Privacy Policy
Last updated: 2026
HeyisAI is built to keep your personal data private. This policy explains what data the app accesses, where it is processed, and the choices you have. It reflects how the app actually works: private on-device processing by default, with optional cloud features you control.
1. Data on your device
When you connect on-device sources, meaning your photos and the files you choose to share, HeyisAI reads and understands that content using an AI model that runs entirely on your phone. This on-device data and the personal memory built from it are stored in your phone’s secure storage. It is not uploaded to our servers and no server ever sees it.
Your calendar is read from your phone, but it is handled with your other connected apps rather than as strictly on-device data: when you ask a question about your schedule and cloud processing is on, the matching events are sent to generate the answer, exactly as described in section 4.
2. Google user data we access, and why
If you choose to connect a Google account, HeyisAI requests only the scopes below. You grant them through Google’s own sign-in screen, and you can revoke them at any time from your Google Account permissions page or by disconnecting the source in the app.
| Scope | What it allows | Why HeyisAI needs it |
|---|---|---|
gmail.readonly | Read-only access to your Gmail messages | To find and answer questions about your own email, covering receipts, bills, bookings and order confirmations, and to surface them in your dashboard. HeyisAI never sends, deletes or modifies mail. |
drive.metadata.readonly | Read-only access to Drive file metadata (names, types, dates, links) | So you can ask “find my offer letter” and get the right file. HeyisAI reads only file metadata, never file contents, and never creates, edits or deletes files. |
email, profile, openid | Your basic profile and email address | To create and secure your HeyisAI account and link it to your plan and credits. |
Google data is used only to provide the features you asked for. It is not sold, not shared with advertisers, not used for advertising, and not used to train AI models. No human at HeyisAI reads your Google data.
3. Limited Use disclosure
HeyisAI’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. Optional cloud features
Some features are optional and run only when you have cloud processing enabled: faster answers, organising your connected email, live search across Gmail, Drive and Calendar, and web search. When you use them, only the specific content needed for that request, for example your question or the matching emails, is sent to our processing service and to the AI provider that fulfils it. This content is processed transiently to generate your answer, is not retained after the request, and is never used to train models.
You can choose which AI model answers your questions. Requests reach the chosen model either through OpenRouter, which routes to the model provider, or directly to that provider. On every routed request we require providers that do not retain or train on the content we send; providers that would use it for training are excluded, and this is enforced in our software on each request rather than left to a setting.
5. Who processes your data for us
We use a small number of service providers. They act on our instructions, may use your data only to provide their service to us, and are not permitted to use it for their own purposes, for advertising, or to train AI models.
- Google Cloud / Firebase: sign-in, our processing service, and your account record.
- OpenRouter: routes a request to the AI model you selected.
- AI model providers: including OpenAI and Google, whichever serves the model in use, reached through OpenRouter or directly.
- TinyFish: web search and page reading. Only your search terms and public web pages, never your personal content.
- Google Play and RevenueCat: purchases and subscription status. We never receive your card details.
These providers are in the United States, so cloud requests may be processed there. The list may change as we add or replace a provider; this page is updated when it does.
Data that lives on your device, your photos and on-device files, is never sent to the cloud under any setting. That boundary is enforced in the app itself, not just by policy: answers touching on-device data are generated by the model running on your phone.
6. Account & billing
To use cloud features we create an account tied to your sign-in and a credit balance. We store your account identifier, email address, plan, and credit balance. Payments are processed by Google Play and/or our payments partner; we do not receive or store your card details.
7. Retention
On-device data stays on your device until you delete it or uninstall the app. Cloud request content is not retained after the request completes. Your account record (identifier, plan, credits) is kept while your account is active and deleted within 30 days of your deletion request. See Data & Account Deletion.
8. Security
Data in transit is encrypted with TLS. On-device data is held in app-private storage protected by your phone’s application sandbox and device encryption. Access to our servers is restricted and authenticated, and API credentials are held server-side, never in the app.
9. What we don’t do
We do not sell your personal data. We do not use your personal content to train AI models. We do not share your data with advertisers or data brokers. We do not allow humans to read your content, except with your explicit permission to resolve a support issue you raise, or where required by law.
10. Children
HeyisAI is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.
11. Your choices & rights
You can disconnect any source, turn off cloud processing, clear your on-device data, and delete your account, all from within the app. Depending on where you live you may also have rights to access, correct, export, or erase personal data we hold; email us and we will action it. To delete your account and server-side data, see our Data & Account Deletion page.
12. Changes to this policy
If we make material changes we will update this page and, where the change is significant, notify you in the app before it takes effect.
13. Contact
Questions about this policy? Email hello@heyisai.com.