Privacy policy

Privacy Policy

Last updated: 26 October 2026

Heynour is a companion for children, run by parents. This policy explains what we collect, why, where it goes, how long we keep it, and how you stay in control. We wrote it to be read, not skimmed.

1. Who we are

Heynour is operated by Heynour ("we", "us") and is available at heynour.com and in the Heynour apps. At launch Heynour is offered to families in Saudi Arabia. Questions about privacy go to support@heynour.com.

2. Children and parental consent

Heynour is designed for children, but every account is created and controlled by a parent or legal guardian. A child never signs up, gives an email address, or agrees to anything. By creating an account, or by accepting an invitation to one, you confirm that you are the parent or legal guardian of every child you add, and you accept this policy and the Terms of Service and agree on their behalf to the processing described in this policy: to what your child says being processed, including what concerns their feelings and wellbeing; to its use to run Heynour, to improve it and to train and improve our models; and to its reaching the providers named in section 7, some of them outside the Kingdom. We record when you created the account or accepted the invitation and which version of this policy and of the Terms was in force. You can withdraw your consent at any time by deleting the child's profile or your account.

3. What we collect

• From you (the parent): your name, email address and timezone. You sign in with a code sent to your email, or with your Google or Apple account; from Google and Apple we receive only your name and email. Where you sign in with a password instead (if you chose one, or when sign-in by email code is switched off), we keep only a one-way hash of it, never the password itself. If you subscribe or buy from the store, billing details are handled by Stripe and we never see your card number; for store orders we keep the delivery address and phone number.
• About your child: the profile you write (first name, age or school year, interests, strengths, what they find hard, any notes or school files you upload), and the PIN you set for them.
• From sessions: the conversation between your child and Heynour (text and, when voice is used, the transcription of what they said), homework photos they take, explanation pictures Heynour creates, stars, levels and progress, session length, and the short summary Heynour writes for you afterwards. What a child says can concern how they feel or what is happening to them; we treat it as sensitive.
• From you in the parents' app: what you tell or write about your child in "Tell Heynour", and your questions to the parents' assistant "Ask Heynour" with its answers.
• Technical: IP address, browser and device type, basic request logs kept for security and to keep the service running, per-account usage counts so we can apply plan limits and understand our costs, and in-app usage events (such as sign-up, starting a session or a purchase) so we can understand and improve the service. On our website and in the parents' app, and only if you accept in the cookie banner, measurement tools also record which pages you visit, which buttons you press and steps such as signing up and paying (see section 11).

4. Voice

When your child talks to Heynour, or you talk about your child, the audio is sent to our speech provider to be turned into text, and Heynour's replies are turned into speech the same way. Audio is processed in memory and is not stored by us; only the text transcript is kept. The microphone is only active while the talk button is held, or while hands-free mode is switched on, and never in the background.

5. Pictures

A homework photo is checked first: a photo showing a face, a body or a private place is refused and not kept. An accepted photo is sent to the AI provider so Heynour can understand it, and is kept encrypted with the conversation. Explanation pictures are created by the picture provider from a description Heynour writes, with no name and nothing from the conversation.

6. How we use it

To run the service: to run the sessions and make Heynour remember your child from one session to the next; to show you progress, summaries and transcripts in the parents' app; to apply the limits of your plan; to fulfil and deliver store orders; to send you the messages you need (sign-in codes, summaries, alerts, support replies); to keep children safe and the service secure; and to understand usage and costs and measure our marketing campaigns.

To improve Heynour and to train our models: we use the data of your account, including your child's conversations, to improve Heynour and to train and improve our own models and the platform. In practice this means that we analyse sessions to learn where children enjoyed themselves, where they got stuck and where Heynour got something wrong; an AI model may read conversations and write notes about them without your child's name; a small team with a defined role may read a sample of conversations with your child's name hidden; and conversations may be used to train and improve the models and instructions that make Heynour work.

The safeguards we apply to that use:

• Before data is used to train a model, we remove names and other details that identify a child or a family wherever we can.
• What a child says is never written into our logs, error reports, web addresses, emails or notifications, and a child's voice is never kept (section 4).
• Only people with a defined role may read a conversation, and every look by our team is recorded.
• Once de-identified data has been used to train a model, it cannot be taken back out of that model. Deleting your child's data removes it from everything else we hold (section 8).

We do not sell or rent personal data.

