Privacy Policy
Effective 10 September 2026. Last updated 10 September 2026.
HiWall is a private wall for one event. It is built so that the fewest possible people — including us — can see your photos. This page says exactly what we hold, why, who else receives it, and how to make it go away.
Who we are
HiWall is operated by FLYYY INC., a company registered in New York, United States, which is the data controller for the information described here. Write to us at support@hiwall.io about anything on this page, including a request to access, correct, export or delete your data.
This policy covers the HiWall apps for iPhone and Android, the API at api.hiwall.io that serves them, and this website.
What we collect
Your account
To sign in you give us an email address — either directly, for a one-time code, or through Apple or Google if you use one of those buttons. We store that address, the display name and username you choose, and an internal account identifier. You can also use HiWall as a guest, which creates an account with no email address attached at all; a guest can take part in a wall and nothing about them identifies a person to us.
Your photos
We store the photos you take or upload, and which wall each belongs to. Two details are worth stating plainly because most apps do not:
- Every image anyone else can see has been stripped of its metadata. Served images are re-encoded from decoded pixels, so EXIF, GPS coordinates, camera make and every other embedded tag are gone by construction, not by a filter we maintain.
- The original file your camera wrote is kept privately for as long as the photo exists, so a different look can be applied later without asking you to upload again. That file still contains whatever your camera recorded, which on a phone usually includes GPS coordinates. It is returned only to the person who took it — not to the host, not to other guests, and not through any public URL. It is stored in a private bucket reachable only through a short-lived signed link from an audited endpoint.
Your device
If you allow notifications, we store the push token Apple or Google issues so we can tell you a wall was revealed or someone joined. We record which platform issued each token. We also use Apple's App Attest to check that a request came from a genuine copy of the app, which tells us nothing about you or your device's identity.
Technical records
Our servers log requests — IP address, time, which endpoint, and an anonymous request identifier — to keep the service up and to stop scripted abuse. Privileged actions inside a wall (revealing it, removing a participant, a moderation decision, downloading a photo, changing settings) are written to an audit log, because a shared space where nobody can tell what happened is worse for everyone.
Purchases
Upgrading a wall is an in-app purchase through Apple or Google. They handle the payment; we never see your card details, billing address or Apple/Google account. We receive and store only what the store signs and hands us: the product bought, the store's transaction identifier, and whether it was a test purchase.
Diagnostics and product analytics
We record internal events about how features are used — a wall created, an upload finished — against a pseudonymous identifier. These never carry display names, wall names, photo content or photos themselves. There are no advertising identifiers and no third-party advertising or tracking SDKs anywhere in either app.
What we deliberately do not collect
- Your contacts. When a host invites people, the app sends only the addresses that host already picked in their phone's own contact picker, and the server answers which of them already have accounts. Nothing from that list is written down; the question is answered and forgotten.
- Your location. No location permission is requested and no positioning is performed. The only location data that exists anywhere is whatever your own camera embedded in your own original file, described above.
- Advertising identifiers, cross-app tracking, or anything sold or shared with data brokers. We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are used under California law.
Why we use it
| Purpose | Legal basis (UK/EEA) |
|---|---|
| Running walls: accounts, invitations, uploads, galleries, reveals | Performance of our contract with you |
| Notifications you switched on | Consent, withdrawable in your device settings at any time |
| Keeping the service up, preventing abuse and fraud, audit logs | Our legitimate interests in a service that works and is not abused |
| Crash reports and diagnostics | Our legitimate interests in fixing what is broken |
| Purchases and their records | Performance of our contract, and our legal obligation to keep transaction records |
Who else receives it
We use a small number of service providers, each of which handles data only on our instructions. None of them is permitted to use it for their own purposes.
| Provider | What reaches them |
|---|---|
| Supabase | The database and the photo storage themselves — all of the above, at rest and encrypted |
| Render | Runs the API; processes requests in transit |
| Resend | Your email address, to deliver sign-in codes and notification emails |
| Sentry | Crash reports. From the signed-in account these carry the internal account identifier and nothing else about you |
| Canny | The feedback board. Only if you open it: your name, your email address and your internal account identifier. The board is public — anything you post there is visible to other people. Both apps say this before your first visit |
| Apple and Google | Push delivery, sign-in if you use their buttons, and in-app purchases |
| Vercel | Serves this website |
We will also disclose information where the law requires it, or to protect someone's safety or our rights. If HiWall is ever sold or merged, your data may transfer with it, and this policy would follow it until replaced by one no less protective.
Where your data is
Everything is processed in the United States. If you use HiWall from the United Kingdom or the European Economic Area, your data is transferred there under the standard contractual clauses our providers offer, or an equivalent lawful transfer mechanism.
How long we keep it
- Your account and photos: until you delete them, or the account.
- A deleted wall's photos: purged from storage within 30 days.
- Audit logs: 13 months.
- Notification delivery records: 90 days.
Deleting your account
Delete your account from inside the app, under Settings. You do not have to email anyone and we do not ask why. Step-by-step instructions, and the full list of what is deleted and what is kept, are here. When you do:
- Every session and device is signed out immediately.
- Your photos and the stored files behind them — including the camera originals — are permanently deleted within 30 days.
- If you signed in with Apple, we revoke the token with Apple, as Apple requires.
- If you ever opened the feedback board, that profile is deleted too, and it takes your posts, comments and votes with it. A deletion that left your name and address on a public board would not be a deletion.
- Your contributions to other people's walls become blank placeholders rather than vanishing without trace, so the people who were there are not left wondering what happened.
Your rights
Wherever you live, you can ask us to give you a copy of your data, correct it, or delete it, and we will not treat you differently for asking. Email support@hiwall.io; deletion is faster from inside the app.
If you are in the UK or the EEA you also have the right to object to or restrict processing based on our legitimate interests, the right to data portability, the right to withdraw consent at any time, and the right to complain to your local supervisory authority. If you are in California, you have the rights to know, delete, correct and opt out; as stated above, there is nothing to opt out of, because we neither sell nor share personal information.
Children
HiWall is not intended for children under 13, and we do not knowingly collect their data. In the UK and EEA, the minimum age is 16 unless a parent or guardian consents. If you believe a child has an account, write to us and we will remove it.
Security
Traffic is encrypted in transit with TLS, and the database, the photo storage and the backups are encrypted at rest with AES-256. Sessions use short-lived tokens that rotate, held in the iOS Keychain and the Android Keystore. Photos in a wall that has not been revealed are not readable by anyone — including the host, and including us. No system is perfect, and we will tell you and the relevant regulator promptly if something goes wrong that affects you.
Changes
If we change this policy we will update the date at the top, and we will tell you in the app before anything material takes effect.
Contact
FLYYY INC., New York, United States — support@hiwall.io