Privacy Policy

Last updated: October 13, 2026

This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You.

We use Your Personal data to provide and improve the Service. By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy.

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

  • Account means a unique account created for You to access our Service or parts of our Service.
  • Affiliate means an entity that controls, is controlled by or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.
  • Application refers to HeyMe, the software program provided by the Company.
  • Company (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to HeyMe.
  • Country refers to: United Kingdom
  • Device means any device that can access the Service such as a computer, a cellphone or a digital tablet.
  • Personal Data is any information that relates to an identified or identifiable individual.
  • Service refers to the Application.
  • Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used.
  • Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
  • You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Collecting and Using Your Personal Data

Types of Data Collected

Local Content Data

While using Our Service, you create and store content locally on your device, including:

  • Chat messages and notes you create within the app
  • Chat categories and organization you set up
  • App preferences and settings

Important: All your content data is stored exclusively on your device. We do not transmit, access, or store your personal messages or notes on our servers.

Technical Data

We may automatically collect certain technical information, including:

  • Device type and operating system information
  • App usage analytics for improving our service
  • File metadata for app functionality
  • Crash reports and error logs

Purchase Data

When you make in-app purchases, we collect purchase-related information through our payment processor RevenueCat, including:

  • Purchase history and transaction details
  • App Store receipts for subscription validation
  • Device identifiers for fraud prevention (when linked to purchases)
  • Subscription status and entitlements

Analytics Data

We use PostHog as our analytics provider to understand how the Service is used and to improve it. PostHog collects:

  • App usage events (e.g. screens viewed, features used)
  • Device type and operating system information
  • Session information (e.g. session duration, app open/close events)
  • A pseudonymous user identifier (see "How We Link Your Data" below)

PostHog does not collect your name, email address, or the content of your messages and notes.

Support Correspondence

When you email us at support@bitoverloaded.com, we collect:

  • Your email address and any name you include
  • The content of your message and any attachments you send

We use this only to respond to your enquiry and to keep a record of the support we have given. We keep support emails for up to 2 years, unless you ask for earlier deletion.

Featurebase (Feedback and Changelog)

Our feedback board and changelog are hosted by Featurebase. If you post, vote or comment there, Featurebase collects the details you provide (such as your name or email address and what you post) under its own privacy policy.

Website

Our website uses PostHog (EU, Frankfurt) for cookieless analytics: it counts page views without setting cookies or identifying you across visits. Our hosting provider, Vercel, keeps server logs (such as your IP address, browser type and the pages requested) to deliver and secure the site.

The website sets no cookies. The only thing it stores in your browser is your light or dark theme choice, in local storage, so the site looks the way you left it. This is a strictly necessary preference that stays on your device and is never sent to us.

How We Link Your Data

To understand how users interact with the Service and to correlate subscription status with app usage, we use the anonymous identifier generated by RevenueCat as a pseudonymous identifier in PostHog. This means:

  • A single anonymous identifier links your purchase data (in RevenueCat) to your usage analytics (in PostHog)
  • This identifier is not linked to your name, email, Apple ID, or any other personally identifiable information
  • If you restore a purchase on a new device, the identifier may change as RevenueCat reconciles your subscription. In this case, analytics data captured before the restore may not be linked to your ongoing profile
  • We use this linked data solely to improve the Service, understand feature usage among free and paying users, and inform product decisions

How We Use Your Data

Local Content Data

  • All messages and notes remain on your device only
  • Data may sync via your personal iCloud account (Apple's service) if enabled
  • Used solely for app functionality and your personal use

Technical Data

  • Used to improve app performance and fix bugs
  • Used for analytics to understand app usage patterns
  • Used to ensure app functionality and security

Purchase Data

  • Used for fraud prevention and security
  • Used for analytics to improve our subscription offerings
  • Required to unlock premium features and maintain your subscription status

Analytics Data

  • Used to understand how users interact with the Service
  • Used to identify and fix usability issues
  • Used to inform product development decisions
  • Used to measure the impact of new features

Support Correspondence

  • Used to respond to your enquiries and provide support
  • Used to keep a record of the help we have given
  • Retained for up to 2 years unless earlier deletion is requested

Website

  • Cookieless analytics are used to understand which pages are visited and to improve the site
  • Hosting logs are used to deliver the site and keep it secure

Data Sharing and Third Parties

RevenueCat (Payment Processing)

  • We use RevenueCat as our payment processor for in-app purchases
  • RevenueCat is based in the United States and processes purchase data on AWS servers located in the United States
  • RevenueCat processes purchase data on our behalf to manage subscriptions
  • RevenueCat generates anonymous user identifiers, which we also use for analytics purposes (see "How We Link Your Data" above)
  • RevenueCat does not sell or share your personal data for advertising purposes
  • RevenueCat acts as a data processor, not a data controller
  • We have a Data Processing Agreement (DPA) in place with RevenueCat, which includes Standard Contractual Clauses (SCCs) for international data transfers
  • For more information, see RevenueCat's Privacy Policy

PostHog (Analytics)

  • We use PostHog to collect anonymised usage analytics
  • PostHog is hosted in the European Union (Frankfurt, Germany), meaning your analytics data does not leave EU jurisdiction
  • PostHog receives the pseudonymous identifier generated by RevenueCat, along with app usage events and device information
  • PostHog does not receive your name, email, Apple ID, or the content of your messages and notes
  • PostHog processes this data on our behalf to provide analytics dashboards and insights
  • PostHog acts as a data processor, not a data controller
  • We have a Data Processing Agreement (DPA) in place with PostHog
  • For more information, see PostHog's Privacy Policy

Apple (iCloud Sync)

