Privacy Policy

1Preamble

This policy is drawn up in accordance with the General Data Protection Regulation (GDPR, Regulation EU 2016/679) and the applicable Portuguese legislation on the protection of personal data.

S2ND Lda designed the architecture of Hi around a fundamental principle: Hi does not know your civil identity. This is a deliberate choice, and a technical reality.

Hi does not accumulate conversational exchanges in order to protect them. Hi erases them, permanently and irreversibly, even from the hosting infrastructure, within the periods detailed in article 4. A limited amount of structural data remains necessary for the account to function: it is described precisely in article 3.

2Data controller

3What Hi collects, and what it does not collect

3.1 The data kept by Hi

Hi keeps a deliberately small amount of data, each item linked to a specific purpose and a defined retention period.

• Your pseudonym (display name): it is used to identify you within the App. Retention: for the lifetime of the account.
• Your anonymous technical identifier (UID): it is created by the App when you subscribe (Firebase Authentication) and makes it possible to recognise your account without knowing your identity. Retention: for the lifetime of the account.
• Your recovery username and password: you choose them in order to recover your account on another device. Hi associates a fictitious internal address with them, which is not a real email address. The password is managed by Firebase Authentication, and Hi has no access to it. Retention: for the lifetime of the account.
• The status of your subscription: passed on by RevenueCat, which checks with Apple or Google that a subscription is active. Hi receives neither your identity nor your payment details. Retention: for the lifetime of the account.
• Your age confirmation: a simple confirmation (yes) that you are 13 or over, recorded after you subscribe. No date of birth is requested or kept. Retention: for the lifetime of the account.
• Your consent to the Terms and to this policy (a time-stamped indicator): it constitutes proof of acceptance of the contract. Retention: for the lifetime of the account, then 5 additional years.
• Your notifications and your device's technical notification token: they are used to send you the App's notifications. A notification does not reproduce the content of your messages: it only tells you that something is happening in the App. The token is kept for the lifetime of the account. An unread notification is kept for up to 5 years, as long as your account is active and your subscription is current; its retention period is shorter once it has been read. When your subscription ends, your notifications are deleted along with your account.
• Your language and your time zone: they are used to display the App in your language and to schedule notifications. Retention: for the lifetime of the account.
• Aggregated behavioural metadata: it feeds the community reputation system (Trend score). It is recalculated daily. Retention: for the lifetime of the account.
• The content you choose to create (profile and profile photos, albums, personal journal, lists, in-App contacts): it follows the periods in article 4.

Hi does not collect any data other than that listed above. No hidden data. No advertising profile. No cross-referencing with other services. Hi uses no audience analytics tool, no advertising and no third-party crash reporting service.

Note on the nature of this data: in accordance with article 4(5) of the GDPR, the technical identifier is pseudonymised data, not anonymous data: it makes it possible to recognise the same account over time, without ever linking it to a civil identity known to S2ND Lda. The pseudonym and the recovery username are, in the same way, personal data in their own right.

3.2 What Hi does not collect and never sees

• Real first name and surname
• Real email address
• Telephone number
• Date of birth
• Banking or payment data (it stays with Apple or Google)
• Geographic location
• Hi carries out no facial or voice recognition on your photos and videos.
• Hi only accesses your camera, your microphone and your photos when you yourself use them in the App, for example to record a video message. You can withdraw these permissions at any time in your device settings.
• Hi does not record your IP address in its database. As with any online service, our providers' servers receive your IP address each time you connect, for the technical operation and security of the service.

How does the technical identifier work? When you subscribe to Hi through the App Store or Google Play, Apple or Google handles the payment. The App creates an anonymous identifier of its own, and the RevenueCat service tells Hi that a subscription is active. Your real identity and your email are never passed to Hi.

4Automatic erasure: the heart of Hi

Erasing content is not an option. It is how Hi fundamentally works for conversational exchanges.

Every message you send on Hi (text, photo or video) automatically disappears from the hosting infrastructure within periods defined by type of content. This erasure is total and irreversible for this category: no copy is kept by S2ND Lda once these periods have expired. No archive. No hidden backup. The only exception is reported content (article 6).

4.1 Conversations

• Messages (text, photos, videos): erased automatically and permanently 48 hours after being sent, whichever space they are in.
• Video messages: the video file, its soundtrack and its thumbnail are erased from the hosting infrastructure. They cannot be downloaded or shared from the App.
• Spaces: when a space no longer contains any message, it expires within the following periods.
• One-to-one: 48 hours without a new message.
• Discussion: 48 hours without a new message.
• Circle: 5 days without a new message.
• Event: 2 days after the date of the event, if no new messages have been sent.
• Connections: kept for 7 days at most if they do not become friends.

4.2 Other features

• An Album is a permanent folder, separate from the Posts (photo and text) it contains: a Post is erased after one year, regardless of the lifespan of the Album, which remains active for as long as the account exists.
• Friends: kept permanently, unless 2 years without interaction trigger their erasure.
• Hi's other features (personal journal, lists and others) follow specific periods, available at any time in the App.
• These periods may change depending on the technical architecture. You will be informed in the App, with reasonable notice in the event of a significant reduction affecting content already created.

4.3 End of subscription, account deletion and inactivity

• If your subscription ends and is not renewed, your account and all associated data (including your notifications) are permanently deleted at the end of a 7-day grace period. Notifications warn you before the deletion.
• You can also delete your account yourself at any time, from the App or from the account deletion web page on our website hi.s2nd.life. Deletion erases your account and the associated data.
• If you subscribe again after deletion, you start again with an empty account.
• On an inactive account, content is progressively reset to zero. Hi archives nothing: in the end, all that remains of an inactive account is what is needed for it to exist, until it is deleted completely.

