Privacy Policy

2. What we collect, and why

The table below lists every category of data heyy.to stores, where it comes from, why we need it, and how long we keep it. If a category isn't here, we don't collect it.

Note: Marketing analytics on heyy.to use anonymized IP collection (GA4 anonymize_ip: true) and run no PostHog session replay. The authenticated dashboard (app.heyy.to) does record masked PostHog session replays, with every input and all text masked - see §9.

3. What we do NOT collect

• We do not keep your Instagram DMs. We read the DMs and story replies sent to your connected account as they arrive, to run your automations (and, on Pro accounts that turn it on, to spot brand enquiries, see §4). We store only the DMs heyy.to sends on your behalf, answers to a Lead Form you run, and brand enquiries flagged on Pro.
• We do not scrape Instagram posts, followers, hashtags, or any content outside the webhook fields you authorize at OAuth time.
• We do not store your card, UPI, or bank details. heyy.to offers paid plans (Lite and Pro); all payment credentials are entered directly with Razorpay, our payment processor, and never touch heyy.to's servers. We keep only your plan, subscription status, Razorpay references, and GST invoices.
• The marketing site (heyy.to) runs no session replay and no autocapture: it uses GA4 + PostHog with autocapture and session recording both disabled. The authenticated dashboard (app.heyy.to) does run PostHog autocapture + session replay, but every input and all text is masked before it leaves your browser - see §9.
• We do not sell, rent, or share your data with third parties for marketing or advertising. Ever.
• We do not use your data to train AI or ML models.

4. Reading messages and comments with AI (Pro)

On the Pro plan, heyy.to can use an AI model to read comments and DMs. Three things already work or are coming in this way, and each is described here so you can decide whether to use it:

• Meaning-based keyword matching (available now). If you set a keyword to match on meaning, the comment or message text is checked by the model against your keyword to see whether the intent matches.
• AI comment moderation. Comments that none of your automations used can be checked for spam and abuse. Depending on your setting we flag them for your review or hide them on Instagram. We only ever hide, which you can undo; we never delete a comment.
• Brand enquiry detection. DMs and story replies that none of your automations used can be checked for brand collaboration enquiries. A flagged message is shown on your dashboard for 90 days and then removed. DMs that are not flagged are not stored. heyy.to never replies to a brand on your behalf.

What is sent. Only the text of the comment or message, to Cloudflare Workers AI, the model service run by Cloudflare. We do not send your access token or your account identifiers with it. Cloudflare states that it does not retain inputs to Workers AI or use them to train models (see Cloudflare's Workers AI data usage page). We do not use your data to train AI or ML models.

Your control. Moderation and brand detection are Pro features you switch on per connected account, and they run only for accounts that have accepted this version of the policy. Meaning-based keyword matching is part of the current service: when a keyword is set to match on meaning, the comment or message text is sent to Workers AI, and this is not gated on accepting this version. A model can be wrong: that is why moderation can be reviewed and undone, and why a brand enquiry is a suggestion you act on yourself.

5. Where your data lives

heyy.to runs entirely on Cloudflare. Your data resides in:

• Cloudflare D1 (Asia-Pacific region): relational data such as users, invites, IG account metadata, comment events, DM events, contacts, lead submissions, and audit logs.
• Cloudflare KV: encrypted Instagram access tokens, short-lived caches (webhook dedup, OAuth state nonces), and rate-limit counters.
• Cloudflare R2: image attachments you upload inside the automation editor (used as DM media).

The marketing site (heyy.to), dashboard (app.heyy.to), and API (api.heyy.to) are all served from Cloudflare's edge. Cloudflare's data processing terms apply to the underlying infrastructure.