  • If you enable iCloud sync, your content data may be stored in your personal iCloud account
  • This is governed by Apple's Privacy Policy, not ours
  • We do not have access to your iCloud data

Featurebase (Feedback and Changelog)

  • Our feedback board and changelog are hosted by Featurebase
  • Anything you post or vote on there is handled by Featurebase under its privacy policy

Vercel (Website Hosting)

  • Our website is hosted by Vercel, which processes server logs (such as IP address, browser type and pages requested) on our behalf
  • Vercel acts as a data processor, and we have a Data Processing Agreement (DPA) in place with Vercel
  • For more information, see Vercel's Privacy Policy

Support Email

  • Support emails are handled through our email provider and used only to respond to you

No Other Sharing

  • We do not sell, rent, or share your personal data with other third parties
  • We do not serve advertisements in our app
  • We do not use analytics or tracking services for your content data (messages and notes)

Data Retention

Local Content Data

  • Remains on your device until you delete it
  • You can delete individual messages, chats, or all app data through device settings
  • Data persists as long as the app is installed

Purchase Data

  • Retained by RevenueCat for subscription management and legal compliance
  • You can request deletion of purchase data by emailing us at support@bitoverloaded.com
  • Apple maintains separate transaction records per their policies

Analytics Data

  • Usage analytics are retained in PostHog for as long as necessary to fulfil the purposes described in this policy
  • Analytics data is pseudonymous and not linked to your personal identity
  • You can request deletion of your analytics data by emailing us at support@bitoverloaded.com

Support Correspondence

  • Retained for up to 2 years for support purposes
  • You can request deletion of your support emails at any time

Security

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.

  • All local data is protected by your device's security measures
  • Purchase data is encrypted during transmission
  • Analytics data is transmitted securely to PostHog's servers
  • We implement industry-standard security practices

International Data Transfers

Our analytics provider PostHog is hosted in the European Union (Frankfurt, Germany). For users in the UK and EEA, this means your pseudonymous analytics data remains within EU jurisdiction and no international transfer mechanism is required. The UK has an adequacy decision with the EU, so UK-to-EU transfers are permitted without additional safeguards.

Our website host Vercel may process website server logs in the United States. Our DPA with Vercel includes Standard Contractual Clauses (SCCs) as approved by the UK and EU for these transfers.

Our payment processor RevenueCat is based in the United States, and all purchase-related data is processed on AWS servers located in the United States. If you are located in the United Kingdom, European Economic Area, or Canada, this means your purchase data is transferred to and stored in the United States. We ensure appropriate safeguards are in place for these transfers:

  • RevenueCat's Data Processing Agreement includes Standard Contractual Clauses (SCCs) as approved by the UK and EU for international transfers
  • RevenueCat acts as a data processor and processes your data only in accordance with our instructions and the terms of the DPA
  • Only purchase-related and subscription data is transferred to the United States — your messages, notes, and content remain on your device and are never sent to our or RevenueCat's servers

For users located in the United States or Canada, no international transfer restrictions apply to RevenueCat's processing. Your PostHog analytics data is processed in the EU, which provides a high standard of data protection.

Legal Basis for Processing (UK GDPR)

We process your data on the following legal bases:

  • Contract performance: Purchase data is processed to fulfil your subscription and provide premium features
  • Legitimate interest: Analytics data is processed to improve the Service, understand usage patterns, and fix bugs. We have assessed that this processing is necessary for our legitimate interests and does not override your rights, given that the data is pseudonymous and not linked to your identity
  • Legitimate interest: Support emails and website hosting logs are processed to answer your questions and to deliver and secure the website

Your Privacy Rights

You have the right to:

  • Delete all local app data at any time
  • Request deletion of purchase data by emailing us at support@bitoverloaded.com
  • Request deletion of analytics data by emailing us at support@bitoverloaded.com
  • Manage subscription settings through your Apple ID account
  • Object to processing based on legitimate interest
  • Request information about what data we hold about you
  • Request deletion of your support emails
  • Request information about what support correspondence we hold
  • Lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated

Your Privacy Rights (California, USA — CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

  • Right to know: You can request details about the categories and specific pieces of personal information we have collected about you
  • Right to delete: You can request deletion of the personal information we hold about you
  • Right to opt out of sale or sharing: We do not sell or share your personal information for cross-context behavioural advertising
  • Right to non-discrimination: We will not discriminate against you for exercising your privacy rights

To exercise these rights, please email us at support@bitoverloaded.com.

Your Privacy Rights (Canada — PIPEDA)

If you are a Canadian resident, the Personal Information Protection and Electronic Documents Act (PIPEDA) provides you with rights regarding your personal information, including the right to access, correct, and request deletion of your data. Our data practices — including pseudonymous analytics collection and local-first storage — are designed to align with PIPEDA's principles of limited collection, purpose limitation, and consent. To exercise your rights, please email us at support@bitoverloaded.com.

Children's Privacy

Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please email Us at support@bitoverloaded.com. If We become aware that We have collected Personal Data from anyone under the age of 13 without verification of parental consent, We take steps to remove that information from Our servers.

If We need to rely on consent as a legal basis for processing Your information and Your country requires consent from a parent, We may require Your parent's consent before We collect and use that information.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top of this Privacy Policy.

Important: Since our app uses anonymous user identifiers and we do not collect your contact information through the app, we cannot directly notify you of privacy policy changes via email. We recommend periodically checking this page for updates, especially before app updates.

For significant changes that materially affect your privacy rights, we will also display a notice within the app when you next open it.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, You can contact us:

This privacy policy is designed to comply with Apple App Store requirements, UK GDPR, CCPA/CPRA, PIPEDA, and other applicable privacy laws. It accurately reflects our data collection practices for a local-first application with subscription functionality and pseudonymous analytics.