Privacy Policy — Heartsay

Last updated 29 September 2026 · Effective 29 September 2026

The short version. We keep your name, your email, the region you pick, and what you post. We run no advertising trackers and sell nothing to anyone. You can erase everything from inside the app in about ten seconds, without emailing us.

1 Who we are

Heartsay is operated by Sarah Aldosari, registered in Saudi Arabia. For anything in this policy, including data requests, write to support@heartsay.co. We answer within 30 days, and usually much sooner.

For the purposes of the UK and EU GDPR, we are the data controller for the information described below.

2 What we collect

What	Why	Where it comes from
Display name	So voters know whose decision they are helping with	You, or your Apple / Google account
Email address	Signing you in, and the alerts you switch on	You, or your Apple / Google account
Region	Shown on your posts; you can hide it in settings	You
Age confirmation	The 17+ check the App Store rating requires	Calculated once, see section 3
Photos and videos	They are the post	Your camera or library, only when you pick them
Votes, advice, saves, blocks	Running the app	Your use of it
Profile photo	Optional, shown next to your posts	You, if you add one
Crash and error logs	Fixing what breaks	Your device, with no advertising identifier attached

3 What we never collect

Your date of birth. We ask for it once, confirm you are 17 or older, store only the yes-or-no result, and discard the date itself. It is never written to our database.
Your location. The region on your profile is the one you typed. We never read GPS, and the app does not request location permission at all.
Advertising identifiers. No IDFA, no advertising SDKs, no cross-app tracking. This is why the App Tracking Transparency prompt never appears — there is nothing to ask you for.
Your contacts, calendar, microphone or health data. The app never requests them.
Payment details. Heartsay is free and has no purchases, so there is nothing to charge.

4 Why we are allowed to hold it

Under GDPR every use of your data needs a legal basis. Ours are:

Performance of a contract — your account, your posts, your votes. Without these the app cannot work.
Legal obligation — the 17+ age check, and keeping records of content we removed.
Legitimate interests — keeping the service safe and free of abuse, and fixing crashes. We balance this against your rights and keep the data minimal.
Consent — optional emails and push notifications. Withdraw it any time in Profile → Notifications; nothing else changes if you do.

5 Who else sees it

We do not sell your data, and we never will. We share it only with the companies that run the service for us, under contracts that forbid them using it for anything else:

Supabase (database and photo storage) and GitHub Pages (this website) — storing the database and your photos.
Apple and Google — only if you choose their sign-in button. They confirm who you are and hand us a name and an email address. They never receive your posts, your votes or your advice.
Law enforcement, but only where a valid legal order requires it, and we will tell you unless we are forbidden from doing so.

Sign in with Apple and Private Relay. If you choose Hide My Email, Apple gives us a forwarding address instead of your real one. We never see your actual inbox, and everything in the app works exactly the same.

Google user data. When you choose Sign in with Google, we receive only your name and email address from your Google account. We use them solely to create and identify your Heartsay account and to contact you about your account. We do not sell this data, share it with third parties for advertising, or access any other Google data such as your contacts, Drive or Gmail. You can delete your account and all associated data at any time from inside the app.

6 How long we keep it

While your account exists — your profile and your posts stay until you remove them.
After you delete your account — erased from our live systems immediately, and purged from encrypted backups within 30 days.
Records of removed content — kept for 12 months so we can enforce bans, then deleted. These hold what was removed and why, not the material itself.

7 Your rights

Wherever you live, you can ask us to show you what we hold, correct it, or erase it. Under GDPR you also have the right to receive your data in a portable file, to object to processing based on legitimate interests, to restrict processing while a dispute is open, and to complain to your national data protection authority.

Under the CCPA and CPRA, California residents can ask what we collected and have it deleted. We do not sell or share personal information as those laws define it, so there is nothing to opt out of. We will never treat you differently for exercising any of these rights.

Write to support@heartsay.co, or use Profile → Data & privacy in the app.

8 Deleting your account

Open Profile → Delete account, type DELETE, and confirm. That erases your profile, every photo and video you posted, all of your advice and every vote you cast. No email to us, no support ticket, no waiting — as Apple's Guideline 5.1.1(v) requires.

Deletion cannot be undone. Anonymous vote totals on other people's posts stay, because they belong to those posts and no longer point to you.

9 Children

Heartsay is rated 17+ and is not for children. We do not knowingly collect anything from anyone under 17. If we learn that a younger person has created an account we delete it and its contents without waiting to be asked. Parents and guardians can reach us at support@heartsay.co.

10 Security and where your data lives

Traffic between your device and our servers is encrypted in transit, and the database and stored media are encrypted at rest. Access is limited to the people who need it to operate the service.

Our servers are in the European Union (Frankfurt, Germany). Where data leaves the UK or EEA, we rely on the European Commission's Standard Contractual Clauses. No method of storage is perfectly secure, and we do not claim otherwise; if a breach affects you we will notify you and the relevant authority within the time the law allows.

11 Changes to this policy

If we change something that materially affects you, we will tell you in the app before it takes effect and update the date at the top. Continuing to use Heartsay after that means you accept the revised policy.