Privacy Policy
Last updated 7 November 2026 · Applies to hiya and every page published on it
The short version. Signing in with Discord tells us your Discord ID, username and avatar — not your email address, not your servers, not your messages. We store the page you build, the images, audio and fonts you upload, and a small amount of technical data used to stop abuse.
There is no advertising and no analytics anywhere, and nothing third-party at all on the pages hiya publishes — a visitor to someone's page is not measured, profiled or passed to anyone. Our own pages (this one, the dashboard, pricing) carry a live-chat widget so you can reach us, and it is named below. We don't sell anything to anyone. You can delete all of it yourself, whenever you like.
1. Who's responsible
hiya operates hiya from South Africa and is the party responsible for the personal information described here — the “responsible party” under South Africa's POPIA, and the “controller” if the UK or EU GDPR applies to you.
Reach us at [email protected] for anything in this policy.
2. What we collect
From Discord, when you sign in
We ask Discord for the identify scope only. That gives us four things:
- your Discord user ID (a number, which is how we recognise you);
- your Discord username;
- your Discord display name, used as a starting suggestion;
- the web address of your Discord avatar image.
We do not receive your email address, your password, your phone number, the servers you're in, your friends or any of your messages. We never post anything as you. We keep the short-lived Discord access token only for the few seconds it takes to read those four fields, and never store it.
What you give us
- the username you choose, and any previous ones you've released;
- everything on your page: headings, text, links, colours, emoji, section layout — both the published version and your unpublished draft;
- images, audio and fonts you upload (banner, project images, icons, tab icon, a page track, a page typeface), with their file size, type and dimensions;
- the content of any report you send us about someone else's page.
- if you connect your own domain (Hiya Advanced): the domain name, when you added it, and the results of our checks on its DNS records and security certificate.
- if you run a business page, everything on it (published and draft), the people you add as its editors, and its view counts — handled exactly like your own page;
- if you apply for the Verified badge or a business page, what you put in the application — the links and follower count you give us, and what you wrote — and our decision.
- if you buy Hiya Advanced, the fact that your account holds it, when it was granted and a short internal note about why. There is no payment page yet, so we hold no card details, no billing address and no payment processor records — an upgrade is switched on by hand.
- if you start the free Advanced trial, when it started and when it ends, so each account gets one.
Your page is a free-text space, so what ends up in it is up to you. Please don't put anything sensitive in there — health information, ID or card numbers, your home address — that you wouldn't want on a public web page, because that's exactly what a published page is.
Collected automatically
- Your IP address, used two ways: as part of a short-lived counter that stops someone brute-forcing invite codes or flooding uploads, and recorded against certain administrative actions in our internal audit log.
- Server logs. Our web server records requests in the ordinary way — address, time, path, status, user agent — which is what lets us diagnose faults and spot attacks.
- Page view counts. When someone opens a published page we add one to a daily total for that page. We store a number per page per day and nothing about the visitor — no IP, no cookie, no fingerprint, no idea who they were. We don't count the page owner viewing their own page.
- Where a visit came from. If a visitor arrives by following a link, their browser tells us which site it was on. We keep only the site's name — “discord.com”, not the address of the particular page, which can carry a search term, a session ID or someone's username. It's added to a count per page per day, the same way as a view. Arriving from a bookmark or a typed address records nothing.
- Which links get pressed. When a visitor follows a link off a published page, we add one to a count for that destination. We keep the site and the path and drop the query string, so the tracking parameters some links carry aren't stored. Counted once per link per visit, against the page — never against the visitor, who stays as anonymous here as in a view count.
- Timestamps — when your account was created, last signed in, and last changed.
- Who invited you, and which code you used.
4. Why we use it
| What for | Using | Lawful basis (GDPR) |
|---|---|---|
| Signing you in and knowing who you are | Discord ID, session cookie | Performance of our agreement with you |
| Storing and publishing your page | Page content, drafts, uploads, username | Performance of our agreement with you |
| Showing you how many people visited | Daily view totals | Performance of our agreement with you |
| Stopping abuse, spam and brute-force attempts | IP address, rate-limit counters, server logs | Our legitimate interest in a service that works |
| Handling reports and moderating content | Report details, page content, account records | Our legitimate interest in keeping people safe; legal obligation where one applies |
| Keeping staff accountable for admin actions | Audit log, including staff username and IP | Our legitimate interest in accountability and security |
| Responding to a lawful request or defending a claim | Whatever is relevant and necessary | Legal obligation, or our legitimate interest |
We don't use your information to build a profile of you, to make automated decisions with legal effects, or to advertise anything.