6. Who we share data with

We do not sell your data. We never share it for advertising or marketing purposes. The only third parties that ever see any of your data are infrastructure processors strictly necessary to run heyy.to:

• Meta Platforms, Inc.: to call the Instagram Graph API on your behalf (sending DMs, replying to comments, fetching profile metadata). Subject to Meta's Privacy Policy.
• Cloudflare, Inc.: hosting, edge routing, D1, KV, R2, Workers, and Workers AI (the model that reads comment and message text for the Pro features in §4). Cloudflare Privacy Policy.
• Resend: transactional email delivery (magic-link sign-in, account notifications). Your email address is passed to Resend only at send-time. Resend Privacy Policy.
• Google LLC: only if you choose Google OAuth as a sign-in method. Google receives the sign-in request; we receive your email + Google account ID. Google Privacy Policy.
• Google Analytics 4: page-level marketing analytics on heyy.to only. IP is anonymized at collection. Google Privacy Policy.
• PostHog: product and marketing analytics. On the marketing site (heyy.to) autocapture, session replay, and surveys are all off and persistence is in-memory, so no PostHog cookies are written. On the authenticated dashboard (app.heyy.to) PostHog runs with autocapture and session replay enabled - but every input and all text is masked before it leaves your browser - and a first-party PostHog cookie is used to stitch sessions. PostHog Privacy Policy.
• Razorpay Software Private Limited: payment processing for paid plans. Your card, UPI, or bank details are entered directly with Razorpay and never reach heyy.to; we receive only subscription and payment references to run your subscription and issue GST invoices. Razorpay Privacy Policy.
• Dodo Payments: payment processing and merchant of record for international (USD) subscriptions. Your payment details are entered with Dodo and never reach heyy.to. Dodo Payments Privacy Policy.
• Featurebase: the in-app help messenger and feedback board. Your name and email are passed to it so your requests are linked to your account. Featurebase Privacy Policy.
• Sentry: server-side error monitoring. Logs are scrubbed for sensitive keys before send; no IG tokens, no DM contents. Sentry Privacy Policy.

We do not transfer data to any processor outside this list. We do not engage data brokers, ad networks, or affiliate partners.

7. How we secure your data

• Instagram access tokens are encrypted at rest with AES-GCM-256 using a versioned key envelope, stored only in Cloudflare KV, and never logged or written to D1.
• Magic-link tokens are hashed before storage and expire after 15 minutes.
• Two-factor sign-in (TOTP) and passkeys are available. Once you enable 2FA, you are challenged for it at every sign-in.
• All Meta webhooks are HMAC-SHA256 signature-verified over the raw request bytes before any processing.
• Constant-time string comparison is used for all token, invite, and signature validations.
• Session cookies use the __Host- prefix with Secure, HttpOnly, and SameSite=Lax.
• Logger middleware scrubs sensitive keys (tokens, signatures, authorization headers) at every depth before serialization to Sentry.
• heyy.to is single-tenant per Cloudflare account, so there is no shared multi-tenant database surface across operators.

heyy.to is not (yet) SOC 2, ISO 27001, or HIPAA certified. We do not make compliance claims we can't back up. The full security model is documented internally and reviewed on every change.

8. Your rights and how to use them

Under India's Digital Personal Data Protection Act, 2023 and (for EU/UK users) the GDPR / UK GDPR, you have the right to access, correct, export, and delete your personal data. heyy.to honors these rights regardless of your jurisdiction.