5Legal basis for processing

• The operation of the service (account creation and management, conversations, spaces, age confirmation, Trend reputation system) rests on the performance of the contract between you and S2ND Lda (article 6(1)(b) of the GDPR): this processing is necessary to provide you with the service you subscribe to.
• Access to the camera, microphone and photos rests on your permission, given in your device settings, which you can withdraw at any time.
• Cooperation with judicial authorities, when a formal order is addressed to us, rests on compliance with a legal obligation (article 6(1)(c) of the GDPR).
• The retention of reported content and moderation decisions rests, depending on the case, on a legal obligation (article 6(1)(c)) if a specific text imposes the period, or on the legitimate interest of S2ND Lda in ensuring the security of the service and the protection of users, in particular minors (article 6(1)(f)). In this second case, you have a right to object, which S2ND Lda may contest case by case on compelling legitimate grounds.

6Freezing of content on report: the exception

As an exception to the principle of automatic erasure, S2ND Lda suspends the erasure of the content concerned in two cases only:

• receipt of a report by Hi, whether it comes from a user or from an Administrator of the space concerned;
• receipt of a preservation request from a competent judicial authority.

What is frozen: the history of the last 50 messages of the conversation concerned (text, photos, videos with their sound), provided they have not already expired at the time of the report.

Where and for whom: frozen content is kept in a secure, isolated space, accessible only to members of the S2ND Lda team authorised as internal moderators.

For how long:

• if the report is closed with no further action, the frozen content is destroyed within 48 hours;
• if it is upheld, the frozen content and the moderation decision are kept for 5 years at most, and then destroyed;
• it is passed to the authorities only on presentation of a formal legal order or warrant. S2ND Lda passes on no data spontaneously.

As messages disappear after 48 hours, content that has already been erased can no longer be reviewed: report quickly.

You can hide a message on your device, without erasing it, which allows you to report it afterwards. You can also block a contact.

This exception does not call into question the philosophy of Hi. It completes it: freedom has limits, and so does responsibility.

7Processors and transfers

Hi uses a limited number of processors, each with a strictly defined role.

• Google Firebase (Google Ireland Limited): hosting, database, file storage, anonymous authentication and sending of notifications.
• RevenueCat, Inc. (United States): checking the status of the subscription with Apple or Google, using the technical identifier. Hi passes no civil identity or payment data to it.
• Apple Inc. (United States): management of the subscription and payment on iOS.
• Google LLC (United States): management of the subscription and payment on Android.

Transfers to the United States are covered by the European Commission's standard contractual clauses and, where certified, by the EU-US Data Privacy Framework.

8Minors

• Hi is reserved for people aged 13 or over. Hi does not verify age: the user declares that they are 13 or over by ticking a box, after subscribing. No date of birth is requested.
• When the platform detects a child account, parental consent is requested before the purchase (Ask to Buy at Apple, Family Link at Google).
• Hi shows no advertising and creates no advertising profile, for any user.
• If we learn that a person under 13 is using Hi, we suspend their account, as described in the Terms.

9Your rights

In accordance with the GDPR, you have the following rights, to be exercised directly in the App where possible, or with Hi at tech@s2nd.life:

• Right of access: to obtain a copy of the data Hi holds about you. There is very little of it (see article 3.1).
• Right to rectification: to correct your pseudonym.
• Right to erasure: to request the deletion of your account and of all associated data.
• Right to object: to object to processing based on legitimate interest.
• Right to restriction: to request the temporary suspension of processing.
• Right to data portability: to receive the data you have provided in a structured and commonly used format.

Important note. As Hi does not know your civil identity or your email, a request sent from outside the App must state your pseudonym. We may ask you for a confirmation made from the App logged in to your account, in order to make sure, to the extent of the technical means available given this architecture, that the request does indeed come from the account holder.

If you lose your recovery username and password and are no longer logged in on a device, Hi cannot restore access to your account.

You also have the right to lodge a complaint with the CNPD (Comissão Nacional de Proteção de Dados): www.cnpd.pt, or with the data protection authority of your country of residence within the European Union.

10Security

S2ND Lda implements appropriate technical and organisational measures to protect data against unauthorised access, loss or destruction, in particular encryption in transit and at rest of the data hosted.

Hi does not use end-to-end encryption: this architectural choice makes possible the human moderation mechanism described in article 6, which helps in particular to protect minor users against harassment and sextortion. Outside the strict framework of a report, no conversational content is viewed, analysed or exploited by Hi.

Hi uses technical measures to prevent screen capture and recording. No measure is infallible, and a third party can film a screen with another device.

Hi blocks the sending of internet links in conversations, in order to protect users against malicious links.

A structural security measure completes these protections: beyond the erasure periods described in article 4, conversations no longer exist, and can therefore no longer be exposed to unauthorised access. The structural data listed in article 3.1 remains, for its part, kept and protected for the lifetime of the account.

11Changes to this policy

S2ND Lda reserves the right to amend this policy at any time. Any substantial change will be notified in the App at least 30 days before it takes effect.

12Governing law and jurisdiction

This policy is governed by Portuguese law and applicable European law. Any dispute relating to its application falls within the jurisdiction of the courts of Lisbon, Portugal, without prejudice to the mandatory rights enjoyed by European consumers under the law of their country of residence.