Privacy Policy

HeyHey is a messenger for journalists and their sources. This page explains, in plain words, what we keep and what we cannot see.

Last updated: 30 October 2026

Who we are

HeyHey is run by Zanko, an independent journalist based in France. For any question about your data, write to privacy@heyhey1.com.

What we cannot see

• The content of your messages. Messages are sealed on your device with the public key of the person you write to, and opened only on their device. Our server stores sealed data it cannot read.
• Your private keys. They are created on your device and stay there. We never receive them.
• The content of locked calls. When the lock is on, audio and video are encrypted between the devices in the call.

What we can see

• Your email address, which you give when you create an account.
• Your account details, such as the name and picture you choose, and your password in protected (hashed) form.
• Message metadata: when a message is sent and between which accounts. Not what it says.
• Call metadata: that a call took place, when, and which accounts took part. If a call is not locked, the call provider can technically carry unencrypted media, so use the lock for sensitive calls.
• Basic technical data such as IP address and device type, which our service providers receive when your app connects to them.

Why we use this data

Only to run HeyHey: to create your account, deliver messages and calls, keep the service secure, prevent abuse, and answer your requests. We do not sell your data. We do not show ads. We do not use your data to profile you.

Who helps us run HeyHey

We use a small number of providers who process data only on our instructions: a database and sign-in provider (Supabase), a calls provider (LiveKit), an email delivery provider for sign-in and confirmation emails, and Cloudflare to host this website. They may process data outside your country. Where that happens we rely on the legal safeguards the law requires.

How long we keep it

We keep your account data while your account exists. When you ask us to delete your account, we delete your account data and your sealed messages, except what we must keep by law or to protect the service from abuse, which we keep only as long as needed.

Your rights

Under European data protection law (GDPR) you can ask to see your data, correct it, delete it, receive a copy, limit or object to its use. Write to privacy@heyhey1.com and we will answer within one month. If you think we handled your data badly, you can complain to the CNIL, the French data protection authority (cnil.fr).

This website

This website does not use advertising or tracking cookies. It stores your language choice and your sound setting on your own device only. It is hosted by Cloudflare, which processes technical data such as IP addresses to deliver and protect the site.

Safety limits you should know

No tool can promise perfect safety. If your phone or computer is infected, stolen, or someone has your password, they can read what you can read. Keep your device updated, use two-step login, and keep your keys safe. HeyHey cannot recover messages if you lose your keys.

Children

HeyHey is not meant for people under 16, and we do not knowingly collect their data.

Changes

If we change this policy in a way that matters, we will say so in the app or by email before it applies.