Who is responsible

The operator named in the Imprint is responsible for your data: pokbytes, Inhaber: Calvin Dudek, Antonia-Kozlova Strasse 7, 22763 Hamburg.

Contact: [email protected].

For questions about your data, write to [email protected].

What we collect

On the waitlist: your email address and, if you choose to say, your role.

With an account: your name, email address and picture. If you sign in with Google or GitHub, we get these from them and nothing else, and they learn that you use HeyDiff.

If you set a password, we store only a scrambled form of it (a hash), never the password itself.

If you add a passkey, we store its public key, the name you gave it and when you last used it. The private key stays on your device.

When you set a password, we check it against a public list of leaked passwords. Only the first five characters of a scrambled form of your password leave HeyDiff; the password itself never does.

Your team’s content: comments, replies, drawings, moves and the screenshots of the pages you review.

Connected apps and when they were last used.

Server logs: the address of the request, the time and the page asked for.

Usage statistics: the pages you open, your browser and device type, and a few actions: joining the waitlist, accepting an invitation, creating an organisation, sharing a session, starting and deciding a decision.

We do not send your email address or your name. If you choose Allow all and you are signed in, we send your account ID so your visits link to your account.

PostHog does not store the address of your request.

Your country, which our network provider reads from the address of each request. We use it only to show prices in the right currency and with the right tax note, and we do not store it.

Why, and the legal ground

Waitlist: your consent. You give it by confirming your email address and you can withdraw it at any time with Leave the waitlist.

The service: our contract with you, to give you the product you signed up for.

Logs: our legitimate interest in keeping HeyDiff secure and working.

Usage statistics without a cookie: our legitimate interest in knowing which pages people use.

The cookie and the link to your account: your consent. You give it with Allow all and withdraw it at any time under Cookie settings in the footer or on your Profile page.

Your country: our duty to show prices the way the law of your country requires, and our legitimate interest in showing them in your currency.

Who processes it for us

Our network and security provider carries every request to heydiff.com, to protect HeyDiff and to tell us the country a request comes from. It sees each request in full, including its address, the page asked for and what you send. The provider is a US company; the transfer rests on the EU-US Data Privacy Framework.

Our hosting provider runs HeyDiff and keeps stored files in the EU.

Our email service provider sends the emails you ask for: the waitlist link, invitations, password resets and notifications. It sends them from the EU.

PostHog counts usage for us. PostHog Inc. is a US company; it stores our data on servers in the EU (Frankfurt). A data processing agreement covers it, and the transfer rests on standard contractual clauses.

Mail you send to [email protected] or [email protected] is received by our email service provider in the EU. We keep each message for 30 days and forward it to our team mailbox, which may be outside the EU; that transfer rests on the EU-US Data Privacy Framework.

How long we keep it

Unconfirmed waitlist entries: the confirmation link works for 7 days. We then delete the address the next time we process the waitlist.

The waitlist: until you join or leave. Leaving deletes your email address at once.

Account and content: until you or your organisation delete them.

Server logs: 30 days.

Usage statistics: 12 months in PostHog, then PostHog deletes them.

Your answer to the cookie question: 180 days, in the cookie hd_consent.

Cookies

HeyDiff sets one cookie to keep you signed in. While you sign in with a passkey, it sets a second cookie for five minutes so the sign-in can finish safely. If an address is not on HeyDiff yet, it sets a cookie for five minutes so the sign-in page can offer that address for the waitlist. It sets another, hd_consent, for 180 days to remember your answer to the cookie question.

Before you answer, and if you choose Necessary only, PostHog sets no cookie and stores nothing in your browser.

If you choose Allow all, PostHog sets a cookie and a storage entry that link your visits to your account. They last up to 12 months.

Change your answer at any time under Cookie settings in the footer, or on your Profile page when you are signed in.

Our network provider may set its own security cookie to tell people from bots.

Your rights

You can ask us for access to your data, to correct it, to delete it, to restrict its use, to receive it in a portable form, and to object to its use.

You can withdraw a consent at any time. This does not affect what we did before.

You can complain to a data protection authority.

Write to [email protected] for any of these.

Changes to this page

When we change this page we change the date at the top. If a change matters to you, we tell you by email.