automatically

• Device & technical: device model, iOS version, app version, language, time zone, IP address, crash diagnostics, and basic usage events (which screen you opened, whether a call connected).
• Push tokens: a browser push subscription if you turn on notifications on the web (for example, to hear when a report is ready), and, in the Hey iPhone app, APNs device tokens and PushKit (VoIP) tokens used to deliver notifications and ring branded incoming calls.
• Cookies on the website: session cookies used to keep you logged in at hey.ai. The marketing site does not run third-party analytics, ad pixels, or behavioural tracking. See Section 14.

You grant access (only with your consent)

• Apple HealthKit (Hey iPhone app): steps, active energy, exercise minutes, body mass, heart rate, sleep, and workout summaries. Only the metric types you allow in the iOS Health permission sheet are read.
• Apple Calendar (EventKit, Hey iPhone app): a peek at the next 24 hours of events, used to give characters relevant context (e.g., "you've got a 3 PM block — want me to call at 4?").
• Google Calendar & Gmail (optional OAuth, connected on the web app): if you connect your Google account, Hey's assistant and characters read your calendar events, and Hey's assistant can search your email. When you ask it to, Hey's assistant can add a calendar event, or send or reply to an email from your Gmail account. You can disconnect at any time, which revokes the token.
• Platform data exports you upload (optional, web app): you can import your own data-export files from platforms such as Facebook, Instagram, YouTube, Google, LinkedIn, Reddit, Netflix, Amazon, Uber, DoorDash, and X. These files can contain rich history — for example messages, connections, watch/search history, orders, and location entries included in the export — which we parse into your private analytics store so Hey can write your reports, answer your questions, draft in your voice and suggest cleanup. The export file you upload, including its photos, is kept with your import until you delete the import or your account. Imported data is never shared except with the sub-processors in Section 6 to answer your requests, and it is deleted with your account (Section 13).
• Data market waitlist (optional): if you join the waitlist to sell or buy data, we keep the email you give, whether you would sell or buy, and the answers you choose to fill in, such as the sources and uses you would consider, a price, and, for buyers, your organization and what you are looking for. We use it only to contact you about the data market. Joining does not share any of your data with anyone, and every future offer would be a separate choice. Your waitlist entry is not tied to your Hey account, so deleting your account does not remove it; email privacy@hey.ai to have it removed.
• Microphone and camera: only when you initiate a feature that needs them (voice calls, voice messages, sending a photo). We do not request device contacts or device location.

From other services

• Firebase Authentication returns a signed token confirming you control the phone number or Google account you signed in with.
• Google sign-in: if you sign in with Google, Google shares your name, email address, profile picture and Google account ID with Firebase Authentication. We keep the email address on your account and use it to communicate with you as described in this Policy. Signing in with Google does not give us access to your Gmail, Calendar or anything else in your Google account; those connect only if you choose to connect them separately.
• Stripe tells us your subscription status (active, past due, cancelled, etc.).
• Apple App Store returns receipts for any in-app purchases.

3. How we use information

We use your information to:

• Provide the Services — import and analyse your exports, write reports, answer your questions, draft text in Write, run cleanup, and send email and push notices; for character features, generate replies, place calls, log goal progress and run voice rooms.
• Photo check (optional, paid) — only when you turn it on and confirm its price, Hey reads the photos in your Facebook or Instagram posts from your uploaded export, within the dates you pick, and sends them to an AI model to look for things that could hurt your reputation, such as drinking, drugs, an exposed ID or a work screen. Hey keeps no new copy of your photos, only which posts were flagged and why, and shows the photos back only to you.
• Personalize — feed your memories, goals, calendar context, specific remembered moments, and a synthesized "memory narrative" (a short AI-generated summary of recent activity) into the prompt so Hey and characters reply with continuity.
• Run safety, fraud, and abuse defences — detect spam, scripted abuse, and account takeover.
• Process payments via Stripe and our App Store relationship with Apple.
• Communicate with you — service notices, billing receipts, and notices that an import or report is ready or that a scheduled cleanup scan found something. We send marketing only with your consent and you can opt out from any marketing message.
• Improve the Services — diagnose crashes, fix bugs, evaluate which features are used.
• Comply with law and enforce our Terms.

We do not sell your personal information. We do not use your messages, voice recordings, HealthKit data, or calendar data to train third-party AI models. The AI sub-processors we use to generate replies, reports and drafts process your prompts on a per-request basis and, where the provider offers it, we use accounts configured with training-opt-out.

