Privacy Policy

This policy explains what personal data HeyU collects, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It applies to the HeyU app and to the HeyU pages on shadowparticle.com.

The short version

• We collect what HeyU needs to work: your account, the profile you create, your approximate location if you allow it, and what you do in the app.
• Other HeyU users see your profile. They never see your exact location, only a rough distance or area.
• We don't sell your personal data, and we don't use your messages for ads or analytics.
• Analytics and crash reports are off unless you turn them on. In the EU and some other regions, you choose whether ads can be personalised.
• Our servers are run by Google and are located in the United States.
• You can delete your account, and the data that comes with it, at any time in the app.

1. Who we are

HeyU is provided by Shadow Particle AB, organisation number 559230-2052, Östermalmsgatan 66A, 114 50 Stockholm, Sweden. We are the controller of your personal data, which means we decide how and why it's used.

Contact us about privacy at support@shadowparticle.com. We haven't appointed a data protection officer, so your message comes straight to us.

2. What we collect

Your account

When you sign in with Sign in with Apple or Google Sign-In, we receive an account identifier, your email address and your name (with Google, also your profile picture). If you use Apple's Hide My Email, we receive a relay address instead of your real one.

Your email address is never shown to other users. We use it to contact you about your account, for example about a moderation decision.

Your profile

The information you add to your profile:

• Your name, date of birth and gender.
• Your photos (2 to 9).
• Your bio and prompt answers.
• Your tags: what you're looking for, interests, personality and languages.
• Optionally, your relationship status, social media handles (Instagram, TikTok, Twitch, LinkedIn), website and a Spotify track.
• Your choice of how your location is shown (a distance or an area on a map).

Your location

If you allow location access, HeyU uses your device's location to show you people nearby and how far away they are.

Your exact location never leaves your device. Before your location is saved, the app rounds it to a point on a grid about 1 km wide. We also save three area codes derived from it (covering roughly 40 km, 150 km and 1,000 km) that are used to find people near you. That rounded point and those area codes are all we store.

If you turn location off in your device settings, we delete your stored location the next time you open HeyU.

Some location features are your choice in the moment:

• If you send a location in a chat, the person you're chatting with sees the exact point you picked.
• If you pick a place for your feed filters, we save the area around it (about 40 km) with your filter settings. To show the place's name, the map point is sent to Apple.

What you do in HeyU

• The profiles you Like, Save or Pass, and the profiles shown to you in your feed.
• Your Connections, and the messages you send and receive: text, photos, locations, links and Spotify tracks, as well as reactions, when messages were read, and when you're typing.
• When you last used HeyU, which is used for the "Recently active" label.
• Your feed filters and your settings, such as notification and privacy choices.
• The people you block, the reports you make, and feedback you send us.
• When you've accepted updates to these documents.

Verification

If you choose to verify your account, we collect a selfie of you copying a pose we give you, plus the date and the outcome of the review. The selfie is deleted once the review is done.

Purchases

When you buy something, Apple sends us signed information about the purchase: the product, transaction identifiers, dates and, for subscriptions, when the period ends. We use it to give you what you bought. We never receive your payment card details. We also keep your subscription tier and your Saves and Rewinds balances.

Your device

• A notification token and an installation identifier, so we can send you push notifications.
• Your device model and iOS and app versions, as part of crash reports, and in feedback if you choose to include them.
• A check from Apple's App Attest service that the app is genuine. This protects HeyU from fake apps and bots.
• Your IP address, which our service providers see when your app connects to them.

Crash reports, only if you agree

If you turn on Share Crash Reports, we collect:

• Crash reports (Firebase Crashlytics), which describe what went wrong when the app crashed or hit an error, and include your HeyU user ID so we can trace problems.
• Performance data (Firebase Performance Monitoring), which measures things like how fast screens and network requests load, and isn't linked to your account.

Neither ever includes your messages or profile content. We ask when you set up HeyU, and you can change your mind at any time under More, Privacy & Security. Until you agree, crash reports stay on your device and are deleted without being sent.

