How we process your data

Controller

Heyhop is a product operated by Sergio Medina de Mera, an individual operator and data controller established in Spain. For privacy enquiries and to exercise your rights, contact privacidad@mail.heyhop.app.

No data protection officer has been appointed. The privacy contact handles these requests directly.

Data we process

• Account and access: email, account identifiers and information needed to sign in to, verify and protect your account.
• Age and eligibility: date of birth and information needed to check age and current policy acceptances. Your date of birth is not shown publicly.
• Profile and cards: display name, photo, occupation, interests, links, settings and information you add to your Social or Professional cards.
• Proximity and connections: technical data about Bluetooth encounters, requests and connections, including event context where relevant.
• Social activity: events, rooms, memberships, answers, polls, posts, comments, likes, images and moderation status.
• Communications: direct and anonymous messages and information needed to provide messaging, such as participants, dates and read status.
• Personal organisation: private notes, labels, statuses and reminders linked to your own matches.
• Safety and moderation: reports, blocks, measures affecting accounts or content, and information needed to investigate incidents and defend claims.
• Support: contact details, the content of your enquiry and information needed to respond.
• Organiser applications: information about your organisation, the planned event and any message you choose to send when requesting access. If your application is approved, we may notify the verified email address of your account and keep a minimal record of the notice status and attempts to prevent duplicates and resolve issues. This information is not published in the app.

Purposes and legal bases

• Providing the requested service: creating and protecting the account, authenticating you, displaying your chosen profile and enabling proximity, connections, events, content and chats. The basis is performance of the service relationship and steps requested before using it.
• Age and eligibility: checking the 18+ requirement, applying policies and preventing incompatible access. This relies on performance of the service and the legitimate interest in protecting the community and enforcing its terms.
• Security, moderation and defence: preventing abuse, fraud, unauthorised access, block evasion and risks to others; investigating reports and defending claims. The basis is our legitimate interest, balanced against people's rights, and legal obligation where a rule requires action or retention of information.
• Support and rights requests: answering enquiries, restoring access and handling privacy or deletion requests. This relies on the service relationship, the legitimate interest in resolving incidents and applicable legal obligations.
• Voluntary options: where a feature or permission is genuinely optional and consent is the applicable basis, we will request a clear choice. You may withdraw it through the system or device without affecting processing already carried out lawfully.

We do not use this data for behavioural advertising or sell personal data.

Bluetooth proximity without GPS

Heyhop uses Bluetooth Low Energy to detect nearby signals and confirm encounters between devices. It does not use GPS to determine or publish a precise location. Older Android versions may request a location permission technically required by the system to scan BLE; its purpose in Heyhop remains proximity.

Visibility, organisers and anonymity

Other users see the card and content appropriate to the context. Authorised organisers can see your participation, content you share in their event and your individual answers to their entry questions, even if you choose not to show an answer on your card; poll results are presented in aggregate. They do not receive your date of birth, private notes, private reports or the internal identity of anonymous chats.

In anonymous messaging, your identity is hidden from other users and organisers during ordinary use. This does not mean your data is irreversibly anonymised to Heyhop: authorised staff may access information needed to investigate reports, prevent abuse, protect someone, comply with the law or defend rights.

Providers and transfers

• Supabase: authentication, database, storage and backend functions.
• Vercel: website hosting and related services.
• Google: sign-in, distribution through Google Play, operational email and Firebase Cloud Messaging for optional anonymous notifications when the recipient enables them and the feature is available to their account. In public versions that include optional diagnostics, we will use Firebase Crashlytics for those diagnostics only if you allow it. Preproduction retains its separate testing diagnostics.
• Resend: verification and recovery emails, operational communications about organiser pilot access applications, and handling messages sent to our contact channels. Resend stores email data in the United States; selecting a European sending region does not change that storage. Transfers are subject to its DPA safeguards and applicable mechanisms.

Depending on the service, these providers may act as processors or subprocessors. We may also disclose data where required by law or necessary to establish or defend claims. Some processing may involve transfers outside the European Economic Area; where applicable, we will use mechanisms provided for by the GDPR, such as adequacy decisions or contractual safeguards. You can ask our privacy contact about the safeguards that apply.

Optional push notifications

If you enable notifications for the first activity in an anonymous relationship, we use Firebase Cloud Messaging (FCM), a token and a technical identifier for your installation to deliver them. The notification includes neither the message nor the sender's identity, email or avatar.

Availability may be limited to test accounts or extended to people who enable this option. You can turn it off and unlink your installation. Invalid tokens are deactivated, and inactive installations are removed when they are no longer needed to provide the feature.

Google Play updates

In versions of Heyhop that include this mechanism and were installed through Google Play, the app may automatically check whether an update is available. This functional check is independent of permission for optional Crashlytics diagnostics. Downloading requires your acceptance in the Google Play flow; you can then keep using the app and decide when to restart it to complete the update.

Google Play performs the check through its own processes, subject to its terms. According to Google, it processes device metadata, the Heyhop version and the list of modules and asset packs installed for the app itself to determine update availability and size. That list is not an inventory of the other apps on your phone.

Google states that this data is encrypted, is not transferred to third parties and is deleted after a fixed retention period. The documentation for this feature does not specify its duration; we do not apply the Crashlytics retention period to it.

You can read Google's information about in-app updates.

Optional stability diagnostics

If you allow these diagnostics, Firebase Crashlytics collects crash reports with the stack trace, the time of the crash, the app's technical state, the app version, device and operating system information and relevant technical installation identifiers, such as the Crashlytics identifier and the Firebase Installations identifier where applicable.

We use these reports to detect and fix faults and improve Heyhop's stability, not for advertising or commercial analysis of your activity. The basis for these optional diagnostics is your specific consent, separate from accepting the terms and acknowledging the privacy information.

