Privacy Policy

This policy explains how Neurocodelab Maciej Śnieżyński (“HeronApps”, “we”) handles personal data on heronapps.com and all of its product subdomains. We are the data controller. Contact: hello@heronapps.com, Franciszka Klimczaka 13/102, 02-797 Warszawa, Poland.

What we collect

• Visit statistics (first-party). A random visitor ID stored in a first-party cookie (ha_vid, 12 months), the pages and steps you use, campaign parameters (UTM), referrer and browser user agent. We store a one-way hash of your IP address salted with a secret that changes daily, never the IP itself. We use this to count visits, filter bots and limit abuse.
• Reservations. If you reserve a plan: your email address, the plan and price you chose, and (optionally) your answers to two survey questions.
• Free checks. The website address or text you submit to a free check is processed to produce your result. Some checks send that input to an AI model provider (OpenAI) to generate the analysis. We do not store submitted text in our database; results may be cached in server memory for up to one hour.
• Optional analytics and advertising cookies. Only if you click “Accept”, and only on products that are not health or wellness related: PostHog product analytics and session replay (form inputs are masked), and advertising pixels from Meta, TikTok, Reddit and Google Ads to measure our ads. Health and wellness products never load these tools.

Why and on what legal basis

• Visit statistics, security and abuse prevention — our legitimate interest in running and improving the site.
• Reservation emails — steps you ask us to take before a contract (Art. 6(1)(b) GDPR).
• Optional analytics and advertising cookies — your consent, which you can withdraw at any time by clearing this site's storage or emailing us.

Who processes data for us

OVH (our server and database, in Warsaw, Poland), Hostinger (our mailbox, which sends reservation emails), PostHog Cloud EU (analytics, only with consent), OpenAI (AI analysis for some free checks) and Telegram (internal notifications to our team, with email addresses masked). Where data leaves the EEA or UK, transfers rely on Standard Contractual Clauses or an adequacy decision. We do not sell personal data.

How long we keep it

• Visit events: up to 24 months, then deleted or aggregated.
• Reservation emails: until the product launches plus 12 months, or until you ask us to delete them.
• Rate-limit hashes: 30 days.

Your rights

You can ask for access, correction, deletion, restriction or a copy of your data, and object to processing based on legitimate interest. California residents can also request disclosure and deletion and opt out of “sharing” for cross-context advertising — declining cookies does exactly that. Email hello@heronapps.com; we reply within 30 days. You may also complain to your data protection authority (in Poland: the President of the Personal Data Protection Office, UODO).

Children

Our products are not directed to children under 16, and we do not knowingly collect their data.

Changes

We will post any changes here and update the date above.