Analytics, only if you turn it on

If you turn on Share Data for Improvements (More, Privacy & Security), we collect usage events through Google Analytics for Firebase, such as which screens you open and that you made a decision in your feed. The events are linked to your HeyU user ID and your subscription plan. They never contain your messages, profile text, location or other people's identities. This is off by default.

If you've also allowed tracking when iOS asks, we may share these events with Google Ads to measure and improve our own advertising for HeyU. In the EU, the EEA, the UK and Switzerland, this also needs your agreement in your ad choices. Otherwise, these events are only used for analytics.

Advertising

The free version of HeyU shows ads from Google AdMob. Google collects information about your device, your IP address and how you interact with ads.

• Personalised ads. In the EU, the EEA, the UK and Switzerland, you choose whether ads may be personalised, and can change your mind at any time under Ad Privacy Options (More, Privacy & Security).
• Tracking. Google only receives your device's advertising identifier if you allow tracking when iOS asks.
• Free Rewinds. If you watch an ad to earn a free Rewind, we send Google your HeyU user ID, so that Google can confirm to us that you watched it.

From other people

Other users generate information about you when they Like you, message you, block you or report you.

When you contact us

If you email us, we keep the conversation so we can help you.

If you had a HeyU 2.0 account

When HeyU 3.0 replaced HeyU 2.0, we carried over your name, date of birth, gender, photos, bio and the date you joined. Everything else from 2.0 was removed from your profile, and the backup copy of your 2.0 profile that we kept during the move has been deleted. Your profile can appear in HeyU 3.0 feeds, and you can hide or delete it at any time.

3. What other users can see

In the app, other people can see:

• Your profile: your name, age, photos, bio, prompt answers, tags, relationship status, links and Spotify track.
• A Verified badge, if you're verified, and a Plus or Unlimited badge, if you subscribe.
• How far away you are, or a rough area on a map, depending on your setting. The distance is never more precise than about 1 km, and the map area is far wider. People who have their own location turned off don't see your distance.
• "Recently active", if you've used HeyU in the last 24 hours, unless you turn off Show Activity Status.

To show your profile, other people's apps receive your profile information, including details that are used rather than displayed, such as your date of birth (to show your age) and your rounded location (to show a distance).

Likes. When you Like someone, they're told that someone liked them, without your name. People with a Plus or Unlimited subscription can see who liked them in Profile Likes, and your profile may appear in their feed marked as having liked them.

Chats. Your Connections see the messages you send them. They see when you're typing, and if they subscribe, when you've read their messages.

Hiding your profile. If you turn off Show Me in Feeds, you won't appear in anyone's feed, Saved Profiles, Profile Likes or Feed History. Your existing Connections can still see you and chat with you.

Blocking. You and anyone you block can no longer see each other in the app.

4. Why we use your data, and our legal basis

Under the EU General Data Protection Regulation (GDPR), we need a legal basis for each use of your data.

To provide HeyU (contract)

Creating and running your account, showing your profile, building your feed, forming Connections, delivering messages and notifications, giving you what you've bought, and responding when you contact us. We need this data to provide the service you signed up for.

With your consent

• Location, when you allow it in iOS.
• Push notifications, when you allow them in iOS.
• Analytics, when you turn on Share Data for Improvements.
• Ad measurement with Google Ads, when you've turned on analytics and allowed tracking (and, in the EU, the EEA, the UK and Switzerland, agreed in your ad choices).
• Crash reports and performance data, when you turn on Share Crash Reports.
• Personalised ads and tracking, when you agree to them.
• Verification, when you choose to get verified.
• Sensitive information you choose to put in your profile (see section 5).
• Device details in feedback, when you choose to include them.

You can withdraw your consent at any time, in the app or in your device settings. This doesn't affect anything we did before you withdrew it.

For our legitimate interests

• Keeping HeyU safe: automatically checking photos, reviewing verifications and reports, enforcing our rules, and keeping records of reports and decisions so we can spot repeated abuse.
• Protecting HeyU from fraud and abuse: checking that the app is genuine, verifying purchases, and making sure a purchase or reward is only ever credited once.
• Keeping HeyU working: server logs, so we can find and fix problems.
• Funding the free version with ads, where personalisation doesn't require your consent.
• Improving HeyU from the feedback you send us.
• Protecting our rights if there's a legal claim.

