Privacy policy

This page says what Hegmo collects about you, why each thing is collected, who else ever sees it, and how to get it back or have it removed. It is meant to be understandable on its own: you should not have to read the Terms of service or anything else to follow it.

Last updated 27 October 2026.

Who to write to

[email protected]

That address reaches the founder, who is the person responsible for how Hegmo handles your data and who answers questions about it. It is the right address for everything on this page — a question, a correction, a copy of your data, a deletion, or a complaint. You will get a reply from a person.

What we collect, and why

Everything below is either something you typed into the app, something the app worked out from what you typed, or a report the app sends about how it is running — when it is opened, and what went wrong when it breaks. Hegmo has no advertising, sells nothing about you, and every service that receives anything is named under Who else sees it. There is no hidden half to this list.

To have an account at all

• Your email address and which provider you signed in with. You sign in with Google or with Apple, and they tell us the email address on that account, a permanent id for it, and the name and picture on your provider profile. Why: it is how we know it is you next time. The app itself never shows or uses your email address; it sits in the account record.
• Your handle. Why: it is your one permanent identifier here, and it is what a report is filed against.
• Your date of birth, and the age band we work out from it. Why: Hegmo is 18+, and the date is the only way to hold that line. The band is what matching uses. Nobody is ever shown your date of birth — what another member sees on your profile is your age in years.
• Your gender. Why: to keep a group's mix from tipping entirely one way, and to honour the filter other people set on who they are shown. It is not printed on your profile; it is used and not displayed.
• A record of your sign-ins — when you signed in, and the internet address you signed in from — kept by the service that runs our sign-in. Why: it is how an account can be told apart from someone getting into it.
• The version of the Terms and this policy you agreed to, and when. Why: you agree to them by ticking a box at sign-in, and an agreement is only worth something if both of us can tell later what was agreed and on what day. It is the date at the top of these pages and a timestamp — nothing else.

Your date of birth, gender and handle are fixed after sign-up. Everything else on your profile you can change whenever you like.

To put you in a group near you

• Your home location, as exact coordinates. Why: to work out which named area you live in and how far that area is from every other one. This is the most sensitive thing we hold, so it is worth being exact about it: we store the point, and no member is ever shown your address, your coordinates, or the distance between you and them. What other members see is the name of your area. The point does leave us in one situation — the address search, if you are changing your home location — and Who else sees it below says how.
• The area we assigned you, and the distance from your home to each area. Why: the working out above, kept so it does not have to be repeated on every match.
• The requests you make for a group — the size you asked for and the distance range you set. Why: that is the request itself, waiting in the pool.
• Your swipe preferences — the age range, the distance, the group sizes and the gender filter you set. Why: to decide whose profile you are shown.

Your profile

• Your photos and their captions, one to three of them. Why: they are your profile. They are kept in private storage and are only ever handed to someone allowed to see your profile.
• Your first name, what you do, your prompts, interests, languages, attributes, and your walls — the films, books, channels and artists you pick. Why: they are your profile. Some of these you can hide, and a hidden item is not sent to anyone else.
• Which of those you marked as a deal-breaker. Why: to keep people who do not match it out of your groups.

Your profile is seen by two sets of people and nobody else: the members of a group you are in, once that group has formed, and people swiping near you, who could end up in a group with you. There is no public directory and no way to look someone up.

What you do in the app

• Your messages, and when you read a group last. Why: the chat, and the unread count.
• The name of each group you are in, which any member can change. Why: it is the group's shared label. Bear in mind that anyone in the group can read a name you set.
• Which groups you are in, and when you joined, and whether you have seen the notice that one of them has wrapped up. Why: the group itself, your three slots, and telling you once.
• Every like and pass you make, with who it was about. Why: to build matched groups, to keep the same card from coming back, and to count the day's likes. Likes are never shown to anyone — not to the person you liked, not to anyone else.
• Who you have blocked. Why: to keep the two of you out of the same group for good. We do not tell the person you blocked.
• Save invites — who invited whom to keep a group, and the answer. Why: the 24-hour invite.
• Whether you have paid, and how many Saves you have started. Why: the free limits and what lifts them.
• Anything you post on the feedback board, and that it was you who posted it. Why: the board is public to everyone on Hegmo and your name is never shown on a post — not to other members, not anywhere in the app. We keep who wrote what so that an abusive post can be dealt with, which is the one thing an anonymous board cannot do. Deleting your account deletes your posts with it.
• If we have stopped you posting to the feedback board, that we have, and when. Why: so that somebody who has abused the board cannot simply post again. It is the id and a date and nothing else — no note, no reason; why it happened is on the report that led to it. Being stopped from posting does not stop you reading the board or upvoting, and deleting your account deletes the record with it.
• Which posts on the board you have upvoted. Why: so that a vote counts once — that is the only reason it is kept. A post shows how many members upvoted it and whether you did; who else voted is never shown to anybody, and taking your upvote back off deletes the record of it. Deleting your account deletes your votes with it.
• Your answers to the check-in questions in a group's chat — whether you already knew anyone in the group, and later whether the group has met up and whether you are still in touch — and when you answered. Why: Hegmo is being tested with a first group of members, and these answers are how we find out whether groups actually meet, which the chat alone cannot tell us. Nobody else in the group ever sees your answer — it is read only by us, counted across groups — and your own answers are in your Download my data file.

