Last updated: July 27, 2026

Privacy Policy

heyy.to is an Instagram DM automation tool for creators. This page explains every category of data we touch, why we touch it, how long we keep it, and the rights you retain. Questions or requests: hello@heyghe.com.

1. Who we are

heyy.to is operated by Pranav Bhatkar, an independent creator-developer based in Amravati, Maharashtra, India. heyy.to is not (yet) incorporated as a company; it is an early-stage, independent tool. There is no team, no investors, and no external operators. All contact is via hello@heyghe.com.

2. What we collect, and why

The table below lists every category of data heyy.to stores, where it comes from, why we need it, and how long we keep it. If a category isn't here, we don't collect it.

Data	Source	Why	Retention
Account info: email, name, role, locale	Better Auth sign-in + invite acceptance	Identify the creator behind the dashboard	Until account deletion
Instagram access token	Meta OAuth on Connect IG	Call Meta APIs on your behalf to send DMs, reply to comments, fetch media metadata	Encrypted in Cloudflare KV (AES-GCM-256); deleted immediately on disconnect
IG account metadata: handle, IG user ID, business account ID, profile picture URL, subscribed webhook fields	Meta Graph API on connect	Display your connected account in the dashboard; route webhooks to the right automation	Refreshed each connect; deleted on disconnect or account deletion
Comment events: comment text, comment ID, media ID, commenter IG user ID + handle, timestamp	Meta webhooks for posts/reels you subscribed to	Match your keywords and decide whether to trigger an automation; show you the matched-comments history	90 days, then deleted
DM events: recipient IGSID, message payload snapshot, delivery status, response index, error code	heyy.to's send pipeline	Track DM delivery, retry safely, surface failures in your dashboard	90 days, then deleted
Contacts: IGSID, display name + profile picture URL (if Meta returns them), counters, first/last triggered timestamps	Meta Graph API, lazily enriched on activity	Populate the Contacts page so you know who heyy.to DM'd on your behalf	365 days from last activity, or until you delete
Lead submissions: the form fields a viewer fills in response to a Lead Form DM	Submitted by your audience inside Instagram DM	Hand the leads back to you (CSV export, dashboard view)	Until you delete the parent automation, or your account is deleted
Audit log entries: sensitive action, IP, user-agent	Server-side, generated by heyy.to	Investigate security incidents (login from new device, IG connect/disconnect, invite use)	90 days
Marketing analytics: page views, named events, hashed IP, country, device class	Google Analytics 4 + PostHog on heyy.to	Understand which pages bring real creators (no advertising retargeting)	GA4: 14 months (default). PostHog: 7 years (provider default; we'll delete on request)
Dashboard product analytics + session recordings: clicks and navigation (autocapture), plus masked session replays where every input and all text is masked before it leaves your browser	PostHog on the authenticated dashboard (`app.heyy.to`)	Understand how creators use the dashboard and reproduce bugs (no advertising, no third-party sharing)	PostHog: 7 years (provider default; we'll delete on request)
Billing records: plan, subscription status + billing period, Razorpay subscription/payment references, and GST tax invoices (invoice number, amounts, tax split, place-of-supply state). No card, UPI, or bank details.	Razorpay checkout + heyy.to's billing pipeline	Run your Pro subscription and issue GST-compliant invoices	Retained for tax + accounting records as required by law; otherwise until account deletion

Note: Marketing analytics on heyy.to use anonymized IP collection (GA4 anonymize_ip: true) and run no PostHog session replay. The authenticated dashboard (app.heyy.to) does record masked PostHog session replays, with every input and all text masked - see §8.

3. What we do NOT collect

We do not read or store your Instagram DMs other than the ones heyy.to explicitly sends on your behalf.
We do not scrape Instagram posts, followers, hashtags, or any content outside the webhook fields you authorize at OAuth time.
We do not store your card, UPI, or bank details. heyy.to offers paid plans (Pro and Business); all payment credentials are entered directly with Razorpay, our payment processor, and never touch heyy.to's servers. We keep only your plan, subscription status, Razorpay references, and GST invoices.
The marketing site (heyy.to) runs no session replay and no autocapture: it uses GA4 + PostHog with autocapture and session recording both disabled. The authenticated dashboard (app.heyy.to) does run PostHog autocapture + session replay, but every input and all text is masked before it leaves your browser - see §8.
We do not sell, rent, or share your data with third parties for marketing or advertising. Ever.
We do not use your data to train AI or ML models.

4. Where your data lives

heyy.to runs entirely on Cloudflare. Your data resides in:

Cloudflare D1 (Asia-Pacific region): relational data such as users, invites, IG account metadata, comment events, DM events, contacts, lead submissions, and audit logs.
Cloudflare KV: encrypted Instagram access tokens, short-lived caches (webhook dedup, OAuth state nonces), and rate-limit counters.
Cloudflare R2: image attachments you upload inside the automation editor (used as DM media).

The marketing site (heyy.to), dashboard (app.heyy.to), and API (api.heyy.to) are all served from Cloudflare's edge. Cloudflare's data processing terms apply to the underlying infrastructure.