4. Legal basis for processing (EEA / UK)

If you are in the EEA, UK, or Switzerland, our lawful bases under Article 6 GDPR are:

• Performance of a contract — to provide the Services you signed up for (most processing).
• Consent — for HealthKit data, calendar data, voice-clone creation, microphone access, optional marketing emails, and any other sensitive processing. You can withdraw consent at any time in iOS Settings or in-app.
• Legitimate interest — to keep the Services secure, prevent fraud, and improve quality. Where we rely on legitimate interest you can object at privacy@hey.ai.
• Legal obligation — to comply with tax, accounting, and law enforcement requirements.

Sensitive data (health data). Where HealthKit data is processed, we rely on your explicit consent (Article 9(2)(a) GDPR).

5. Who we share data with

We share personal information only with:

• Sub-processors that operate parts of the Services on our behalf (see Section 6).
• Apple — push notification delivery and App Store billing for in-app purchases.
• Law enforcement and regulators — only when we are required to by valid legal process, and where we can, we will notify you.
• An acquirer — if Hey AI is sold or merged, your information may transfer to the surviving entity, subject to this Policy.

We do not share your data with advertisers, data brokers, or marketing partners.

Links you choose to share. When you share a report, a score card or a year card, Hey publishes it at a link, and anyone who has the link can see what that page shows, which can include names and the words of messages in its charts. A shared report never includes the rows from your exports behind its findings. These pages ask search engines not to index them. You can take a link down at any time, and these links stop working when you delete your account.

6. Sub-processors

We use the following sub-processors. We sign a data processing agreement (DPA) with each one where one is offered, and we share only the minimum personal information needed for the provider to perform its function. We will update this list when sub-processors change; to receive notice of changes, contact privacy@hey.ai.

7. Calendar, HealthKit & voice — specific disclosures

HealthKit, Apple Calendar, calls, voice messages and voice clones are part of the character features, used mostly in the Hey iPhone app (Section 1). Google Calendar also works with Hey's assistant on the web.

HealthKit

Health data is sensitive. We treat it accordingly:

• We read HealthKit only after you grant explicit per-metric permission in the iOS Health sheet.
• We use HealthKit data to auto-log goal progress (e.g., a "10,000 steps" goal logs from your steps reading) and to give characters contextual awareness ("you slept 5h last night — want to talk about it?").
• HealthKit data is not shared in raw form with any of the AI sub-processors in Section 6. When relevant, we include short, derived summaries in the prompt to the language model (for example, "user walked 8,200 steps yesterday; sleep was below their target"). We never send raw HealthKit time-series data outside our backend.
• We do not sell HealthKit data, do not use it for advertising, and do not share it with third parties for any purpose other than operating the Services.
• You can revoke HealthKit access at any time in iOS Settings → Privacy & Security → Health.

Calendar (EventKit & Google Calendar)

We use calendar access to surface nearby events to Hey's assistant and to characters for scheduling and context. Hey adds an event to your Google Calendar only when you ask it to; Apple Calendar access is read-only. Calendar contents are not shared with sub-processors except as short derived summaries in the prompt (e.g., "user has a 3 PM meeting") on the same basis as HealthKit above.

Voice calls and recordings

During a character voice call, your audio is streamed to a speech-to-text sub-processor (AssemblyAI) for live transcription, the transcript is sent to the conversation model (Groq) to generate a reply, and the reply is synthesised back to audio by a text-to-speech provider (ElevenLabs / Fish / InWorld depending on the character). We do not record calls: raw call audio is not stored by Hey AI — it exists only in the live stream. What persists after a call is text: an AI-written summary (and, for kids calls, a short interest list) saved to your account, plus a recent-dialogue memory that lets the character pick up where you left off. You can turn off transcript/summary saving in Settings. The apps also label every conversation and call as AI (thread header, call screen, and the incoming-call screen), and our published crisis protocol is at hey.ai/safety.

Voice messages you and a character exchange in a conversation are audio you chose to create — those files are stored with the conversation until you delete them or your account.

Voice clones

Hey no longer creates voice clones. If you created one earlier, the reference audio you provided was uploaded to InWorld (or another TTS provider) under your account. We delete the reference audio and the cloned voice when you delete your account, or sooner if you ask us at privacy@hey.ai.

8. Children & Kids mode

Hey AI accounts are created only by adults aged 18 or older. By creating an account you confirm that you are at least 18.

Kids mode is available only in the Hey iPhone app, to people who already use it, and is not offered to new users.

