Privacy Policy

What we collect

Account data: your email address, display name, hashed password (or the sign-in provider you used) and plan. Usage data: the projects, jobs, credit ledger entries and settings you create in the studio or the HeyBop mobile app. Technical data: IP address, browser or device type and approximate region, used for security and abuse prevention. If you turn on notifications in the mobile app, we store a push token for your device. Web payments are processed by Stripe. Where in-app purchases are enabled, Apple or Google processes the payment. We record purchase identifiers, products, quantities and refund status to deliver credits and prevent abuse; we never see or store your full card number. After account deletion, we keep store transaction records without a link to the deleted profile to prevent receipt reuse.

Media you provide: audio tracks, lyrics, reference images, voice samples and prompts you upload or type. Media we generate for you: videos, songs, voice-overs and their intermediate scenes.

How generation works and where media goes

To create your videos, songs and voice-overs, HeyBop shares the necessary prompts, images, audio, lyrics or text with service providers. They process these inputs under their own terms and privacy policies. Your results are saved in your library.

Your media and project information are stored with your account so you can review, edit and export your work.

Service providers

We use service providers for hosting, payments, sign-in, email, mobile notifications, generation and advertising measurement. They receive only the information needed to provide their service for us.

Voice cloning and consent

Voice cloning is only available for voices you are entitled to use: your own voice, or another person's voice with their explicit, documented consent. By uploading a voice sample you confirm that this is the case. We may ask you to record a consent statement, and we will remove cloned voices and suspend accounts on credible reports of misuse.

How we use data

To provide the service, bill credits, show your ledger, prevent fraud and abuse, review content reports, respond to support requests, and send transactional messages (receipts, password resets, security notices, and a notice when a video you started is ready). We do not sell personal data. We do not use your uploaded or generated media to train models. Aggregated, non-identifying usage statistics may be used to improve the product.

Retention and deletion

Projects and media remain until you delete them or your account. Deleting a project removes its media from active storage within 24 hours and from backups within 30 days. Credit ledger records are retained for seven years for accounting purposes. You can delete your account at any time — on the web in Settings, or in the mobile app under Account → Delete account — or by emailing privacy@heybop.ai. Deleting your account cancels any subscription, removes your media and personal data, and keeps only records we are legally required to keep.

Cookies

HeyBop uses a session cookie to keep you signed in, a cookie that remembers an invite code for 30 days when you arrive through a friend's link, a first-party cookie that remembers for 90 days how you first found HeyBop (the link, website or search that sent you, and your browser's language and time zone), which is saved with your account when you sign up, together with the type of device you signed up on, a cookie that remembers a promo code from a promo link for 30 days so it can be applied to your account, and a setting that remembers your language. A first-party browser-session cookie also connects sample playback, music preview, photo readiness and setup confirmation to sign-up. HeyBop stores these milestones without photos, filenames, names, prompts or song URLs, and does not send them to Meta. A cookie also remembers your choice about ad measurement. On heybop.ai and app.heybop.ai, Meta's advertising cookies (_fbp, _fbc) are used through the Meta Pixel to measure our ads — see “Advertising measurement” below. The HeyBop mobile app uses no advertising cookies or tracking pixels.

A first-party browser identifier lasts up to 90 days and is renewed when you visit. It connects recorded page visits across sessions to your account when you sign up or sign in, so our team can understand your journey and provide support. Page records omit query parameters and fragments. This identifier and these internal journey records are not sent to Meta.

Advertising measurement

To learn which of our ads bring people to HeyBop, heybop.ai and the studio at app.heybop.ai use the Meta Pixel, and our servers send the same events to Meta through its Conversions API. Meta receives the pages you view and the moments you create a draft on heybop.ai/create, sign up, start a checkout or pay (with the price and whether it was a plan, a credit pack or a gift). To match these events to ad clicks we send your email address and account ID only as SHA-256 hashes, together with your IP address, your browser's user agent and Meta's own cookies. We never send your songs, photos, prompts, videos or card details. Meta Platforms processes this data under its own privacy policy.

If your browser's time zone is in Europe (the EU, EEA, UK and Switzerland), the Pixel only loads after you choose Accept in the banner. Everywhere else it is on by default, and you can turn it off at any time with the “Do not sell or share my data” switch below, in the site footer or in the studio's Settings; the choice covers heybop.ai and app.heybop.ai in that browser, and our servers stop sending your events too. If your browser sends Global Privacy Control or Do Not Track, ad measurement stays off.

We also use the AppLovin Pixel on our website and studio to measure page and gift-offer views, registration, checkout and confirmed purchases. AppLovin receives technical information such as your IP address, browser information and its advertising identifiers (including _axwrt), plus product identifiers, payment amounts and transaction identifiers. Email addresses and account identifiers are sent only as SHA-256 hashes. We do not send your photos, songs, videos, prompts, recipient names, gift messages or payment-card details. The same advertising choice and browser privacy signals described above apply to AppLovin. Opting out stops future events and reloads the page to unload its script. For more information about AppLovin’s collection and use of your information visit: https://legal.applovin.com/privacy/.

We also use OpenAI measurement for ChatGPT Ads. With the advertising choices above, OpenAI receives page-view events and server-confirmed registration and purchase events, including repeat purchases and amounts after tax. We send a hashed account identifier and available ad-click or browser references to match these events. Our click-context cookie lasts up to 30 days. We do not send songs, photos, videos, prompts or card details. Declining measurement stops future events and cancels pending sends. OpenAI processes this data under https://openai.com/policies/privacy-policy/.

Your rights

Depending on where you live you may have the right to access, correct, export or delete your personal data, and to object to certain processing. Email privacy@heybop.ai and we will respond within 30 days. If you are in the EEA or UK you may also lodge a complaint with your local supervisory authority.

Children

HeyBop is not directed at children under 16 and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will remove it.

Changes

We will post changes on this page and, for material changes, email account holders at least 14 days before they take effect.

Contact

privacy@heybop.ai

Session replay

With your separate permission, we use PostHog to replay interactions on creation pages so our team can find errors and improve the experience. All input values and unapproved page text are masked, and photos, audio, videos and embedded pages are blocked before upload. We do not record sign-in, admin or payment pages, console logs, network bodies or headers. Page URLs omit query strings, fragments and project identifiers. Replay data uses random session identifiers; we do not send your email, name or account ID. Our internal user timeline can link a replay to your account when you sign in. Only authorised team members can open these private links. Recordings are retained for up to 30 days; you can withdraw permission here or in Studio Settings without affecting creation or purchase. Withdrawal stops future capture; contact privacy@heybop.ai to request deletion of earlier recordings. Global Privacy Control, Do Not Track and a data-sharing opt-out also keep replay off. The consent cookie lasts up to 180 days and is shared between our website and Studio. This optional permission is separate from advertising measurement.