• Disconnect Instagram at any time. Revoke heyy.to's access in Instagram Settings → Apps and Websites, or disconnect in the dashboard. We delete your access token immediately and stop processing webhooks for that account. Your stored events and contacts stay until you remove the account in Settings or delete your account.
• Delete your account. Visit app.heyy.to → Settings → Danger Zone and confirm with your email address. We then delete all of your data: your sign-in and security records, Instagram access tokens, connected accounts, automations, comment and DM events, contacts, lead submissions, link-in-bio pages and uploaded images, short links, email records, subscription records, and audit log entries tied to you. An active subscription is cancelled first. All data from your connected Instagram accounts is deleted. Two kinds of record are not deleted, they are soft-deleted: they are kept, attached to an anonymous record of your account with no name or email that cannot be signed in to, and they are not shown to you or to anyone else in the product. These are (1) GST tax invoices, their PDF copies and the tax information on them, kept because Indian tax law requires us to keep them, and (2) all referral records: referral links (switched off), clicks on them, who was referred by whom, and commission and payout records, kept because they are records of money owed or paid. If you were referred by someone, the label naming you on their commission record is cleared. Data held by our processors (§6) is covered by their terms; email us and we will ask PostHog to delete yours.
• Export your data. Email us and we'll send a JSON dump of every record tied to your account within 7 days.
• Correct your data. Most fields are editable in the dashboard. For anything else, email us.
• Meta-initiated data deletion. Meta calls https://api.heyy.to/api/ig/oauth/data-deletion when an Instagram user asks Instagram to delete the data heyy.to holds for them. We verify Meta's signature and then delete all of that account owner's data, exactly as described for account deletion above, and respond with a confirmation URL and code per Meta's spec. If the automatic deletion fails, we still revoke access at once, and we finish it by hand: email us with your confirmation code.

If you believe heyy.to has mishandled your data, you can lodge a complaint with India's Data Protection Board (once constituted under DPDP-2023) or, for EU users, your local supervisory authority. We'd appreciate you emailing us first so we can fix it.

9. Cookies and analytics

The marketing site (heyy.to) uses two analytics tools and a minimal set of first-party cookies:

• Google Analytics 4: writes _ga and _ga_* cookies (first-party) for visit measurement. IP anonymization is enabled. We do not enable Google Signals, ad personalization, or remarketing audiences.
• PostHog (marketing): runs with persistence: "memory", so it writes no cookies on the marketing site. Autocapture is off, session recording is off, surveys are off.
• PostHog (dashboard): on app.heyy.to, a first-party PostHog cookie (and local storage) is used to stitch authenticated sessions. Autocapture and session replay are enabled, but mask_all_text plus session_recording.maskAllInputs and maskTextSelector: "*" mask every input and all text before it leaves your browser, so replays and captured events never contain the raw content you type or read.

Both GA4 and PostHog respect the browser Do Not Track header. If your browser sets navigator.doNotTrack === "1", neither tool fires.

Invitation links. If you arrive through an invitation link shared by someone else, we set one additional first-party cookie (heyy_ref) so the invitation can be credited if you go on to create an account. It stores only the short code from the link, expires after 30 days, and is never used for advertising or shared with anyone. To count how often a link is opened without identifying who opened it, we store a salted, irreversible hash of the visitor rather than an IP address, together with a coarse country and the day of the visit.

We do not use third-party advertising cookies. We do not load Facebook Pixel, LinkedIn Insight, or any other ad-network tracker.

10. Children

heyy.to is not intended for users under the age of 18, in line with Meta Platform Terms for the Instagram Graph API. We do not knowingly collect data from anyone under 18. If you believe a minor has signed up, email hello@heyy.to and we will delete the account.

11. International data transfers

heyy.to is operated from India. Your data is processed on Cloudflare's global edge network and stored primarily in their Asia-Pacific D1 region. Cloudflare may route requests through other regions for performance and reliability, covered by their data processing addendum.

For EU/UK users: where processors (Cloudflare, Resend, Google, PostHog, Sentry, Razorpay) are based outside the EEA, they operate under either Standard Contractual Clauses or their own GDPR-compliant transfer mechanisms.

12. Changes to this policy

Every version of this policy has a number and an effective date, shown at the top of this page. When a change is material (new categories of data, new processors, changes to retention) we publish a new version. Signed-in Pro accounts that are on an older version see a notice in the dashboard with a Review button, which opens the policy, and an Accept Policy button, which records your acceptance. Not accepting does not block normal use of heyy.to, but AI comment moderation and brand enquiry detection stay off until you accept. Meaning-based keyword matching is part of the current service and is not gated on acceptance.

13. Contact

Questions, concerns, or data requests: hello@heyy.to. We aim to respond within 7 days; for urgent security or deletion requests, please write "urgent" in the subject line.