5. What's public
Assume these are visible to anyone on the internet:
- your username, because it's the address of your page;
- everything on your page once you publish it, including any image you upload to it;
- the display name and avatar you choose to show on it;
- a custom domain you connect, and that it shows your page. Certificates for it are recorded in public certificate-transparency logs, which anyone can search;
- a business page you run, once we've approved it and you've published it — its name, its address and everything on it;
- any template you share, once we've approved it — including the pictures and audio on its preview, and your username as its creator. A template is public even while your own page is unpublished, because the two are separate copies.
These are not public:
- your Discord ID;
- your unpublished drafts and version history;
- your view counts and visitor stats;
- your badge and business-page applications;
- who invited you, and how many invites you have left;
- anything in our server logs or audit log.
Search engines can index a published page, and anyone can archive or screenshot it. Unpublishing removes it from us but can't remove copies other people or services already made.
6. How long we keep things
| What | Kept for |
|---|---|
| Your account and its settings | Until you delete the account |
| Your page, your draft and your uploaded images, audio and fonts | Until you remove them, or until you delete the account — files are erased from the server's disk, not just hidden |
| Business pages you own | Until you delete them, we remove them, or you delete the account |
| Badge and business-page applications, and our decisions on them | Until you delete the account |
| Templates you shared | Until you withdraw one or delete the account. Withdrawing clears the public copy immediately; pages other people built from it are their own copies and are not affected |
| Version history | The most recent 10 published versions, or 15 on Advanced; older ones are pruned automatically |
| Released usernames | About 30 days, so nobody can take your old handle and impersonate you |
| Daily view counts | Indefinitely — they're a number per page per day and contain nothing about visitors |
| Rate-limit counters (which include an IP address) | Minutes to an hour, then deleted automatically by the database |
| Server request logs | Rotated by the server, typically a couple of weeks |
| Moderation reports and decisions | Kept after they're resolved, as the record of what was decided and why |
| Audit log of administrative actions | Kept long-term for security and accountability. Entries can include a username, a Discord ID and an IP address, and survive the deletion of the account they refer to |
| Record that an invite code was redeemed | Kept after account deletion, so the chain of who invited whom stays intact. Accounts made during an open-signup period have no code and no inviter to record, so there is nothing to keep |
Backups of the database may hold copies for a short period after deletion before they're overwritten in the normal cycle.
7. Who else is involved
Running the service means a few other companies necessarily see some data. We don't give any of them your information to use for their own purposes.
- Discord — handles signing in. Discord knows you authorised hiya, and your use of Discord is governed by their own privacy policy. Avatar images are loaded straight from Discord's CDN, so your browser contacts Discord when one is displayed. If you apply for a business page, you can sign in to Discord once more with the
guildspermission so we can confirm you own the business's server: we read your server list that one time, keep only the server you pick (its name, ID, icon and member count) with your application, and don't keep any access to your Discord account. - Google Fonts — the site's typeface (Inter) is loaded from Google's servers, which means your browser reveals your IP address to Google when a page loads. We don't receive anything back from them. The same applies if a page you visit uses one of the other Google fonts a Hiya Advanced page can choose. A page whose owner uploaded their own font is different: that file is served from our server, so no third party is involved.
- Spotify and Apple Music — a page with a music player on it loads that player straight from Spotify or Apple, so opening the page reveals your IP address to them, and their own privacy policies apply to what the player does.
- Discord and Roblox on business pages — a business page can show its Discord server or its Roblox games. The live numbers are fetched by our server, not your browser, but the server icon and game pictures load from Discord's and Roblox's image servers, which reveals your IP address to them.
- YouTube — if a page has a YouTube video on it, the video's preview picture is loaded from YouTube's image server, which reveals your IP address to Google. The player itself only loads when you press play, from YouTube's privacy-enhanced domain (youtube-nocookie.com); after that, YouTube's own privacy policy applies to what you watch.
- Tawk.to — the live-chat bubble on hiya's own pages. It loads from Tawk's servers, so opening one of those pages reveals your IP address and which page you are on to them, and it sets its own cookies. If you start a conversation, what you type is stored by Tawk and readable by us. It is not loaded on the pages hiya publishes for members, so visiting someone's portfolio never contacts Tawk at all.