Kids mode is an optional feature that a parent or legal guardian can enable so that their child (ages 3–12) can interact with curated, public-domain AI characters (storytelling, encouragement, conversation) under the parent's account. Every character is clearly labeled as AI in the app, discloses in kid-friendly language during calls that it is a computer voice and not a real person, and AI companion characters may not be suitable for some children — the parent decides. When Kids mode is used:

• Consent comes first. Parental consent is required in-app before a child profile can be created and before any call is placed — and it is revocable at any time in Settings in the Hey iPhone app, which immediately re-blocks kids calls and new profiles.
• What we collect about a child: the profile the parent enters (name, age, and optional interests, a photo, trusted-adult names, and notes), and — from calls — a short AI-written summary and a list of the child's interests. The photo is stored privately and served only to the parent's signed-in account. We instruct our systems not to record the names of other people the child mentions.
• We do not record children's calls. A child's voice is streamed for live speech recognition only (see Section 7) and is not stored; only the text summary and interest list persist.
• Children's data retention policy (published under 16 CFR 312.10): a child's call summaries and interest lists are retained to give characters continuity across calls, for a maximum of 12 months from creation, after which they are automatically deleted by a scheduled job. Deleting a child's profile deletes that child's summaries, interest lists, call-history rows, stories, and photo immediately; deleting the account deletes everything (Section 13). We retain children's data for no other purpose and never longer than needed for this one.
• Third parties: children's data is shared only with the sub-processors in Section 6, strictly to operate the feature (speech-to-text, the conversation model for the live call, text-to-speech, hosting), never for advertising, never sold, and never used to train AI models.
• Calls always ring the parent's verified phone — children have no login, device token, or phone number in our systems — and the parent may review, edit, or delete the child profile and associated data at any time in-app or by emailing privacy@hey.ai.
• Our child-specific crisis protocol is published at hey.ai/safety.

If we learn that a child's information was collected without the required parental consent, we will deactivate the relevant profile and take reasonable measures to delete that data. To review, request deletion of, or ask questions about a child's data, contact privacy@hey.ai.

9. How long we keep data

10. Security

We use industry-standard safeguards including TLS in transit, encryption at rest, principle-of-least-privilege access controls, audit logging, and short-lived credentials. Authorized staff can access an account for support, and that access is audited. No system is perfectly secure; if we ever become aware of a breach that affects you, we will notify you within the timeframes required by applicable law.

11. International data transfers

Hey AI is based in the United States and most of our sub-processors are based in the United States. Some AI model providers reached through our US-based gateway (Section 6) may process requests in other regions — for example, text-to-speech partners with Singapore operations and the model hosts behind our routing gateway. All such processing is per-request, under training opt-out, and limited to generating your reply. If you are in the EEA, UK, or Switzerland, your data will be transferred to and processed in the United States and other countries that may have different data protection laws than your own. We rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) to lawfully transfer personal data internationally. To request a copy of the SCCs in place with a specific sub-processor, email privacy@hey.ai.

12. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy.
• Correct inaccurate information.
• Delete your information (see Section 13).
• Port your information to another service in a machine-readable format.
• Restrict or object to certain processing.
• Withdraw consent at any time where we rely on consent.
• Lodge a complaint with a supervisory authority (EEA/UK users — find yours here).

To exercise any of these rights, email privacy@hey.ai or use Settings in your account. We will respond within 30 days (45 days for complex requests, with notice).

13. Account & data deletion

Connecting a second sign-in method. If you connect a phone number or Google account that already belongs to another Hey account with nothing in it, we delete that empty account so both methods open one account. If that other account holds anything you made or paid for, we leave it untouched and tell you.

What gets deleted, in order:

1. Deletion of any imported platform-export data (Section 2) is queued in our analytics store; those datasets are fully removed within 30 days.
2. Third-party OAuth tokens (such as Google) are revoked at the upstream provider.
3. User-keyed files in cloud storage (voice messages, character avatars, uploaded images, child photos) are removed.
4. Reports, research runs, memories, writing settings, cleanup reviews, receipts and saved copies, conversations with Hey's assistant and characters, every message in those conversations, scheduled calls, call sessions, goals, log entries, daily commitments, voice memos, voice clones, connected accounts, child profiles, and children's call summaries are removed from the database.
5. Your account row is removed last.
6. Backups containing deleted data are rotated out within 90 days.

Some records may be retained longer where required by law (for example, billing records for tax purposes). Aggregated, fully de-identified information may be retained indefinitely.

14. Cookies, tracking & analytics

The Hey AI website (hey.ai) uses only essential cookies to keep you signed in. We do not run third-party analytics (Google Analytics, Mixpanel, etc.), ad pixels (Meta, TikTok, X, Google Ads), or session replay tools on the marketing site. We do not honor or need to honor a "Do Not Track" header because we do not track across sites.

The Hey iPhone app collects basic diagnostic and usage events on our own backend; it does not include third-party analytics SDKs and does not use the Apple advertising identifier (IDFA).

15. California privacy rights (CCPA / CPRA)

California residents have the following rights under the CCPA / CPRA:

• Right to know what categories and specific pieces of personal information we have collected.
• Right to delete personal information.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing of personal information for cross-context behavioural advertising.
• Right to limit use and disclosure of sensitive personal information.
• Right to non-discrimination for exercising these rights.

