Privacy Policy

Last updated 8 August 2026.

Hey bb is a conversation service. This page describes what we store, who can reach it and how to remove it. It is written to match what the service does today rather than to cover things we might build later.

What we store

• Your account. Email address, display name and a hash of your password. The password itself is never stored — the hash cannot be reversed into it.
• Your conversations. Every message you send and every reply you receive, kept so the conversation is still there next time.
• What the companion remembers. Short facts drawn from your conversations, used to make replies consistent. There is no screen for these: deleting your account removes them with everything else, and until then you can ask us to show them to you or to remove them.
• Onboarding answers. What you said you were looking for, used to order the companions you are shown.
• Session cookie. One cookie that keeps you signed in.

We do not ask for your real name, your phone number, your date of birth or your location, and we do not collect them.

Who can see your conversations

Our staff can read them. We use conversations to investigate abuse reports and to judge whether replies are good enough. We would rather say this plainly than bury it.

Every time a member of staff opens a conversation, the service records who opened it, whose conversation it was, which companion it was with and how many messages were shown. That record is kept separately and is not deleted when an account is deleted — otherwise it could not answer the question it exists for. If you want to know whether your conversations have been read, ask us and we will tell you from that log.

The AI model

Replies are generated by a third-party language model. To produce a reply, the recent part of your conversation, the companion’s description and the stored memories are sent to that provider. We do not send your email address or your account id with it.

We also record what each request cost us — the number of tokens and the price. That record survives account deletion with your identity removed, because it is accounting rather than personal data.

Cookies

The session cookie that keeps you signed in is strictly necessary for the service to work, so it does not require consent. It is not used for advertising and not shared with anyone.

Everything below sets cookies of its own. It is on by default, and you can turn it off.

Analytics and advertising

We load three third-party tools: Mixpanel to see how the product is used, Meta and Snap to measure which adverts bring people here.

They are on unless you turn them off. We do not interrupt you to ask, and we would rather say that plainly than describe a default as a choice you made. If your browser sends Do Not Track we treat that as a no without being asked. Turning them off means they are never fetched at all, so they learn nothing about you — including that you turned them off.

What they receive is a small, fixed list: the pages you open, and the handful of steps that matter to an advert — reaching the offer, handing over an address, starting a payment. What you say to a companion, who you talk to and what she remembers are never sent to any of them.

One thing happens on our servers rather than in your browser. When a payment completes, we tell Meta what was bought, for how much, and enough to recognise you: your email address as a one-way hash, your IP address, your browser’s description, and the identifiers Meta’s own cookies had already set here. This is the only measurement that does not run in the page, because a payment finishes on the processor’s site and the browser never reliably learns that it happened. It follows the same setting as everything else: turn measurement off and your purchase is not reported.

How long we keep things

Your account and its contents are kept until you delete them. Expired sessions are removed automatically. The staff-access log and the cost records are kept after deletion, with your identity removed from the cost records.

Deleting your account

Go to Settings → Privacy and use Delete my account. You will be asked for your password to confirm.

Deletion is immediate and cannot be undone. It removes your account, every conversation and message in it, everything the companions remembered about you, and all of your sessions. Nothing is kept in a recycle bin and nothing is merely marked as deleted.

Your rights

If you are in the EU or the UK, the GDPR gives you the right to access your data, correct it, delete it, receive a copy of it and object to certain processing. Deleting your account works today and removes everything it holds. A downloadable copy of your data is not offered on screen; ask us at the address below and we will produce one by hand.

Age

This service is for adults only. It is not for anyone under 18, and we do not knowingly keep data belonging to anyone under 18. Every companion is fictional and every companion is an adult.

Contact

Write to support@heybb.me with any question about your data — including a request for a copy of it, a request to see or remove what a companion remembers about you, and a question about whether a conversation has been read by staff.