- GitHub — if you send a feature suggestion or a bug report from the roadmap page, what you wrote is stored as an issue in our private GitHub repository, along with your hiya username and, for a bug report, which browser you were using. Only the title can ever appear on the public roadmap, and only after we've looked at it. Deleting your account removes the link between your account and what you sent, but not the issue itself — ask us and we'll delete that too.
- Our hosting provider — the server that stores the database and your uploaded images, audio and fonts is rented from a hosting company, whose staff could technically access the machine.
- Cloudflare — manages DNS for hiya.page, and may sit in front of traffic to it.
- Let's Encrypt — if you connect your own domain, we get the security certificate for it from Let's Encrypt, a non-profit certificate authority. They receive the domain name and nothing about you. To check your DNS records we look them up through public DNS resolvers (Cloudflare's 1.1.1.1 and Google's 8.8.8.8), which see the domain name being looked up.
- Discord, again, for our own operational notices — some things that happen on hiya are posted to our own private staff channels so we see them promptly. That covers reports, new accounts, invite codes being created and used, moderation actions, Advanced and badge changes, and pages being published or unpublished. What is sent is the hiya username involved, a link to the page where there is one, and the nature of the event — for a report, also the reason chosen and whatever the reporter typed. These notices never contain an email address, an IP address, a password or anything from a draft you have not published. If you report anonymously, nothing identifying you is sent. Each type of notice can be switched off, and any that are switched off send nothing at all.
- Our Discord bot — in the hiya Discord server, the bot gives roles that match your account (for example Hiya Advanced or a badge you hold), using the Discord ID you signed in with; it never changes any other role. If you use
/suggestor/bug, what you wrote goes to GitHub as described above, with your Discord username and ID, and is posted in the server's suggestions or bug channel. Votes on those posts are stored as the Discord IDs of the people who voted.
There is no analytics provider, no advertising network, no email marketing platform and no data broker in that list, and we have no plans to add one.
9. Your rights and choices
Wherever you live, you can ask us to do the following, and most of it you can do yourself right now:
- See what we hold. Most of it is in your dashboard already. Email us for the rest and we'll send you a copy.
- Correct it. Your page, display name and username are all editable by you.
- Delete it. Account settings → delete account. That erases your account, page, drafts, version history, image files, business pages you own and your badge applications. The exceptions are in section 6: audit entries, resolved moderation records and the fact that an invite code was used.
- Take it offline without deleting. Unpublish from the editor and only you can see your page.
- Object to a use we've justified by legitimate interest, or ask us to restrict it while we look at your objection.
- Get it in a portable form — ask and we'll send your page content as a data file.
- Withdraw Discord's authorisation at any time from your Discord settings, under authorised apps. Note that this stops you signing in, but doesn't itself delete your hiya account.
Email [email protected]. We'll reply within 30 days. We may need to confirm you control the Discord account in question before acting, so that nobody can delete someone else's page by asking nicely.
10. Security
- We never handle your password. Discord does the authenticating, so there is no password of yours for us to lose.
- Everything is served over HTTPS. Session cookies are signed, HttpOnly and Secure, so page scripts can't read them and a tampered cookie is rejected.
- Suspending an account invalidates its existing sign-ins immediately rather than waiting for the cookie to expire.
- Uploads are checked by inspecting the file's actual contents, not by trusting its name, and SVGs containing scripts are refused.
- The database listens only on the server itself and requires authentication; it isn't reachable from the internet.
- Page content is escaped when rendered, so one member can't inject code into another's browser.
None of that makes any system perfectly secure. If something does go wrong in a way that puts you at risk, we'll tell you and the Information Regulator (South Africa) as the law requires.
11. Children
hiya isn't for anyone under 13, and we don't knowingly collect information from children. If you believe a child under that age has an account, email us and we'll remove it. Where a child's local law sets a higher age for consenting to online services, that age applies instead.
12. Where your data is
The database and your uploads live on a single rented server. Because Discord, Google and Cloudflare operate globally, some processing necessarily happens outside South Africa — including in the United States. Where the GDPR applies to you, those transfers rely on the mechanisms those providers put in place, such as the European Commission's standard contractual clauses.
13. Changes to this policy
If we change what we collect or what we do with it, we'll update this page and the date at the top. For a change that materially affects you we'll give notice on the site before it takes effect.
14. Contact and complaints
Email [email protected] with any question or request about your information, and please say what you'd like us to do.
If you're not happy with how we've handled it, you can complain to the Information Regulator (South Africa), or to the data-protection authority where you live.
The rules for using the service are in our Terms of Service.