We've weighed these interests against your rights, and you can object to them at any time (see section 10).

To meet legal obligations

For example, responding to lawful requests from authorities, informing the police when someone's life or safety is at risk, and keeping records the law requires.

5. Sensitive information

Your profile is yours to shape. If you choose to share something sensitive in it, for example in your bio or prompt answers, such as your religion, your health or your sexual orientation, it will be visible to other users like the rest of your profile. We only use it to show your profile as you've asked, and you can remove it at any time.

6. Automated decisions

Your feed is put together automatically. We consider things like how close people are, the filters you've set, how recently people have been active, whether someone has liked you, and some randomness, so you see a mix of profiles. Some profiles are chosen for variety, outside your filters.

Photo checks are automated. When you add a profile photo, Google Cloud Vision checks whether it contains a face and whether it's likely to be explicit or violent. If it fails, the photo is rejected and you can choose another. This check only detects that a face is present. We don't use facial recognition, and we don't create a template of your face. When you verify, a person compares your selfie with your profile photos.

None of these automated steps makes a decision with legal or similarly significant effects on you. If you think a photo was rejected by mistake, contact us and a person will look at it.

7. Who we share data with

We don't sell your personal data. We share it only as described here.

Service providers who work for us

These companies process data on our behalf, under contracts that require them to protect it and use it only to provide their service to us:

• Google (Firebase and Google Cloud): hosting our database and file storage, running our servers, sign-in, sending notifications, crash reports and performance data, app integrity checks, automated photo checks, and analytics if you've turned it on.
• Apple: delivering push notifications, App Attest integrity checks, and maps.

Companies that are responsible for their own processing

These companies use data under their own privacy policies:

• Apple, for Sign in with Apple and App Store purchases. See Apple's Privacy Policy.
• Google, for Google Sign-In, for the ads in HeyU (AdMob) and, if you've allowed tracking, for measuring our own advertising for HeyU (Google Ads). See how Google uses data from apps.
• Spotify, when a Spotify track is shown to you in a profile or chat. The app then loads Spotify's player, and Spotify receives your IP address and device information and may store cookies in the app. See Spotify's Privacy Policy.
• Websites linked in profiles and chats. To show a preview of a link, your device loads the page from that website, which then sees your IP address.

Notifications

If you turn on message notifications, a notification shows the sender's name and the start of the message. It's delivered through Google's and Apple's notification services and can show on your lock screen. You can hide previews in your iPhone's notification settings.

Authorities and legal reasons

We share data when the law requires it, for example in response to a valid order from a court or the police. We also share it when we believe it's necessary to protect someone's life or safety, or to defend our legal rights.

If HeyU changes hands

If Shadow Particle AB, or HeyU, is sold or merged, your data may be transferred to the new owner, who must respect this policy.

Inside Shadow Particle

Only authorised people at Shadow Particle can access our systems, and only to run and protect HeyU. We don't read your messages as part of running HeyU. We only access them if the law requires it, or if it's needed to investigate a serious threat to someone's safety.

8. Where your data is stored

HeyU's database, file storage and servers are run by Google in the United States. Some of our other providers may also process data outside the EU and EEA.

When data is transferred outside the EU and EEA, it's protected by the EU-US Data Privacy Framework, which Google participates in, and by the European Commission's Standard Contractual Clauses, which Google and Apple use in their data processing terms. Contact us for more information about these safeguards.