7. Who we share it with

We use a number of providers, each only for the job named:

• Anthropic, OpenAI and Google (Gemini): the AI models that write Heynour's replies, check safety, write summaries, read homework photos and school files, and create explanation pictures, each for the task we assign it.
• OpenAI and ElevenLabs: speech-to-text and text-to-speech.
• Stripe: subscriptions and payments.
• Our email-delivery provider: sign-in codes and messages.
• Cloudflare: site protection, the bot check at sign-up, and storage of our encrypted backups (Cloudflare R2, in the European Union).
• Google and Apple: signing in with their accounts, if you choose to.
• Railway: hosting and the database, in the European Union.
• Carriers: delivering store orders (name, address and phone only).
• Advertising platforms (Snapchat, TikTok, Meta and Google Ads): we send them, from our servers, limited events about the parent's account, such as a sign-up or a purchase, to measure our advertising. Nothing about your child or their conversations is sent.
• Google (Tag Manager, Analytics and Ads), Meta, TikTok, Snapchat and Microsoft (Clarity): measurement tools in your browser, on our website and in the parents' app, and only after you accept in the cookie banner. They receive events such as a page visit, a button pressed, a sign-up or a payment, with no name, no email, no phone number and nothing about your child.

What our AI and speech providers do with what we send. We send each provider only what its task needs. Each processes it under its own published terms and privacy policy, which we do not control and which can change. As we read them on the date at the top of this policy: Anthropic's and OpenAI's published business terms say that they do not train their models on what business customers send them, and that they may keep it for a limited time to monitor misuse, usually up to 30 days and longer if they detect a violation; ElevenLabs' published terms allow it to use content to improve its services unless the customer turns that off. Where a provider offers it, we ask it to keep nothing or not to use our data, but we cannot guarantee what another company does. Their own pages say what they currently do.

Some of these providers' servers are outside your country, including in the United States. We never sell your data to data brokers. We may disclose information if the law requires it or to protect a child's safety.

8. Where data lives and for how long

Our data is stored on servers in the European Union.

• Conversations (their text, homework photos and summaries): kept while your account is active, and deleted at the latest two years after your child's last session.
• Notes and labels about a session that we make to improve Heynour: deleted with your child's data.
• Data already de-identified and used to train a model: cannot be removed from that model (section 6).
• Anonymous usage statistics that cannot identify anyone: may be kept.
• Support emails: kept for up to two years so we can follow up.
• Invoices: kept for as long as the law requires.

When you delete a child's profile with the "delete everything" option, or delete your account, their profile, conversations, photos, progress and the notes about their sessions are removed from our live database immediately and from backups within 30 days (we take an encrypted backup every day, keep it in the European Union on Cloudflare R2, and delete each one after 30 days), except invoices the law requires us to keep.

9. Your rights and controls

From the parents' app you can read every conversation, edit or delete anything in your child's profile, delete a child's data, change your email, sign out of every device, and delete your account and everything in it. You can also ask us, through support, for a copy of your data and for a list of the times our team looked at your child's content. Depending on where you live you may also have legal rights to access, correct, export, restrict or object to processing of your data, and to complain to a data-protection authority. Email support@heynour.com and we will help within 30 days.

10. Security

By default you sign in with a one-time code by email or with Google or Apple; where a password is used, it is stored only as a one-way hash, and a wrong one counts towards locking the sign-in. All traffic uses HTTPS and sensitive data is encrypted. Logins use random, revocable session tokens; child PINs lock after repeated wrong attempts. Access to production data is limited to the people who need it to run, protect and improve the service, by a defined role; every look by our team at a conversation is logged. No system is perfectly secure; if we ever learn of a breach affecting your data we will tell you without undue delay.

11. Cookies

We use cookies needed to keep you signed in and to remember your language and light/dark preference, and one cookie that remembers which advertising campaign you came from so we can measure it.

On our website and in the parents' app, and only after you press "Accept" in the cookie banner, we use Google Tag Manager to load Google Analytics and the measurement tools of Google Ads, Meta, TikTok and Snapchat, and Microsoft Clarity, to understand how visitors arrive and move through the site and the sign-up and payment steps. On the parents' pages no page title or event names a child or carries a child's id; the address of a child's own plan and subscription pages holds that child's random reference code, which these tools may read, but never the child's name; and Clarity is kept from reading the page's text. Before you accept, no analytics or advertising cookie is stored. If you press "Decline", none of these tools is loaded. We remember your choice in one cookie for 180 days; you can change it by clearing your cookies. Nothing your child said or wrote is sent to these tools.

12. Changes

If we change this policy in a way that matters, we will email the address on your account before the change takes effect and update the date at the top of this page.

13. Contact

support@heynour.com: we read everything and reply to everyone.