Effective 2026-11-04 · Version 2026-11-04
We collect only what is needed to provide Heapo: account identifiers and sign-in details; uploaded photos, videos and their metadata, including the capture time and any location recorded in the file (GPS coordinates and place name), and place names members add; family, invitation, album and sharing-link details; comments, hearts and reports; storage usage, deletion requests, device notification tokens, IP addresses and service logs; and, if you use the home-screen widget in the mobile app, a random app install identifier and when the widget's read access was issued and last used. If a group creator publishes a post to the public explore space, we also collect the public nickname, the post text and tags, published copies of the selected photos and videos (with file information such as location removed), the version of the publishing notice they agreed to, and hearts, reports and blocks on public posts. Passwords are handled by Firebase Authentication and are not stored by us.
We use this information to authenticate accounts, operate private family albums, process media, sort media by date and group it by place, manage invitations and access, provide sharing links and reactions, prevent duplicates and abuse, answer support requests, and administer storage and subscriptions.
Account data and user content are deleted after the 30-day account-deletion grace period. Trashed media is deleted after 30 days. Photos and videos under an open serious report are kept as evidence until the report is resolved, regardless of trash, group or account deletion. Expired-plan overage may be deleted after the notified grace period. Revoked links stop working immediately (file URLs are covered in section 10); related audit records are retained only as needed for security and legal obligations. Home-screen widget read access expires 14 days after last use (at most 90 days after issue), and expired or revoked records are deleted daily. On sign-out or when the widget is turned off, it is removed from the device right away and the app asks the server to revoke it; if the app cannot reach the server (offline or the session has expired), it stops working when it expires as above. It is deleted when you are removed from a family, the family is deleted, or your account is deleted.
From 2026-10-06, when "Show my visits to family" is on, we record the date and time you open a family album, the number of visits per day, whether you arrived from a notification or the home-screen widget, and your device's time zone. We do not record which photos you viewed. The record lets family members who upload photos (owner and editors) see whether others visited recently, and helps us understand service usage.
Visit records are deleted 90 days after the last visit, immediately when you are removed from a family or the family is deleted, and entirely when your account is deleted. Turning the setting off stops recording from that moment.
We do not sell personal information. We disclose it only with consent, when required by law, or when necessary to protect a person from imminent harm. Content is shown only to the family members or link recipients selected by the user, except posts a group creator publishes to the public explore space (section 7). File URLs and invitation link previews work as described in section 10.
We use Hetzner for our servers, database and media conversion, Firebase for identity and notifications, Backblaze B2 for media storage, and Cloudflare for media delivery and temporary caching. They process information only to provide the contracted service and under appropriate safeguards.
Our servers and database, which hold the information described in section 1, are hosted by Hetzner in Germany. Identity data, device notification tokens and notification content may be processed by Google Firebase in the United States, media is stored by Backblaze in the United States, and media is delivered through Cloudflare in the United States and other countries where its network operates. Transfers occur continuously while the service is used, for authentication, notifications, storage and delivery, and last only for the retention periods described above.
The service is intended for parents and guardians sharing family media, not for children to create accounts. The uploader must have authority to share a child’s image. We promptly review reports involving child safety or unauthorized images. A group creator may choose photos and videos they uploaded themselves and publish them to the public explore space. Published photos, videos and post text can be seen by anyone without signing in and may appear in search engines. They are published as separate copies with file information such as location removed; the group's other photos and its details stay private. The creator can withdraw a post at any time and must have a guardian's authority to publish a child's image. Copies already saved by search engines or other people may remain after a post is withdrawn.
You may request access, correction, deletion, suspension of processing or withdrawal of consent by using account deletion or contacting support. We may verify identity and will respond as required by applicable law. Revoking a sharing link takes effect immediately; file URLs are covered in section 10.
Electronic records are securely erased so they cannot be restored; storage objects and derived thumbnails or streams are deleted together, although storage deletion can take 1 to 2 days and CDN temporary copies may remain until they expire, as described in section 10. Records that law requires us to keep are isolated and deleted when that period ends.
We use access controls, individually revocable recipient links (stored as a verification hash, and family links also as a server-side encrypted copy so parents can copy them again), encrypted transport, restricted operator access, backups and logging. List and detail requests are served only after checking group membership or a valid sharing link; a pending invitation link can show the group name, the inviter and one cover photo without sign-in. Media is delivered through a CDN. File URLs contain a hard-to-guess random value but do not expire, so anyone holding a URL can open the file without signing in, and the URL of a display copy can reveal the URL of the original. URLs people already have can keep working after a link is revoked, a member is removed or an item is made private. Trashed files stay reachable until they are permanently deleted (30 days after being moved to trash, or longer for content under an open report), and deleted files may stay reachable for a while through the CDN cache. Original photos and videos may contain the capture location, and some are delivered as the original file through sharing links. Album and sharing-link pages use noindex and a no-referrer policy; only posts published to the public explore space can appear in search engines. Public posts are served as separate copies after our server checks they are still public, not through group file URLs, and stop opening within minutes after they are withdrawn or removed.
Privacy officer: kim-jun-young (operator), juny3738@gmail.com. You may contact this address for any privacy request or complaint.
You may also seek help from the Personal Information Infringement Report Center (118), the Personal Information Dispute Mediation Committee, the police or other competent authority in your country.
Operator: june; representative: kim-jun-young; business registration number: 371-07-03738; support: juny3738@gmail.com.
We will announce changes before they take effect. Material changes affecting your rights will receive prominent advance notice. The Korean policy is the controlling version if a translation differs.