9. How long we keep your data

We keep your personal data for as long as your account exists, and delete it when you delete your account. Some things are deleted sooner, and a few are kept longer:

• Verification selfies are deleted as soon as the review is done.
• Rejected photos are deleted straight away, and photos you remove from your profile are deleted when you save your changes.
• Your stored location is deleted the next time you open HeyU after you turn off location access.
• Chats are deleted, for both people, when either of you blocks the other or deletes their account. If you remove a Connection, the chat closes for both of you, and its messages are deleted when either of you blocks the other or deletes their account.
• Crash reports are kept for 90 days. Analytics data, if you've turned it on, is deleted within 14 months. Server logs are kept for 30 days.
• Reports and moderation decisions are kept for as long as they're needed to keep HeyU safe, for example to recognise someone who returns after a ban, or to deal with a legal claim. We review them regularly and delete those we no longer need.
• Feedback is kept while it's useful for improving HeyU.
• Purchase records. A record of each purchase and ad reward is kept so it can never be credited twice. When you delete your account, the record is no longer linked to your HeyU account.

What happens when you delete your account

When you delete your account in the app, we delete your profile, photos, Connections and chats, Likes, Saves and history, verification data, and your sign-in account, straight away. Your remaining Saves and Rewinds are lost.

A few things remain:

• Reports, moderation records and feedback, as described above.
• Other users' own records may still contain your user ID, a random code, for example in their history of profiles they've decided on. Your profile itself is gone.
• Notifications already delivered to other people's devices.
• Deleted data takes time to be removed from our providers' systems and backups. For Google Cloud, this is typically completed within about six months.

Deleting your account does not cancel an active subscription. Cancel it in your Apple account settings.

10. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you, and get a copy of it.
• Correct data that's wrong. You can edit most of your profile yourself in the app.
• Delete your data. You can delete your account yourself in the app.
• Restrict how we use your data in some situations.
• Data portability: get the data you gave us in a machine-readable format.
• Object to our use of your data based on legitimate interests. We'll stop unless we have compelling reasons that override your interests, or need the data for a legal claim.
• Withdraw consent at any time.
• Not be subject to decisions based solely on automated processing that significantly affect you.

To use your rights, email support@shadowparticle.com from the email address linked to your Apple or Google sign-in, so we can confirm it's you. If you use Hide My Email, tell us, and we'll find another way to confirm it's you. We'll respond within one month.

You also have the right to complain to a data protection authority. In Sweden, that's the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se. You can also contact the authority where you live or work. We'd appreciate the chance to help first, though.

11. Your controls in the app

Under More, Privacy & Security you can:

• Turn Show Me in Feeds off to hide your profile from feeds.
• Turn Show Activity Status off to hide "Recently active".
• Turn Share Data for Improvements (analytics) on or off.
• Turn Share Crash Reports on or off.
• Choose whether others see your distance or an area on a map, and manage location access.
• Change your ad choices under Ad Privacy Options, where your region offers them.
• Manage the people you've blocked.
• Delete your account.

Under More, Notifications you choose which notifications you get.

12. Security

We protect your data with encryption in transit and at rest, strict access rules on our database and file storage, server-side checks for anything that affects safety or purchases, and app integrity checks.

Messages are encrypted on their way to and from our servers, but they're not end-to-end encrypted. They're stored on our servers so they can be delivered and synced.

No system is completely secure. If a breach affects your personal data, we'll notify you and the authorities as the law requires.

13. Age limit

HeyU is only for people who are 18 or older, and we don't knowingly collect data from anyone younger.

HeyU 2.0 was open to people from 16, so some accounts carried over from 2.0 belong to people who aren't 18 yet. Those profiles are hidden from everyone, and the account can't be used until the person turns 18. While it waits, we don't collect any new data from it, such as activity or location. The account holder can delete it at any time from the app.

If we learn that someone under 18 has created a HeyU account, we close it and delete their data. If you think someone on HeyU is under 18, please report them.

14. Our website

The HeyU pages on shadowparticle.com don't use cookies, analytics or third-party trackers. The site stores a small setting in your browser, so an intro animation only plays once per visit. Our hosting provider, Google, processes your IP address to deliver the pages.

15. Changes to this policy

We may update this policy, for example when we add features or when the law changes. We'll update the date at the top. If a change is significant, we'll tell you in the app before it takes effect.

16. Contact

Shadow Particle AB, organisation number 559230-2052

Östermalmsgatan 66A, 114 50 Stockholm, Sweden

Email: support@shadowparticle.com