HeyweiPrivacy policy
Prelaunch documentation. Account deletion and private request intake are awaiting backend activation and verification. The app has not launched publicly.
Effective version 2026-11-11.1
Who operates Heywei
Heywei is an adults-only social app being prepared for the United States. Operator identity and launch arrangements are under review; this is prelaunch documentation. This policy describes the service, including its phone sign-in, profile, discovery, messaging and safety features. Use the Contact and privacy requests page linked with this policy, or Your data in the app, for privacy help. We do not publish the operator’s private enrollment address or phone number.
Information we use
We use a login phone number, optional account email, account identifier, private date of birth and policy acceptance records; your first name, gender, biography, occupation, activities, connection preferences and chosen media; temporary location and visibility choices; Pokes, connections, messages, notification preferences and device push registration; and reports, appeals and safety records. Providers may also process IP addresses and operational logs for delivery, security and reliability. We do not upload your address book or request microphone access for unavailable calling or voice features.
What other people can see
Eligible people may see your profile name, approved photos, public profile details and approximate map position while you choose to be visible. You control whether to display your age. Your date of birth, login phone and account email do not appear on public profiles. A mutual Poke opens chat; it does not reveal an exact map location. Information you choose to put in a profile or message can be read or copied by its recipients.
Location choices
Device location is used to center the map, calculate distances, check the supported area and publish a temporary position when you choose visibility. Discovery requests and stored presence use rounded coordinates at three decimal places. This is approximate relative to device GPS but is Precise Location under Apple’s privacy-label definition. Visibility expires at the chosen time; moving does not extend that original expiry. Hiding, disabling discovery or signing out stops publication. Expired presence records are removed by account maintenance within 24 hours when maintenance is operating. Native map services and map-tile providers receive requests needed to display the map.
Purposes and providers
We use this information to authenticate adults, deliver your chosen nearby experience, personalize discovery to your preferences, deliver messages and notifications, prevent abuse, handle privacy requests and maintain the service. Cloudflare hosts the public policy and contact pages and processes the requests needed to serve them. Supabase hosts account records, authentication, private requests and private media. Twilio is the intended verification-text provider. Expo and the platform push services deliver supported notifications when configured. OpenAI screens selected messages and profile photos for safety; photo screening can use a short-lived private image link. Apple’s native map service and OpenStreetMap tile services support the platform-specific maps. These providers process information needed for their services. The app does not promise end-to-end encryption or that automated screening makes a meeting safe.
Sale, advertising and sensitive information
We do not sell personal information or share it for cross-context behavioral advertising. We do not use an advertising identifier or an advertising-tracking SDK in this version. Location, date of birth, gender and preferences are used for the requested adult social experience, privacy and safety. We do not use them to make decisions about employment, housing, credit, insurance or other consequential eligibility. Any future materially different use requires an updated notice and any legally required choice.
Retention and deletion
Active account and conversation records remain while needed to provide the service. Removed profile-photo metadata does not immediately delete an immutable upload; private replaced or orphan uploads are removed during account deletion. Once deletion is confirmed, discovery and account access are disabled, sessions are revoked and server cleanup removes the Auth account, profile, private date of birth, preferences, related conversations, device registrations and ordinary media. A durable worker retries interrupted cleanup. Confirmed deletion cannot be undone. Previously downloaded copies and recipients’ own records cannot be recalled; short-lived media links or content already in transit may remain until removed or expired.
Limited safety retention
Case evidence is kept while a safety case or appeal is open and for 90 days after resolution, or longer under a documented legal hold. Retained media is isolated from consumer access before ordinary account media is removed. Minimal keyed phone fingerprints can remain while an active ban or protective restriction is in force, and while another active account maintains a block, so deletion and re-registration cannot erase those protections. They do not contain the original phone number, name or date of birth. Completed deletion receipts and retry records are kept for 30 days. Resolved privacy-request records are kept for 90 days. Provider logs and backups follow their actual service configuration; deleted data must not be restored into active use without reapplying deletion records.
Your choices and requests
You can hide from discovery, change supported privacy and notification settings, block or report another account, prepare a copy of currently accessible account records, and initiate account deletion in the app. The account copy is not a complete legal data-access response. Use Contact and privacy requests for access, correction, deletion, restriction, a safety appeal, a larger export or help after losing access. We verify identity before disclosing data or acting on a request; do not send passwords, verification codes or government ID in the form. Applicable law may provide additional access, portability, correction, deletion, objection and appeal rights without discrimination. We respond within the periods required by applicable law and explain any permitted exception or extension.
Security, age and changes
Access controls, private media, moderation and limited staff access protect the service, but no system can guarantee perfect security. The service is for adults 18 and older, not children. Report an account suspected to belong to a minor. We update this notice when practices change and display its version so you can review the current terms before creating a profile.