5. Who we share data with

We do not sell your data. We never share it for advertising or marketing purposes. The only third parties that ever see any of your data are infrastructure processors strictly necessary to run heyy.to:

Meta Platforms, Inc.: to call the Instagram Graph API on your behalf (sending DMs, replying to comments, fetching profile metadata). Subject to Meta's Privacy Policy.
Cloudflare, Inc.: hosting, edge routing, D1, KV, R2, and Workers. Cloudflare Privacy Policy.
Resend: transactional email delivery (magic-link sign-in, account notifications). Your email address is passed to Resend only at send-time. Resend Privacy Policy.
Google LLC: only if you choose Google OAuth as a sign-in method. Google receives the sign-in request; we receive your email + Google account ID. Google Privacy Policy.
Google Analytics 4: page-level marketing analytics on heyy.to only. IP is anonymized at collection. Google Privacy Policy.
PostHog: product and marketing analytics. On the marketing site (heyy.to) autocapture, session replay, and surveys are all off and persistence is in-memory, so no PostHog cookies are written. On the authenticated dashboard (app.heyy.to) PostHog runs with autocapture and session replay enabled - but every input and all text is masked before it leaves your browser - and a first-party PostHog cookie is used to stitch sessions. PostHog Privacy Policy.
Razorpay Software Private Limited: payment processing for paid plans. Your card, UPI, or bank details are entered directly with Razorpay and never reach heyy.to; we receive only subscription and payment references to run your subscription and issue GST invoices. Razorpay Privacy Policy.
Sentry: server-side error monitoring. Logs are scrubbed for sensitive keys before send; no IG tokens, no DM contents. Sentry Privacy Policy.

We do not transfer data to any processor outside this list. We do not engage data brokers, ad networks, or affiliate partners.

6. How we secure your data

Instagram access tokens are encrypted at rest with AES-GCM-256 using a versioned key envelope, stored only in Cloudflare KV, and never logged or written to D1.
Magic-link tokens are hashed before storage and expire after 15 minutes.
Owner accounts are required to enable TOTP-based 2FA on first sign-in.
All Meta webhooks are HMAC-SHA256 signature-verified over the raw request bytes before any processing.
Constant-time string comparison is used for all token, invite, and signature validations.
Session cookies use the __Host- prefix with Secure, HttpOnly, and SameSite=Lax.
Logger middleware scrubs sensitive keys (tokens, signatures, authorization headers) at every depth before serialization to Sentry.
heyy.to is single-tenant per Cloudflare account, so there is no shared multi-tenant database surface across operators.

heyy.to is not (yet) SOC 2, ISO 27001, or HIPAA certified. We do not make compliance claims we can't back up. The full security model is documented internally and reviewed on every change.

7. Your rights and how to use them

Under India's Digital Personal Data Protection Act, 2023 and (for EU/UK users) the GDPR / UK GDPR, you have the right to access, correct, export, and delete your personal data. heyy.to honors these rights regardless of your jurisdiction.

Disconnect Instagram at any time. Revoke heyy.to's access in Instagram Settings → Apps and Websites. Our server-side cleanup deletes your access token immediately and stops processing webhooks for that account.
Delete your account. Visit app.heyy.to → Settings → Danger Zone, or email hello@heyghe.com. We delete your user record, IG metadata, contacts, lead submissions, and queued DM events within 7 days. Audit log entries are retained for 90 days for security purposes, then deleted.
Export your data. Email us and we'll send a JSON dump of every record tied to your account within 7 days.
Correct your data. Most fields are editable in the dashboard. For anything else, email us.
Meta-initiated data deletion. Meta calls https://api.heyy.to/api/ig/oauth/data-deletion when an Instagram user requests deletion. We honor every such request automatically and respond with a confirmation URL per Meta's spec.

If you believe heyy.to has mishandled your data, you can lodge a complaint with India's Data Protection Board (once constituted under DPDP-2023) or, for EU users, your local supervisory authority. We'd appreciate you emailing us first so we can fix it.

8. Cookies and analytics

The marketing site (heyy.to) uses two analytics tools and a minimal set of first-party cookies:

Google Analytics 4: writes _ga and _ga_* cookies (first-party) for visit measurement. IP anonymization is enabled. We do not enable Google Signals, ad personalization, or remarketing audiences.
PostHog (marketing): runs with persistence: "memory", so it writes no cookies on the marketing site. Autocapture is off, session recording is off, surveys are off.
PostHog (dashboard): on app.heyy.to, a first-party PostHog cookie (and local storage) is used to stitch authenticated sessions. Autocapture and session replay are enabled, but mask_all_text plus session_recording.maskAllInputs and maskTextSelector: "*" mask every input and all text before it leaves your browser, so replays and captured events never contain the raw content you type or read.

Both GA4 and PostHog respect the browser Do Not Track header. If your browser sets navigator.doNotTrack === "1", neither tool fires.

We do not use third-party advertising cookies. We do not load Facebook Pixel, LinkedIn Insight, or any other ad-network tracker.

9. Children

heyy.to is not intended for users under the age of 18, in line with Meta Platform Terms for the Instagram Graph API. We do not knowingly collect data from anyone under 18. If you believe a minor has signed up, email hello@heyghe.com and we will delete the account.

10. International data transfers

heyy.to is operated from India. Your data is processed on Cloudflare's global edge network and stored primarily in their Asia-Pacific D1 region. Cloudflare may route requests through other regions for performance and reliability, covered by their data processing addendum.

For EU/UK users: where processors (Cloudflare, Resend, Google, PostHog, Sentry, Razorpay) are based outside the EEA, they operate under either Standard Contractual Clauses or their own GDPR-compliant transfer mechanisms.

11. Changes to this policy

We will update the "Last updated" date at the top of this page whenever the policy changes. For material changes (new categories of data, new processors, changes to retention) we will email every active beta user at least 14 days before the change takes effect.

12. Contact

Questions, concerns, or data requests: hello@heyghe.com. We aim to respond within 7 days; for urgent security or deletion requests, please write "urgent" in the subject line.