Privacy Policy

Last updated 10 August 2026.

Hey bb is a conversation service. This page describes what we store, who can reach it and how to remove it. It is written to match what the service does today rather than to cover things we might build later.

Hey bb is operated by AI Friends Tech LLC.

What we store

• Your account. Email address, display name and a hash of your password. The password itself is never stored — the hash cannot be reversed into it.
• Onboarding answers. What you said you were looking for, used to order the companions you are shown.
• Your subscription. If you take a paid plan, we keep which plan you are on, whether it is active, and when it next renews, so we know what to give you access to. How the payment itself is handled is set out under Payment below.
• Session cookie. One cookie that keeps you signed in.

We do not ask you for your real name, your phone number, your date of birth or your location, and we do not collect them ourselves. If you subscribe, the billing details a card carries — the name and country on it — are handled by Stripe as part of the payment, not by us.

Your conversations

We do not store your conversations. Your messages are sent over an encrypted connection to the language model that writes the reply, and are not kept on our side afterwards. No member of our staff can read your conversations.

The AI model

Replies are generated by a third-party language model. To produce a reply, the recent part of your conversation and the companion’s description are sent to that provider over an encrypted connection. We do not send your email address or your account id with it.

We also record what each request cost us — the number of tokens and the price. That record survives account deletion with your identity removed, because it is accounting rather than personal data.

Payment

Paid plans are handled by Stripe. When you subscribe, your card details are entered on Stripe’s side and go straight to them — we never see your full card number and we never store it.

What Stripe hands back to us is only what we need to run the subscription and keep our books: that you are subscribed, which plan, when it renews, the last four digits and the brand of the card, the country the card was issued in, and an identifier that ties you to Stripe’s own record of you.

We keep our own record of each payment — what was charged, when, and the tax on it. That is an invoice, and the law requires us to keep invoices for several years. So, unlike the rest of your data, an invoice is not removed when you delete your account; it is kept as accounting, with no more of your identity attached than the law asks for.

Stripe has its own privacy policy covering what it does with your card details, at stripe.com/privacy.

Who we share your data with

We share your data with an outside party only when one of these is true: it is needed to provide the service to you, we or they have a legitimate interest in it, you have consented, or the law requires it.

To run the service we rely on outside providers, and your data passes through them:

• Our payment provider (Stripe) — to take payment and manage your subscription.
• Our hosting provider — the servers the service runs on.
• The third-party language model that writes the replies. To generate a reply it receives the content of your messages and the companion’s description, and it processes them under its own terms. We do not send it your email address or your account id.
• Product-analytics and advertising-measurement providers — as described under Analytics and advertising below, and only where you have not turned measurement off.

Some of these providers are outside the European Union and the United Kingdom, including in the United States, so using the service can involve transferring your data outside those regions. Where that happens we rely on the safeguards the law provides for such transfers.

Cookies

The session cookie that keeps you signed in is strictly necessary for the service to work, so it does not require consent. It is not used for advertising and not shared with anyone.

Everything below sets cookies of its own. It is on by default, and you can turn it off.

Analytics and advertising

We may use third-party services for internal product analytics and to measure which adverts bring people here. We do not name them here, and the list can change.

They are on unless you turn them off. We do not interrupt you to ask, and we would rather say that plainly than describe a default as a choice you made. If your browser sends Do Not Track we treat that as a no without being asked. Turning them off means they are never fetched at all, so they learn nothing about you — including that you turned them off.

What they receive is a small, fixed list: the pages you open, and the handful of steps that matter to an advert — reaching the offer, handing over an address, starting a payment.

How you got here

When you first open the site we record what the link you followed said: the advertising identifiers in it, the campaign it belonged to, the page you landed on and which site you came from — the site, not the page. If you then create an account, that record is tied to it, so we can tell which advert brought you.

We keep a fixed list of parameters and drop the rest of the address unread. It is a list rather than “whatever the link contained” because links carry things nobody means to hand over.

We also record what you arrived on: whether it was a phone or a computer, which operating system and browser, the size of the window and the screen, your language and your time zone. That is so we can tell a bad advert from a page that does not fit on your screen — the two look identical in the numbers otherwise.

We do not fingerprint your browser. There is a longer list of things a browser will tell a website — how it draws shapes, which fonts are installed, how its audio behaves, how much memory the device has. Together those identify one person across unrelated websites without anything being stored on their machine, and that is what they are for. We do not collect any of them, and nothing above needs them.

This follows the setting above. Turn measurement off and none of it is recorded — not stored and marked, not recorded at all.

How long we keep things

Your account — your email, display name, onboarding answers and subscription status — is kept until you delete it. Expired sessions are removed automatically. Cost records are kept after deletion with your identity removed from them. Payment invoices are kept for as long as tax and accounting law requires — several years — because the law does not let us delete them on request.

Deleting your account

Go to Settings → Privacy and use Delete my account. You will be asked for your password to confirm.

Deletion is immediate and cannot be undone. It removes your account and everything tied to it — your email, display name, onboarding answers, subscription status and all of your sessions. Nothing is kept in a recycle bin and nothing is merely marked as deleted.

One thing outlives deletion: payment invoices we are required by law to keep. (We also keep cost records, but with your identity stripped out of them.) If you had a subscription, cancel it before or at deletion so it does not renew — deleting the account does not by itself end a Stripe subscription.

Your rights

If you are in the EU or the UK, the GDPR gives you the right to access your data, correct it, delete it, receive a copy of it and object to certain processing. Deleting your account works today and removes everything it holds, apart from the payment invoices the law requires us to keep. A downloadable copy of your data is not offered on screen; ask us at the address below and we will produce one by hand.

Age

You need to be at least 16 to use Hey bb, and we do not knowingly keep data belonging to anyone under 16. Every companion is fictional and every companion is an adult.

Contact

Write to support@heybb.me with any question about your data — including a request for a copy of it, or a request to delete it.

Hey bb is operated by AI Friends Tech LLC.