Data protection policy

Last updated: 24 October 2026

This page complements the privacy policy: it describes how your data is protected and how to exercise your rights.

1. Our principles

• Minimization: no account, no email, no password; one anonymous ID per device.
• Visible consent: every share is accepted on the device of the person concerned, can be paused and appears in "Who sees what".
• Local processing first: automations, places, fall detection, health and anti-scam features run on the device.
• No commercial use: no advertising, no profiling, no reselling, no third-party analytics tools.

2. Encryption

• In transit: all communication with HeyUs Connect is encrypted (HTTPS/TLS); the app refuses unencrypted connections.
• End-to-end (AES-GCM, keys exchanged via ECDH P-256): online backups (key derived from your password, which we do not know), family vault, documents of the couple and of trusted people, journeys you share, and exchanges between your own devices (notifications, SMS, calls, clipboard, files). The server only stores data it cannot read.
• Other content (messages, photos, lists, shared locations) is encrypted in transit and stored on a protected server; it is only accessible to the people you share it with and is never analyzed.

3. Hosting and security

• The HeyUs Connect service is hosted by a professional hosting provider and administered by the publisher, behind an HTTPS certificate.
• Each device authenticates with a random 256-bit key; the server only keeps a hash of it (SHA-256).
• A device can only read what is meant for it: links, permissions and space membership are checked on every request.
• Invitation codes are single-use and expire within a few minutes.
• A daily backup copy of the database is kept for 14 days, on the same server, so it can be restored in case of an incident.
• On Android, the system's automatic backup is turned off for HeyUs: your data does not end up in a third-party backup.

4. Access to data

Only the publisher administers the server. It only accesses data when technically necessary (incident, security) or legally required, and never end-to-end encrypted content, which it cannot read.

5. Security incident

In the event of a data breach likely to put you at risk, we notify the competent authority and the people concerned within the time limits set by law, and publish the measures taken.

6. Transfers

Payments for activation codes are processed by PayPal, which may process data outside your country with its own safeguards; we only keep the transaction IDs and a fingerprint of the payer's email. The services you connect (Google, Microsoft, Dropbox) are contacted directly from your device.

7. Exercising your rights

1. View and export: My account › Settings › Backup and restore › Export a backup.
2. Stop a share: on the loved one's page or in "Who sees what", at any time.
3. Delete everything: see Delete my account.
4. Any other request: info@heyus.app. We reply within one month. Since we know neither your name nor your email, give the name of your device and, if possible, your HeyUs ID.

You can also contact your country's data protection authority (the CNDP in Morocco, the CNIL in France, the ICO in the UK, or your country's authority).