Contents
When you register, you choose a screenname. We construct a synthetic internal email address
({screenname}@hiitsme.app) used only by our authentication system — it is never shown publicly and
has no mailbox. If you add a real email address for password-reset purposes, we store that too.
We also store a hashed password (we never store or see your plaintext password),
a profile bio and status message that you choose to share, and an optional
avatar image you upload.
We store the content of direct messages you send and receive, and messages you post in chat rooms. This includes message body text, timestamps, delivery and read-receipt metadata, reply and forward references, emoji reactions, and edits or deletions. If you send media attachments (images, video, audio, documents up to 10 MB), those files and their metadata (filename, size, MIME type, dimensions) are stored.
Messages you mark as disappearing are assigned an expiry timestamp. Automated deletion of expired messages is a planned feature; until implemented, content may persist past the expiry time.
We store your buddy list (who you have added), connection status (following / pending / mutual), and block records including any optional reason you provide (up to 240 characters). Trust & safety abuse reports you file or receive are stored with category, detail text (up to 1,200 characters), and moderation status.
We collect last-active timestamps, idle timestamps, your current room memberships and last-seen position in each room, and unread-message state. These power the live buddy-list and room-presence features.
When you grant notification permission, we store your APNs device token (iOS), the platform (ios / android / web), and whether the token is for sandbox or production. Stale tokens are automatically removed when Apple reports them as invalid. We do not collect your device model, OS version, advertising ID, or any other device identifier beyond what is needed for notification delivery.
We store your privacy preferences: whether to share read receipts, your notification preview mode (full message, name only, or hidden), whether the screen shield (screenshot blocker) is enabled, and per-conversation DM preferences. We also store a discoverability flag controlling whether your account appears in search results.
Our authentication provider (Supabase) logs the IP address associated with each sign-in and session refresh. Our web hosting and API infrastructure (Vercel) logs IP addresses for inbound requests. These logs are retained per our sub-processors' standard log retention policies and are used solely for fraud detection, abuse prevention, and security investigation.
On the web version of H.I.M., we use Vercel Analytics to collect anonymised page-view events and device-type breakdowns. No cookies are set for analytics purposes.
We do not use your data for advertising, do not sell it to third parties, and do not build advertising profiles.
If you are in the European Economic Area or the United Kingdom, we rely on the following lawful bases:
We process this data only to provide the core features of the app you chose to use. We apply the following additional safeguards:
We process special-category data on the basis of your explicit consent given when you create an account and voluntarily share this information with other users, and/or because you have manifestly made this information public through your use of the service (Art. 9(2)(a) and/or Art. 9(2)(e)).
When you enable push notifications, H.I.M. sends alerts when buddies send you a message. The notification payload includes the sender's screenname and — depending on your privacy setting — a preview of the message (up to 140 characters).
Your notification preview mode controls what appears on your lock screen:
Lock-screen privacy notice: Notification banners and the lock screen are visible to anyone with physical access to your device. If you are in a situation where others can see your screen, select Sender only or Hidden to prevent message content or contact identities from being exposed. The Hidden mode shows only a generic "New message" alert with no identifying information.
You can change this setting at any time in Account → Notification previews. You can disable all push notifications at any time in iOS Settings → H.I.M. → Notifications. Disabling notifications does not delete your account or any data.
We do not use push notifications for marketing. Notifications are sent only in direct response to messages you receive from other users.
H.I.M. uses no cookies. We use browser localStorage to store data
directly on your device. This data is never shared with third parties for advertising or tracking.
All items in the table below are strictly necessary to deliver the service.
The web app does not set cookies. The iOS and Android apps use the same localStorage-equivalent mechanism provided by Capacitor, scoped to the app's sandbox.
| Key | Purpose | Expiry | Strictly necessary |
|---|---|---|---|
sb-*-auth-token |
Supabase authentication session (access token + refresh token) | Cleared on sign-out; refresh token rotates periodically | Yes — authentication |
hiitsme_theme |
Your color-scheme preference (light / dark / system) | Until you change it or clear browser data | Yes — UI rendering |
hiitsme:away-presets:{userId} |
Your saved away-message presets | Cleared on sign-out | Yes — core messaging |
hiitsme:away-settings:{userId} |
Auto-away configuration (threshold, auto-reply enabled) | Cleared on sign-out | Yes — core messaging |
hiitsme:away-cooldowns:{userId} |
Timestamps that throttle auto-reply frequency | Cleared on sign-out | Yes — prevents reply spam |
hiitsme:buddy-sort:{userId} |
Buddy-list sort order preference | Cleared on sign-out | Yes — UI state |
hiitsme:outbox:v1:{userId} |
Offline message queue for reliable delivery when network is lost | Cleared on delivery or sign-out | Yes — offline messaging |
hiitsme_rich_text_format |
Message composer format state (bold, italic, etc.) | Until changed or browser data cleared | Yes — UI state |
hiitsme:dm-preferences:v1:{userId} |
Per-conversation preferences (pinned, muted, archived, chat theme) | Cleared on sign-out | Yes — core UX |
hiitsme:privacy:v1:{userId} |
Local cache of your privacy settings for faster rendering | Cleared on sign-out | Yes — privacy-sensitive UI |
hiitsme:app-lock:v1:{userId} |
App-lock settings: enabled flag, SHA-256 PIN hash (never the raw PIN), auto-lock duration, biometrics flag | Cleared on sign-out | Yes — security |
storage_notice_acknowledged |
Records that you dismissed the storage disclosure notice (EU/EEA/UK users only) | Until browser data cleared | Yes — prevents repeat notices |
All per-account keys (those ending in :{userId}) are removed automatically when
you sign out. You can also clear all locally stored data at any time through your browser or
device settings:
Clearing local data signs you out on that device. Your account and messages remain on our servers until you delete your account through Settings → Delete account.