We do not sell or share personal information for cross-context behavioural advertising as those terms are defined under the CCPA. We have not sold or shared personal information in the prior 12 months.

To exercise California rights, email privacy@hey.ai or use the in-app deletion control described in Section 13. Authorized agents may submit requests on your behalf with written authorization.

16. Hey Cleanup (Chrome extension)

Hey Cleanup is a Chrome extension that works with the Hey web app. It carries out the Facebook, Instagram, LinkedIn, Reddit and X cleanup you have approved in Hey: on Facebook it makes your own posts visible only to you, moves them to Facebook's trash, or deletes your own posts and comments; on Instagram it archives your own posts or deletes your own posts and comments; on LinkedIn and Reddit it deletes your own posts and comments; and on X it deletes your own posts and replies, one approved item at a time, in your own browser. You only need it if you want Hey to remove items for you. This section says what the extension itself does with data; the rest of this Policy covers the web app it works with.

What it does with data

• It acts only on what you approved in Hey. It works through the exact posts and comments you reviewed and approved in a batch you chose to start. It cannot add to that list or change it.
• It works in your own signed-in Chrome, on your own posts and comments. It uses the Facebook, Instagram, LinkedIn, Reddit or X tab where you are already signed in, only for your own posts and comments (on X, your own posts and replies). You sign in to those sites yourself; the extension never signs in for you.
• It reads the page only to find and confirm those exact items. It looks at the page it is working on to match an approved item (its text, time, link and author, and the account you are signed in as) and to see the site's own confirmation. It does not collect, keep or send anything else on that page.
• It sends Hey only receipts. For each item: which item, what happened (including the site's own confirmation message), when, and the link it observed. The extension makes no network requests of its own; it passes receipts to the Hey page you have open, which sends them to Hey over your signed-in session.
• It never reads or sends passwords or cookies. It does not use Facebook's, Instagram's, LinkedIn's, Reddit's or X's APIs or tokens. It only notices when a sign-in form or a security check is on the page, so that it can stop.
• It stops on anything it doesn't recognize. If something differs from what you approved or from the pages it knows (edited or duplicate text, a different account, an unfamiliar menu or window, a missing confirmation), it stops and leaves the item for you to check. It never retries an item it is unsure about.

What stays on your computer

A small checkpoint in Chrome's extension storage: the batch and item IDs, the step the extension reached, a short-lived token Hey issues for the item, and any receipt not yet delivered. It holds no post or comment text, and it is removed when you uninstall the extension.

What Hey does with receipts

Receipts are kept with your cleanup record in Hey, stored with the providers in Section 6, so you can see what was removed and what was not. We use them for that and to run and secure the Services, and for nothing else: we do not sell them, share them for advertising (Section 5), or use them for credit or lending decisions. They are deleted with your account (Section 13). The extension has no analytics, advertising or third-party code, and it does not load or run code from anywhere else.

Before Hey Cleanup acts on a post or comment you approved, Hey saves a copy of its text, date, link and what was done, so you can download it later. Photos and videos are not copied. The copies stay until you delete them on the Clean up page or delete your account; deleting or replacing an import does not remove them.

Limits

The extension supports English, desktop Facebook, Instagram, LinkedIn, Reddit (through old.reddit.com) and X, and your own posts and comments (on X, your own posts and replies). It does not act on groups, replies to comments, reposts, LinkedIn company pages, or anyone else's content, and it acts on a Facebook post with photos, videos or attachments only when you approved the whole post. On Instagram, archiving or deleting a post you approved acts on the whole post, and on LinkedIn, Reddit and X, deleting a post removes the whole post, including its photos, videos and attachments; Hey asks you to confirm that before you approve. Comments can only be deleted. Reddit and X cannot restore what is deleted, so Hey asks you to type "delete" before you approve a Reddit or X batch. These sites change their pages without notice; where a page is not one the extension recognizes, it stops rather than guesses. A post made visible only to you or archived stays on the site, and you can change it back there. Moving a post to trash is a Facebook feature, and Facebook says it keeps trashed items for 30 days; deleting a post or comment is permanent.

Our use of information the extension handles adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. Questions about the extension: privacy@hey.ai.

17. Changes to this Policy

If we change this Policy in a way that materially affects how we use your personal information, we will give you notice by email, push notification, or an in-app banner before the change takes effect. The "Effective" date at the top reflects the most recent revision.

18. Contact

Hey AI, Inc.
Privacy team: privacy@hey.ai
General: info@hey.ai

If you are in the EEA, UK, or Switzerland and prefer to contact a data protection authority, you can find your local supervisory authority's contact details at edpb.europa.eu.