Hearest (相癒) Privacy Policy
Last updated 2026-10-04 · Covers the Hearest app for Android and iOS and the website towntown.us
Hearest is run by TownTown Inc. (小鎮 TownTown — "we", "us"). This policy explains what we collect, why, who processes it, how long we keep it, and what you can ask us to do. Contact: tobewithblue@towntown.us.
Hearest is a self-care journaling app. It is not a medical service and does not diagnose or treat any condition. If you are in crisis or thinking about harming yourself, contact your local emergency number or a crisis line right away (Taiwan: 1925).
1. What we collect in the app
Your account. You sign in with Google. Through Firebase Authentication we receive your email address and the account ID Firebase Authentication gives you in Hearest, which we also store with your Hearest profile on our servers. Each request the app sends to our servers' API carries a sign-in token from Firebase (pictures and other files the app downloads are fetched without it), which also contains your Google account's name and profile-photo link; our servers use it to confirm that the request comes from you, and their logs may record details of the request. Firebase keeps your Google account's name and profile photo. We never receive your Google password. You choose a nickname and one of our preset avatars, and you can set your language, region, music and sound preferences.
What you write and choose. We store what you create so the app can show it back to you:
- seeds — what you write about a worry, its category (for example health or relationships), how you feel, the tree you pick, who can see it, reminder times, and the AI's reflections on it; older seeds also still hold the comments and replies left on them in earlier versions of the app;
- guided reflections — your conversation with the AI guide, and the rating and feedback you give at the end;
- the Treehole — the letters and replies you write, drafts, your Treehole nickname and mood animal, and the matching preferences you set, such as topics you care about;
- Hearest Friends — friend requests, friendships and the nicknames you give friends. An invite QR code or link contains your account ID. If someone opens it in a web browser, the page that passes it on to the app or the app store is hosted by Zeabur, which receives the link, including your account ID, with ordinary request details.
Much of this is about your feelings and well-being, and we treat it as sensitive information.
Collected automatically.
- A notification token, so we can send you notifications. To deliver a notification, Google (Firebase Cloud Messaging) and Apple also handle the details needed to open it — for example account IDs (a friend's, or a letter writer's), a friend's nickname and avatar, the IDs of seeds, letters and drafts, and a letter's score.
- App-integrity checks (Google Play Integrity on Android, Apple App Attest on iOS) on requests to the AI guide, and when you delete or restore your account.
- An ID for this installation of the app, which Google receives when the app downloads its current settings (Firebase Remote Config).
- On iPhone, to tell whether you are offline or our servers are down, the app loads a small test page from Apple (captive.apple.com), so Apple receives your IP address and ordinary request details.
- Like any app that uses the internet, your IP address and basic request details reach the servers that answer each request — our servers at AWS and Google, and the other providers in section 5 — which may keep them in their logs.
- Crash reports (Firebase Crashlytics): device model, operating system, app version, technical details of the crash and an ID for this installation of the app, which groups reports from the same installation. We don't attach your account to them. On Android, when Google sign-in fails or is cancelled, the app also sends Crashlytics a short report of what went wrong — the kind of failure, whether the account picker appeared, and the Google Play services version — so we can fix sign-in problems.
- On Android only, Google Analytics for Firebase records standard app-usage events with a separate analytics ID for this installation of the app (the app-instance ID), and estimates your approximate location (for example your city) from your IP address. We use it only to see how the app is used — never for advertising — and we don't collect your device's advertising ID.
- On Android, the QR code scanner is Google's ML Kit. When you open it, ML Kit sends Google technical information — your device model and system version, the app version, identifiers for your device and this installation of the app, and how the scanner performed — which Google uses under its own privacy policy to maintain the scanner and detect abuse. The camera image itself stays on your phone.
- On Android, if you install the app from a friend's invite link, Google Play keeps the link's invite details — which include your friend's account ID — and the app reads them once after installing to connect the invite.
Bug reports. When something goes wrong and you agree to send a report, we receive the note you type, recent app logs with message contents removed, technical details of the request that failed, your device model and software versions, and your account ID. The app also sends such a report automatically, without asking, when it finds duplicated Treehole letters, so that we can fix the cause.
Feedback and emails. The feedback form in Settings is a Google Form: Google Forms stores what you enter there, including your email address and nickname. If you email us, the message stays in our mailbox (Gmail, in our Google Workspace).
What we don't collect. The app never asks for your device's location; the only location information is the approximate one Google Analytics estimates on Android, described above. The app doesn't access your contacts, the photos on your phone or your microphone, and it never asks for your phone number, birthday or legal name. If you type details like these into something you write — a seed, a letter, a bug report, the feedback form or an email — they are stored and sent along with that text. The camera is used only to scan friend QR codes, and the image never leaves your phone. We show no ads and don't track you across other companies' apps or websites.