Because all storage is strictly necessary to run the service, no consent toggle is required under ePrivacy rules. EU/EEA/UK users see a one-time notice when they first visit the app.
We use the following third-party services that process personal data on our behalf. All transfers of EEA/UK personal data to processors in the United States are conducted under appropriate transfer mechanisms (Standard Contractual Clauses or equivalent).
| Sub-processor | Purpose | Location | Transfer mechanism | Data processed |
|---|---|---|---|---|
| Supabase, Inc. SOC 2 Type II |
Database, authentication, file storage, realtime messaging, edge functions | US (AWS us-west-2) | Standard Contractual Clauses (SCCs) | All user account data, messages, media files, push tokens, trust & safety records |
| Vercel, Inc. SOC 2 Type II |
Web hosting, serverless API functions, web analytics | US (edge network: global) | Standard Contractual Clauses (SCCs) | IP addresses and user-agent strings (web); push notification payloads routed via Vercel Functions; anonymised page-view analytics |
| Apple Inc. — APNs | iOS push notification delivery | Apple global infrastructure | Apple Developer Program License Agreement (DPLA) | Device push token; notification payload (sender name and, based on your privacy setting, a message preview) |
| Google LLC — Google Fonts | Web font delivery on privacy and terms pages | US (Google global CDN) | Standard Contractual Clauses (SCCs) | IP address at font load time (privacy.html and terms.html only; not loaded by the app itself) |
| Google LLC — Firebase Cloud Messaging (FCM) (planned) | Android push notification delivery | US (Google global infrastructure) | Standard Contractual Clauses (SCCs) | Device push token; notification payload (when Android push is shipped) |
All libraries used in the app that operate solely on your device (Capacitor, jose, @aparajita/capacitor-biometric-auth, bad-words) transmit no data to third parties and are not listed above.
This table is generated from
docs/compliance/sub-processors.json.
To update it, edit that file and re-run
node scripts/render-subprocessors.mjs.
| Data category | Retention window | How enforced |
|---|---|---|
| Account & profile | Until you delete your account | Account-deletion flow |
| Direct messages & room messages | Until the sender or recipient deletes their account | Account-deletion flow (cascade) |
| Media attachments | Until the message is deleted or account deleted | Account-deletion flow |
| Push notification tokens | 90 days since last registration, or until account deletion | Automated daily cleanup job |
| Blocks | Until you unblock the user or delete your account | Account-deletion flow |
| Abuse reports (closed — reviewed or dismissed) | 24 months from submission | Automated daily cleanup job |
| Abuse reports (open or actioned) | Retained for legal-obligation purposes (safety & DSA compliance) | Manual review process |
| Account deletion records (internal) | 30 days after account deletion | Automated daily cleanup job |
| Server logs (authentication, API) | Per our infrastructure providers' standard policies | Supabase / Vercel managed |
| Analytics (web only, anonymised) | Per Vercel Analytics' retention policy | Vercel managed |
| On-device data (localStorage) | Until you uninstall the app or delete your account | OS / user action |
Retention windows are enforced by an automated daily cleanup job. Disappearing messages have sender-set expiries; automated purge of those records is a planned feature.
Depending on where you live, you may have some or all of the following rights regarding your personal data. To exercise any right, contact us at support@hiitsme.app. We will respond within 30 days (GDPR) or 45 days (CCPA/CPRA).
We will not discriminate against you for exercising any of these rights.
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you additional rights.
We collect identifiers (screenname, synthetic email), internet or network activity (IP address, session data), geolocation data (city-level, derived from IP by our infrastructure providers), and the contents of messages and communications. Messages, room memberships, and social-graph data may constitute Sensitive Personal Information under the CPRA because they reveal the contents of communications and, in the context of this app, may reveal information about sexual orientation or gender identity.
We do not sell your personal information and do not share it with third parties for cross-context behavioral advertising. You do not need to take any action to opt out.
As a California resident, you have the right to request that we limit our use of sensitive personal information to the purposes permitted by the CPRA (i.e., providing the service you requested). We already limit our use of sensitive personal information in this way. To exercise this right formally, contact support@hiitsme.app.
You have the right to know what personal information we collect, delete your personal information, correct inaccurate information, and opt out of the sale or sharing of personal information. To exercise these rights, contact support@hiitsme.app or use the in-app account deletion flow.
H.I.M. is intended for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If we learn that a user under 18 has created an account, we will delete the account and all associated data. If you believe a minor has created an account, please contact support@hiitsme.app.
We may update this policy from time to time. When we make material changes, we will update the effective date at the top of this page. We encourage you to review this policy periodically. Continued use of the app after the effective date of an updated policy constitutes acceptance of the changes.
H.I.M. is operated by Saman Technologies LLC, the data controller for the purposes of this policy. Privacy questions, data-subject requests, and complaints: support@hiitsme.app