In supported versions, we will invite you to decide once per installation, after the introductory tour or after a few quiet seconds in the main area if you skip it. You can choose Allow or Not now; closing the invitation means Not now. We remember both responses on that installation when they can be saved, and you can change them in Settings. Consent is per installation, not per account: signing out does not withdraw it. We do not initialise public Crashlytics before your permission, and your choice does not restrict any Heyhop feature. Reinstalling the app or clearing its data resets this local preference.

You can withdraw consent in Settings. Withdrawal immediately blocks new admissions of reports to the sending service, including from its persistent queue: each new send call, including queue retries, checks permission and the authorisation interval again. An operation admitted before withdrawal may start or finish an HTTP request afterwards; its internal redirects and retries belong to that operation, not to a new admission. Those requests are not cancelled or waited for, and not all transfers are guaranteed to stop at that instant. Allowing diagnostics again does not authorise reports captured during earlier intervals. If the SDK has already been initialised in that process, the new permission may require restarting the app. If saving the refusal fails, we block new report sends in the current process and show an error; the refusal is not saved, and a new process could still use the last saved permission. You need to retry saving it. Withdrawal does not automatically delete reports Google has already received or affect the lawfulness of earlier processing.

We do not deliberately add messages, photos, profiles or account identifiers to reports, nor Google Analytics, custom keys or our own logs. Technical identifiers do not make reports completely anonymous: a stack trace or error message may contain incidental personal information. The prepared public path does not initialise Firebase Sessions and always suppresses auxiliary GDT_CLIENT_METRICS counters, including shared counters relating to FCM. These counters are not notifications, messages or organiser metrics. Not all Firebase communications are removed: Settings and Firebase Installations have their own communications. FCM and its notification choice remain independent. Preproduction retains its separate testing diagnostics.

Reports are sent to Google/Firebase Crashlytics. Processing may take place outside the European Economic Area. The provider's roles and applicable safeguards are described in the Providers and transfers section; you can request more information through our privacy contact.

As well as withdrawing this consent in Settings, you can exercise applicable rights through the privacy contact stated in this policy. We assess each request according to its scope and the data that can be located proportionately. Deleting your Heyhop account does not guarantee automatic deletion of reports already received by the provider.

Retention

• Accounts, profiles, cards and content are retained while the account exists or while needed to provide the feature, until edited, withdrawn or deleted where appropriate.
• Posts are kept while needed to display them, until you remove them, your account is deleted or a feature limit applies. Evidence needed for safety or claims may be retained under different criteria.
• If event-context visibility is enabled, a verified encounter at a shared event may allow the corresponding public card to be viewed temporarily for up to seven days. A precise GPS location is not kept for this purpose.
• Private notes are deleted when the match or account is removed.
• Messages and relationships are retained while needed for the conversation and feature; unmatching removes the relationship and certain associated data according to the app's behaviour.
• Reports, sanctions, audits and limited evidence are retained while needed to protect users, investigate incidents, prevent abuse, fulfil obligations or establish and defend claims.
• Support enquiries are retained while needed to resolve the request and address related responsibilities.
• Rejected organiser applications are reviewed for possible deletion from 180 days after the decision, unless a claim or other justified reason requires their retention. For approval notices, we keep the minimum status needed to prevent resending while the application exists. Provider identifiers and detailed technical fingerprints for terminal notices older than 30 days from acceptance, the first attempt or transition to a terminal state if there was no attempt are removed in bounded batches when notices are processed; removal on that exact day is not guaranteed. Deleting the application or account removes these associated local records. The email provider applies its own retention criteria.
• Google states that it retains Crashlytics crash stack traces and associated identifiers for 90 days before starting their removal from active systems and backups. This does not guarantee complete deletion on day 90 or when you withdraw permission. For service data Google collects or generates when providing and administering Firebase, its general retention criteria depend on the type of information and its purpose, including service provision, security and legal obligations. Those criteria do not separately specify how long auxiliary Crashlytics configuration records or Firebase Installations registration and token issuance records are retained. We do not automatically apply the 90-day period to those records. FCM retains its independent treatment; withdrawing permission for diagnostics does not mean deleting data the provider has already received.

Where there is no fixed technical retention period, we apply these necessity and limitation criteria. Data that must be retained after deletion is limited or anonymised where possible.

Account deletion

You can request deletion in the app or on the deletion page. The account is blocked while we process the request and remove data we no longer need to keep. Information subject to legal obligations, safety needs or claims may be retained on a limited basis; cases requiring further checks are reviewed before data is deleted.

Requests are handled without undue delay and within applicable legal deadlines. Automatic execution or a fixed number of hours is not promised.

Your rights

Where applicable, you can request access, rectification, erasure, restriction, objection and portability, withdraw consent without affecting previous processing and lodge a complaint with the Spanish Data Protection Agency. Contact privacidad@mail.heyhop.app. We may request proportionate identity verification to avoid disclosing or changing another person's data.

Security and minors

We use authentication, access controls, separation of private information and protection of communications in transit. No system is infallible; for incidents or child safety concerns, contact seguridad@mail.heyhop.app.

The initial launch is exclusively for people aged 18 or over. Internal age and Safety protections remain in place even though the public audience is adult.

Advertising

The current public version does not display ads, use the device's advertising identifier or use your data for behavioural advertising. If these practices change, we will update our privacy information before applying the changes where required.

Changes and contact

Substantial changes will be clearly published and, where appropriate, require renewed acceptance. For general support, contact soporte@mail.heyhop.app; for privacy, use the controller's stated contact channel.

Website language preference

If you choose a language on the website, we store a preference cookie for one year to remember it. You can delete it in your browser. It is not used for advertising or cross-site tracking.