2. How we use it
- To run the app: keep your forest, deliver and match Treehole letters, connect friends, remind you, send notifications and keep your data in sync.
- For the AI features described in section 3.
- To keep Hearest safe and working: check app integrity, fix crashes and investigate bug reports.
- To improve Hearest: see how the app is used (analytics on Android) and, from the rating you give at the end of a guided reflection, whether the AI guide helps.
We don't sell your information and we don't use it for advertising.
Legal bases (EEA and UK). We process your information to provide the service you signed up for (contract); to keep it secure and fix problems (including the automatic reports about duplicated Treehole letters) and to understand how the app is used through analytics on Android (legitimate interests); and — for the bug reports you choose to send, for information about your health, and on the website for reader analytics and the newsletter — with your consent.
3. AI features
When you plant a seed or talk with the AI guide, what you write, with your language and region, is sent from our servers to OpenAI, which writes the reflection or reply. This can happen while you are still writing a seed and when a reminder is due. Before you sign in, the app shows you this policy and asks you to agree to it, and you can't sign in without agreeing. You can withdraw only by deleting your account in the app. We don't attach your email address or other account details to it; anything you write yourself, including any names or contact details in it, is sent as you wrote it. OpenAI may keep any of these requests for up to 30 days to detect abuse, under its own policy.
Conversations with the AI guide. To stay consistent from one conversation to the next, the guide builds a memory in our database at Google (Firestore, United States): a summary of each conversation and a profile of what comes up for you — recurring themes, what matters to you, and the approaches that help or that you would rather avoid. It also automatically assesses each message you send for signs of risk, such as hopelessness or thoughts of self-harm: it records the kinds of risk it sees, an overall risk level, how confident it is, and a one- or two-sentence explanation. These assessments are kept for safety review and to check the guide's quality, and they never change what the guide replies. To choose how to respond, the guide also judges your state in each message — for example how intense your feelings seem, how ready you are for a suggestion, how much you can take in, and patterns such as rumination, hopelessness or self-criticism — and keeps that judgment, the approach it chose and a short explanation with the conversation. OpenAI also keeps a copy of every request we send it for the guide and of its reply — including your conversation and the memory built from it — in our OpenAI account, where the people who run Hearest can look at them to find and fix problems with the guide. When a conversation ends, we also save it with your seed on our servers at Amazon Web Services (Japan): the whole conversation, its closing summary, and the feedback and score you give it.
Seeds. OpenAI also keeps the requests about your seeds, and its replies, in our OpenAI account, for the period OpenAI sets.
AI replies can be wrong and are not professional advice.
4. What other people can see
- A Treehole letter is delivered to another Hearest user with your Treehole nickname, your mood animal and the kind of support you chose for it (for example, just to be listened to, or to find a way through together) . The app doesn't show them your email address or account details, but their app does receive your account ID with the letter and keeps it hidden. They can reply, and they can forward it to other users.
- Seeds you set to "Hearest Friends" or "Public" can be seen by your friends or by visitors to your forest. Seeds set to "Just me" are not shown to anyone else in the app. However, when a friend opens your forest, their app currently downloads all your seeds, including those set to "Just me", and hides those on their phone.
- Comments and replies that you or your friends left on seeds in earlier versions of the app are still kept with those seeds, with each writer's account ID, nickname and avatar, and are sent to the app of anyone who opens that forest — the seed's owner and their friends.
- Friends and people you invite see your nickname and avatar.
5. Who processes your information, and where
These companies process your information to provide their service to us:
- Amazon Web Services — our servers and databases, and the verification and account-deletion emails — Japan;
- Google (Firebase, Google Cloud and ML Kit) — sign-in, notifications, crash reports, app-integrity checks, configuration, analytics and the QR code scanner on Android, and part of our servers. Our Cloud Functions run in Taiwan and the United States and our Firestore database is in the United States; the other Firebase services run on Google's infrastructure worldwide;
- Google Workspace (Gmail) — our email, tobewithblue@towntown.us;
- Google Forms — the feedback form. This is a Google consumer service, which Google provides under its own terms and privacy policy;
- OpenAI — AI replies and reflections, and the copies of AI requests described in section 3 — United States;
- Zeabur — the web pages behind invite links and email verification;
- Cloudflare — the website and, if you agree, its reader analytics;
- Mailchimp (Intuit) — the website newsletter — United States;
- Apple and Google Play — notification delivery and app-integrity checks on their platforms, and on iPhone the connection check described in section 1; on Android, Google Play also passes the details of an invite link (including the inviting friend's account ID) to the app.
