Privacy & safety
Hapipy holds personal things: letters between partners, photographs, the date a relationship started. This page explains, without legal language, who can see each of them and what we do to keep it that way. The formal version is our Privacy Policy.
Who can see what
| What | Who can see it | In search engines? |
|---|---|---|
| Everything inside a world (letters, photos, notes, dates, hidden memories, music) | The members of that world. Hapipy’s administrator has technical access (see below). | Never |
| A letter or proposal you send by link | Anyone who has the link | No — marked noindex |
| An unlisted invitation (the default) | Anyone who has the link | No — marked noindex, not in our sitemap |
| A listed invitation (only if you choose it) | Anyone | Yes, it may appear in search results |
| Replies (RSVPs) to an invitation | The members of the world that owns the invitation, and Hapipy’s administrator | Never |
How a world is kept private
- Access is checked by the database, not only by the app. Our database rules refuse to return a world’s contents to anyone who is not a member of it, whatever a browser asks for.
- Joining needs both the invite code and the world password. The database will not add a member unless a valid invite code for that world is presented.
- Passwords are hashed. World passwords and hidden-memory passwords are stored as salted PBKDF2 hashes, never as readable text.
- Connections are encrypted with HTTPS.
- No advertising inside the app. Ads appear only on some public pages of this website, never in a world, on a letter, proposal or invitation, or on sign-in pages — and nothing you write in Hapipy is used for advertising.
The limits, stated plainly
- Photos and music are stored with our file-hosting provider (Cloudinary) at long, unguessable addresses. Those addresses are not protected by a login: anyone who obtains a file’s exact address could open it.
- A link is a key. If you forward a letter, proposal or invitation link, whoever receives it can open it.
- Hapipy’s administrator can technically access the data stored in the service. We look at the contents of a world only when that is needed to give support you have asked for, to investigate a report of abuse or a security problem, or to meet a legal obligation. Administrative actions are recorded in an internal log.
Hapipy is not a monitoring tool
Hapipy is something two people choose to share. It cannot see your location, your other apps, your messages elsewhere or anything on your device beyond what you type or upload into it, and it has no feature for watching what another person does. Each person joins with their own account and must know the invite code and password to do so.
Using Hapipy to monitor, track or pressure another person, or signing in to someone else’s account, is against our Terms and Community guidelines. If you want to be removed from a world, or want your account deleted, contact us from the email address on your account and we will do it.
If you are in danger, contact your local emergency services. Hapipy cannot respond to emergencies.
Reporting content
Every shared letter, proposal and invitation page has a Report link. Reports go to Hapipy’s administrator, who can remove the content and suspend the account or world behind it. You can also email us — see how to report, including copyright complaints.