When you report someone

• The reason you chose, anything you wrote, and the message, person or feedback-board post you reported. Why: a human reads it and decides what to do.
• A copy of your handle and theirs, kept on the report itself. Why: so that deleting an account cannot erase a history of harassment. This is the one place a handle outlives its account, and What deletion actually does, further down, says so again in its own place.

To send you a notification

• Your device's push token. Why: it is the address a notification is sent to. It is deleted when the device stops accepting notifications, and when you delete your account.
• Which kinds of notification you want, from the two switches in Settings. Why: so that turning one off actually stops it, on every device you sign in on. We only hold this once you change something — leaving both on is nothing stored at all.
• Which of your groups you have muted, from the mute on a group's own page. Why: so that one group can go quiet without the others doing the same. It is yours alone — nobody else in the group is told, and nobody can see it — and we only hold it while you are muting and while you are in that group: unmuting removes it, and so does leaving.

One thing that is not about you personally

What you type into a wall search is remembered, so that the next person to search the same words does not send a second request out — with no record of who typed it. A film, channel or music search is kept ten minutes; a book search is kept a day, because the book catalogue is slow and one person's wait saves everyone else's.

Who else sees it

Hegmo is small, so this list is short and complete.

• Supabase runs our database, our file storage and our sign-in, so everything on this page is held on their systems. It is stored on servers in Mumbai, India.
• Google and Apple handle sign-in. They know you have an account with us, because you signed in through them.
• Expo delivers push notifications, and passes them to Google's or Apple's notification service to reach your phone. A notification carries the sender's first name and the opening of their message, because that is what a notification is. If you would rather that were not the case, turning notifications off in your phone's settings stops it. Expo also delivers app updates: each time the app opens, it asks Expo whether a newer version is out. That request carries your internet address, the app's version and a random number made on your phone to count installs, and nothing about you or your account.
• Photon, a free address-search service built on OpenStreetMap, is what the address box searches. It is called from your phone, so it sees your internet address and what you typed. It also receives a rough coordinate, whenever the app has one to send, so that it can put nearby places at the top of the list — the fix from Use my current location if you have just taken one, or your saved home location if you are changing it from Edit profile. It is rounded to about a kilometre before it is sent, so what goes out says roughly which part of a city you are in and nothing sharper: your exact coordinate never leaves the app. Nothing else about you is sent, and it happens only while you are setting a home location.
• Sentry tells us when the app or our servers go wrong, so we can fix it. It receives a report whenever something breaks: what went wrong, the app version and phone model, the screens and buttons you passed through just before it (by name — "tapped Send", never what you typed), your account number, and the city your internet address points to (the address itself is not kept). It also receives a short note each time the app is opened and closed, saying whether that session ended in a crash. It never receives your messages, your coordinates, your name, handle or email, or a picture of your screen. Reports are stored in Frankfurt, Germany, and deleted after 30 days.
• AI agents help us in two places. They may read Sentry's reports to suggest fixes, and see what Sentry holds there. And they read the feedback board to sort it: which ideas come up most, and what to build next. On the board they see what everyone on Hegmo can already see: each post's words, how many upvotes it has, its status and the date. They never see who wrote a post or who upvoted it. The board is the only part of our database they read: not your profile, your messages, or a report you made about someone.
• PostHog tells us how the app is used, so we can tell what is working. It receives a short note when the app is opened and closed, which screen you are on (by name — "Home", "Chat"), whether a chat you open is a random or a matched group, how many people a swipe deck had in it, whether you finished or skipped the First-run tour (and the step where you skipped), whether you closed the Save hint by tapping Save, Got it or back, and whether you ended the Swipe hint by swiping or using a button, the app version and your phone's operating system, and your account number. It also tells the app which features are switched on. It never receives your messages, your general tap history, anything you type, who is in your groups, your name, handle, email, gender or age, or any location — on the notes we send, the internet address is thrown away rather than turned into a place. We also send it totals worked out from our database, like how many groups met up — never a row about you. Notes are stored in Frankfurt, Germany, and deleted after one year.
• TMDB, Open Library, YouTube and Deezer are where the films, books, channels and artists on your walls come from. A wall search is sent from our servers, not from your phone, so those services do not see your device. Their picture servers do, when a cover or an avatar loads.
• YouTube. The channels on a YouTube Diet are found with the YouTube API Services, so YouTube's owner, Google, handles those searches under the Google Privacy Policy. We send YouTube the words you search for and the ids of channels already on walls, never your name, account or location. From what it returns we keep each channel's name and picture link on your profile, and we ask YouTube for them again at least every 30 days. A channel YouTube no longer lists is taken off every wall it is on. Remove a channel from your wall, or delete your account, and we no longer keep anything YouTube returned about it for you.
• Cloudflare serves this website, and sees the internet address of anyone who opens it.