Your information may therefore be stored and processed outside your country. Apart from what you choose to share with other Hearest users (section 4), we share information beyond these providers only when the law requires it, or to protect someone's life or safety.
6. How long we keep it
- Your account and content: for as long as your account exists.
- Removing a friend: the letters and other exchanges between the two of you disappear from both apps, but we keep them without a time limit, and they come back if you become friends again.
- Deleting your account: in the app, you confirm on a screen that shows the recovery period (currently 1 hour). Signing in during that period restores your account. When it ends, we permanently delete your profile and your seeds from our servers' databases; backups we have made may still hold copies. Letters you exchanged with other people stay in their mailboxes. Your own Treehole letters, replies and drafts, your friend requests and records left by features of earlier app versions are not deleted either; if you sign up again with the same Google account, they come back. Messages still waiting in our delivery queues when your account is deleted, such as notifications and letters sent from older versions of the app, are not removed with it and are kept for a few days. Your language and region setting, your bug reports, your sign-in record at Google (Firebase Authentication keeps your account ID, your Google account's own ID, your email address, name and profile-photo link) and, if you have used the guided reflection, the records the AI guide keeps in our Firestore database and the saved copies of your finished conversations on our Amazon Web Services servers (section 3) are not deleted with your account; email us and we will delete them.
- Bug reports: until you ask us to delete them. They have no automatic expiry date and are not removed when you delete your account.
- Crash reports: 90 days (Firebase Crashlytics).
- The installation ID Google receives when the app downloads its settings (Firebase Remote Config): for the period Google sets.
- Notification delivery (Google's Firebase Cloud Messaging and Apple's push service): the ID Google uses to reach this installation is kept until we ask Google to delete it, and a notification that cannot be delivered right away waits for a limited time; Google and Apple set those periods.
- A friend's invite read through Google Play when installing on Android (including that friend's account ID): Google Play offers it to the app for 90 days after installing, and reinstalling resets it; how long Google keeps it beyond that is Google's to set.
- Usage analytics on Android (Google Analytics for Firebase): kept for the period set in our Google Analytics settings.
- Copies OpenAI keeps for abuse monitoring: up to 30 days.
- Copies of AI requests and replies, for the AI guide and for your seeds, that OpenAI keeps in our account (section 3): for the period OpenAI sets.
- Feedback-form answers and emails you send us: until you ask us to delete them.
- Information stored on your phone stays until you uninstall the app. On iPhone, your sign-in and a timer that limits verification emails (which includes your email address) stay in the system keychain even after you uninstall the app, so reinstalling the app on the same iPhone can sign you back in automatically; logging out before you uninstall removes both. If you back up your iPhone to iCloud or a computer, the backup includes the app's data on your phone.
7. Your choices and rights
- In the app you can edit your nickname and avatar, choose who sees each seed, archive seeds, remove friends and delete your account.
- Email tobewithblue@towntown.us to get a copy of your information, correct it, delete specific items, object to or restrict a use, or withdraw a consent — except the agreement in section 3, which you withdraw by deleting your account. We reply within 30 days. We cannot yet find and delete the copies of AI requests OpenAI keeps in our account one by one.
- You can turn notifications off in your phone's settings.
- If you live in the EEA or the UK, you can also complain to your data protection authority.
8. Children
Hearest is for people aged 13 and over. We don't knowingly collect information from children under 13. If you believe a child under 13 is using Hearest, email us and we will delete the account.
9. Security
Everything the app sends to our servers is encrypted in transit (HTTPS). Bug reports waiting to be sent are encrypted on your phone. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
10. The website
Like any website, towntown.us receives your IP address and ordinary request details with every visit: they reach Cloudflare, which hosts the site, and on pages that list crisis lines we use the country Cloudflare works out from your IP address to show the lines for your region, without storing it; Cloudflare may keep request details in its own logs. The site also counts how many times each article is opened — a count that records nothing about you — and, only if you agree in its banner, keeps a visitor ID and your reading activity (which articles, how far, how long, the referring site, country and city, device type, browser, operating system and window size) for 12 months, stored with Cloudflare. The site sets up to three cookies of its own: ha_consent remembers your choice for 6 months; only after you agree, ha_vid holds the visitor ID for 13 months and ha_sid marks the current visit until you close the browser. You can withdraw at any time on towntown.us/privacy/, which also deletes the records kept for that browser; the site has no accounts, so it cannot find records from another browser or device — withdraw there too. If you subscribe to the newsletter, your email address is stored with Mailchimp (United States) until you unsubscribe.
11. Changes
We will publish updates on this page with a new date. If a change materially affects how we use information you have already given us, we will tell you in the app or by email before it takes effect.
12. Contact
TownTown Inc. (小鎮 TownTown) · tobewithblue@towntown.us