Privacy Policy
Effective date: 20 July 2026
This Privacy Policy explains how Wise Platform Limited, the company that operates HeySifu ("HeySifu", "we", "us" or "our"), collects, uses, stores, shares and protects your personal data when you use the HeySifu website and services (the "Service"). We are committed to handling your data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong and, where applicable, other data protection laws of the places where our users live.
By using the Service you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Service.
1. Who we are and how to contact us
The Service is owned and operated by Wise Platform Limited. For any question, request or complaint about your personal data, contact us at support@heysifu.com.
2. What we collect
2.1 Information you give us
- Email address — required to create an account. We use passwordless one-time-code login, so your email is the only credential we hold. We never store a password.
- Display name — optional. If you do not set one, we default it to the part of your email address before the "@" sign. You can change it at any time.
- Language preference — one of Cantonese (Traditional Chinese), English, Filipino or Bahasa Indonesia.
- Notification preference — whether you want an email when a video you submitted finishes processing.
- Personal cooking notes — short notes (up to 200 characters each) you attach to recipe steps on videos you have saved. These are private to your account unless you create a share link (see Section 5.3).
- YouTube links you submit — when you submit a YouTube video for recipe analysis, we record the YouTube video ID and that your account submitted it.
2.2 Information collected automatically
- Usage interactions — when you open a video page, start playing a video, watch past the halfway point, or share a video, we record these events. If you are logged in, they are linked to your account so we can personalise your "Recommended" feed. If you are not logged in, they are only added to anonymous daily totals per video — we do not use cookies or any other identifier to track visitors who are not logged in.
- Saved-video library — which videos you have bookmarked, and when.
- IP address — used transiently for security rate-limiting (for example, limiting how many login codes or video submissions can be requested in a short period). Rate-limiting counters are processed by our infrastructure provider (Upstash) and expire automatically; we do not build profiles from IP addresses.
- Coarse region — our content delivery network (Cloudflare) resolves the country your request comes from and passes that country code to our server; we do not receive or store your IP address for this purpose. If that signal is unavailable, we fall back to your language preference as a rough proxy for region. We use this only to show regionally relevant sponsored or affiliate content (for example, products available in your country) — not to build a location history or profile of you.
- Error reports — if the Service encounters a technical error, technical details about what went wrong (such as the page you were on, your browser type and your IP address) may be sent to our error-monitoring provider (Sentry) so we can diagnose and fix the failure. We do not use error reports for advertising or profiling.
- Cookies — see Section 6.
2.3 What we do not collect
We do not collect phone numbers, physical addresses, payment details, government identifiers, precise location, contacts, photos, or microphone/camera input. The Service's voice features use your browser's built-in text-to-speech to read steps aloud — nothing is recorded. We do not use third-party advertising or analytics SDKs (no Google Analytics, Meta Pixel, or similar).
3. How we use your data
- To operate your account and log you in (email, one-time codes, session cookie).
- To provide core features: saving videos, personal notes, language settings.
- To personalise your "Recommended" feed and show related videos, using your saved videos, notes and usage interactions.
- To process YouTube videos you submit into structured recipes using AI (see Section 5.1).
- To send you transactional emails: login codes, and (if you opted in) processing-complete notifications.
- To protect the Service: rate limiting, abuse prevention, and diagnosing processing failures.
- To show regionally relevant sponsored or affiliate content, using your coarse region (see Section 2.2) and the content of the video you are viewing. We do not share your personal data with third-party advertising networks, and we do not build cross-site or cross-app advertising profiles.
We do not sell your personal data.
4. Legal bases
Where a legal basis is required, we rely on: performance of a contract (providing the Service you signed up for), our legitimate interests (securing the Service, improving recommendations from usage data, and showing regionally relevant sponsored content), and your consent (optional email notifications, which you can withdraw at any time in your account settings).
5. Sharing with third parties
5.1 Service providers (processors)
We share data with the following providers only to the extent needed to run the Service:
- Supabase — hosts our database (all account data described above).