Nobody else. We do not sell your data, and we do not share it for advertising.

How long we keep it

While your account exists, we keep what is listed above. Delete your account and it goes, except for the five things named below and the copies we keep for recovery, which hold it for a while longer (both under What deletion actually does). Dead push tokens are removed as soon as we learn they are dead, and a wall-search cache entry expires on its own, within ten minutes or a day depending on which wall it was.

We do not yet delete the accounts of people who stop using Hegmo. That is a gap we know about.

Your rights

You can do all of these by writing to [email protected], and some of them in the app.

• See what we hold. Profile → the gear → Download my data. It builds one file — your profile, everything you have written, everything you have done, and your settings — and hands it to your phone so you can save it or send it to yourself. Once a day. Your photos are in it as links that work for about an hour, so save the pictures you want to keep. Three things are deliberately not in it, and the file says so too: messages other people wrote (those are theirs), who liked you (likes only travel one way here, and an export is not a way around that) and reports other people have made about you (naming them would expose whoever reported). A few working records are not in it either — the email your sign-in provider gave us, your device's notification token, which groups you are in, requests you have waiting, and similar plumbing. Those are not secret; write to us and we will send them.
• Correct it. Nearly all of it you can edit yourself, in Profile → Edit profile. For your handle, gender or date of birth, which the app fixes after sign-up, write to us.
• Have it erased. Profile → the gear → Delete account. It asks once and then it is done — there is no undo and no grace period. You can also ask us to do it.
• Withdraw your agreement. You gave it by ticking the box at sign-in; deleting your account withdraws it, and is as easy to do as signing up was.
• Nominate someone. You can name a person to exercise these rights for you if you die or cannot act for yourself. Write to us with their name and how to reach them.
• Complain. Write to us first — we would rather fix it. Whatever it is about, we will reply within 30 days, and usually much sooner than that. If you are not satisfied with the answer, you can take it to the Data Protection Board of India, which you can do yourself, without going through us.

What deletion actually does

Deleting your account removes your profile, your photos, your likes and passes, your blocks, your preferences, your requests, your push tokens, your feedback-board posts and the record of your agreement, and takes you out of every group. Five things are deliberately kept, and we would rather tell you than let you find out:

• Your messages stay in the chats you sent them to, with your name taken off them. A conversation belongs to everyone in it, so one person leaving does not tear holes in other people's chats. Your messages show as sent by Former member; your name, your photos and your profile are gone from them.
• Reports involving you stay, with your handle on them. Otherwise deleting an account and making a new one would be a way to wipe a record of harassing someone, which would make reporting pointless for everyone else.
• Your answers to the check-in questions stay, with your name taken off them. Whether a group met up is a fact about the group, and the count would change if leaving could take it back. Nothing links an answer to you any more.
• Error reports stay until they expire. A report the app sent to Sentry (see Who else sees it) carries your account number, and is deleted on its own within 30 days rather than when you delete your account. It says what went wrong, not what you wrote.
• App-usage notes stay until they expire. The notes the app sent to PostHog (see Who else sees it) carry your account number, and are deleted on their own after one year rather than when you delete your account. Once your account is gone, that number leads to nobody — and how many people kept using Hegmo should not change because someone later left.

Copies kept for recovery outlive a deletion for a while. Two kinds of copy of the whole database exist, so that it can be put back if something goes wrong. Neither holds your photos — those are gone the moment you delete — but the rest of what this page lists is in them, as it was on the day the copy was made:

• Daily backups, made by Supabase (see Who else sees it): one a day, each kept for 7 days. An account deleted today is gone from all of them within a week.
• Copies we take ourselves, before each change we make to the database, kept encrypted on the founder's computer. Hegmo is in its first test with real members, its beta, and these copies are all deleted when the beta ends. Until then, an account deleted today is still in every copy taken before today.

They are used only to put the database back after a mistake or a failure, never to look anyone up.

Under 18

Hegmo is for adults. You cannot create an account with a date of birth under 18, and we do not knowingly hold any child's data. If you believe a child has an account, tell us at [email protected] and we will remove it.

Keeping it safe

Your data is held in Supabase's managed infrastructure, reached over encrypted connections, and the database is set up so that one member's query cannot reach another member's rows. Photos are in private storage and are handed out one link at a time, to someone allowed to see them.

No system is perfect. If something goes wrong in a way that affects your data, we will tell you and we will tell the Data Protection Board of India.

Changes to this policy

When something on this page changes in a way that matters, we will say so in the app rather than quietly editing the date at the top. The date at the top is when it was last changed.