- Cloudflare — content delivery network sitting in front of our servers. Resolves the coarse country your request comes from (see Section 2.2) and helps route traffic efficiently; we do not send Cloudflare any account data beyond what is needed to serve the page.
- Upstash — processing queue, caching and rate limiting. Receives your IP address and internal account ID transiently for rate-limiting purposes.
- Resend — delivers our transactional emails to your email address.
- Google (Gemini API and YouTube Data API)— when a YouTube video is submitted, we send the public YouTube URL and its public metadata (title, description, category, duration) to Google's Gemini API to generate the recipe. We do not send your email or name with these requests.
- Groq — receives the public title, hashtags and category of a submitted video to check that it is a cooking video before full processing.
- Sentry — error monitoring. When a technical error occurs, receives technical details of the failure (which may include your IP address and browser information) so we can fix it.
- AI question-answering provider — if you use the "ask a question about this video" feature, your question text is sent to an AI service to generate the answer.
5.2 YouTube and Google embeds
Recipe videos are played through YouTube's privacy-enhanced embedded player (youtube-nocookie.com). On most devices, the player only loads after you press play. On Apple iOS devices (iPhone and iPad), however, the player is loaded in the background — paused and hidden — as soon as you open a video page, before you press play. This is a technical requirement of iOS: without it, starting playback would require two taps instead of one. Loading the player sends your IP address and basic device information to Google/YouTube, so on iOS this happens when the page opens rather than when you press play. The privacy-enhanced player does not set advertising or tracking cookies until you actually start playback; once you do, Google/YouTube may set its own cookies and collect data under its own privacy policy, which we do not control. Our pages also load an icon font from Google Fonts, which means your browser sends your IP address to Google when fetching it.
5.3 Content you choose to share
If you create a share link for your cooking notes, anyone who has that link can see those notes and your display name. You can delete your share links at any time from your account page. If someone accepts your shared notes, a copy is saved into their own account and is not removed when you later delete the link.
5.4 Legal requirements
We may disclose personal data if required by law, court order, or a lawful request by authorities, or where necessary to protect the rights, safety or property of HeySifu or others.
6. Cookies
The Service sets only the following cookies. We do not set marketing or analytics cookies.
| Cookie | Purpose | Lifetime |
|---|---|---|
| heysifu-jwt | Keeps you logged in (essential; HttpOnly) | 7 days |
| heysifu-locale | Remembers your language choice | 1 year |
Your browser's local storage may also cache your email and display name after login so pages load faster; this stays on your device and is cleared when you log out.
7. How long we keep data
- Account data is kept for as long as your account exists.
- One-time login codes expire within minutes and are deleted once used.
- Rate-limiting records expire automatically within minutes to hours.
- Anonymous per-video usage totals (daily view/play/share counts) are aggregate statistics not linked to any person and may be retained indefinitely.
8. Your rights and choices
- Access and correction — you can view and edit your display name, language and notification settings in your account page. For anything else, email us.
- Deletion — you can delete your account yourself from the account page. This permanently removes your profile, saved videos, notes, share links and usage interactions. Recipes generated from videos you submitted remain available to other users, but are no longer attributed to you.
- Withdraw consent — turn off notification emails at any time in settings.
- Complaints — you may contact us first at support@heysifu.com; users in Hong Kong may also complain to the Office of the Privacy Commissioner for Personal Data (PCPD).
9. Security
We use industry-standard measures to protect your data: passwordless login (no password database to breach), HttpOnly session cookies, encrypted connections (HTTPS), server-side-only database access, and rate limiting on sensitive endpoints. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your data proportionately to its sensitivity.
10. Children
The Service is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has created an account, contact us and we will delete it.
11. International transfers
Our service providers (listed in Section 5.1) may store or process data in data centres outside your home jurisdiction, including outside Hong Kong. Where we transfer data internationally, we rely on our providers' contractual and security commitments to protect it.
12. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date above and take reasonable steps to notify you (for example, a notice on the Service). Continued use after changes take effect means you accept the updated policy.
13. Language
This Privacy Policy is prepared in English. Translations into other languages are provided for convenience only; if there is any inconsistency between the English version and a translation, the English version prevails.