Privacy Policy

Who we are

HIE is a browser-based design application operated by souporserious LLC, based in California, United States. We are responsible for the personal information processed to operate HIE. This policy covers hie.design and its editor, collaboration, and website-import features.

For privacy questions or requests, contact legal@hie.design. This policy explains our practices; it is not a request for consent to unrelated uses of your information.

Your designs and local storage

Ordinary editing, rendering, source generation, Compose actions, and project history run on your device. HIE saves projects, imported assets, comments, history, and recovery state in browser storage. It also stores preferences and collaboration identifiers, and caches application files for offline use. These stores are used to make the editor work, not as advertising identifiers.

Ordinary solo editing does not upload your project to a HIE document-storage service. Project data leaves your device when you choose a feature that requires it, such as collaboration or website import, or authorize another tool to access it. Files you explicitly export or save to a selected folder remain under your control.

Browser storage is not a backup guarantee. Export work you want to keep. Clearing HIE's site data, changing browsers, using private browsing, or browser storage eviction can remove local projects and preferences. We cannot retrieve local-only files for you.

When you collaborate

Creating or opening an invitation connects you to HIE's signaling service and participating peers. The service processes room and participant identifiers, timing and connection metadata, and encrypted connection-negotiation messages. Project changes, comments, history, and assets are exchanged with collaborators over WebRTC data channels rather than stored as documents on the signaling service.

Collaborators receive the information needed for the shared project and may retain or export it. Peers can learn network-address information needed to connect. If connection-discovery or relay services are configured, those providers also process connection metadata and may relay encrypted traffic.

Invitation links contain access information. Share them only with people you intend to invite. Removing local data or leaving a session does not erase copies held by collaborators.

Website imports and connected tools

When you authorize importing a public website, HIE sends the requested URL, viewport, and asset-import preference to our server. The server retrieves the page and permitted assets and returns an editable snapshot. The destination website and asset hosts receive those retrieval requests. Do not submit private links, access tokens, or content you are not authorized to use.

The import service temporarily uses an IP-derived request key to limit abuse. Import responses are marked not to be cached; the application does not intentionally retain a server-side library of imported pages. Hosting and security records are separate and may still record request metadata.

Opening local files or a repository requires the permissions you grant in your browser. If you authorize an assistant or other connected tool to use HIE's exposed actions, that tool can read or change the information those actions expose. Its own provider's terms and privacy practices govern information it receives.

Limited website analytics

We use Vercel Web Analytics to understand aggregate visits to the editor. Our page-view payload uses one fixed public URL, https://hie.design/. We exclude query strings, fragments, private paths, project names, design content, room IDs, and video IDs from that payload. Custom analytics events and automatic flag-value collection are blocked. The Privacy and Terms pages do not load analytics.

Vercel still receives network requests and processes its standard metadata, which can include timestamps, browser and device information, approximate location including city, and the referring website. Vercel says its request-derived visitor identifier is discarded after 24 hours. HIE suppresses outbound referrer headers to avoid sending editor URLs in those headers. An incoming external referrer remains part of Vercel's standard analytics behavior.

This is not a promise that no personal information is processed. We do not enable analytics cookies or join analytics reports to your local projects. See Vercel's analytics privacy documentation for its current practices.

Hosting, security, and messages

Vercel hosts HIE and its server features. Delivering the application and protecting it from abuse involves request information such as IP addresses, browser headers, requested paths, timestamps, and errors. Removing information from analytics does not remove it from every hosting or security system.

If you email us, we receive your email address, your message, and any attachments you choose to send. We use them to respond, troubleshoot, and maintain an appropriate record of the request. Please avoid sending passwords, invitation secrets, payment details, or confidential design files unless they are necessary and you have agreed an appropriate method with us.

You can also join our Discord community for community help and feedback. Discord is an optional external service with its own terms and privacy practices. Messages you post may be visible to other community members, so avoid sharing private projects, access links, or personal information there. Send privacy and legal requests to legal@hie.design.

How we use and disclose information

We use information to provide the features you request, maintain reliability and security, understand aggregate usage, answer requests, and comply with applicable law. We do not sell personal information or use it for cross-context behavioral advertising. We do not use your project content for advertising.

Information is disclosed to hosting, analytics, and communications providers as needed for those services; to collaborators and destinations you choose; and where reasonably necessary to comply with law, protect rights or safety, or address abuse. If the business changes ownership, relevant service records may transfer with it, subject to applicable law and this policy. Local-only projects are not part of our server-held records.

Where European or UK data-protection law applies, we rely on providing the service you request for necessary service processing, legitimate interests for proportionate security, support, and service improvement where permitted, and compliance with legal obligations when required. Where processing requires consent, that consent must be obtained separately; this notice and acceptance of our Terms do not supply it.

How long information remains

• Local work and preferences: until you remove them, clear site data, or your browser removes them. Exported files and collaborator copies follow their owners' choices.
• Signaling: production signaling messages are configured with a two-minute expiry. Active sessions renew connection records. This is not a two-minute deletion promise for provider logs or backups.
• Import rate limits: the application uses one-minute windows in process memory; expired entries are removed on subsequent requests or when the process ends.
• Analytics: the temporary visitor identifier follows Vercel's stated 24-hour lifespan. Aggregated reports have a separate retention/reporting window determined by the Vercel service plan and settings.
• Hosting and support: retention depends on provider settings and the time reasonably needed to operate and secure the service, resolve your request, and satisfy legal obligations. Records needed for an unresolved dispute or legal requirement may be kept longer.

Contact us for information about current provider retention settings or to request deletion of records we control. We cannot reliably associate an aggregate analytics count with an individual person.

Providers and international processing

We are based in the United States. Vercel and other providers may process information in the United States and other countries where they operate. Those countries may have different privacy protections. Vercel describes its processing terms and international-transfer safeguards in its Data Processing Addendum. Contact us for information about safeguards relevant to your request.

Your choices and privacy rights

You can export your projects, clear HIE's browser storage, stop collaboration, decline a website import, and turn off analytics above. Browser settings control file-system, clipboard, media, and other permissions. Clear site data only after backing up work you need.

Depending on your location and which laws apply, you may have rights to access, correct, delete, or obtain a copy of personal information; object to or restrict processing; withdraw consent; or complain to a privacy regulator. California residents may also have rights concerning sale, sharing, and certain uses of sensitive information where the CCPA applies. We do not sell or share information for cross-context behavioral advertising and do not penalize you for making a privacy request.

Send requests to legal@hie.design. Describe what you want to exercise without including unnecessary sensitive information. We may need proportionate verification that you are entitled to the records, or authorization for an agent. We respond within the periods required by applicable law and explain if a request cannot be fulfilled. We cannot delete data stored only on your device or in another collaborator's possession.

Children and policy changes

HIE is a general-purpose design tool and is not directed to children under 13. If you believe a child has sent us personal information that should not have been collected, contact us so we can investigate and take appropriate action.

We update this policy when our practices change and identify the latest revision above. For material changes, we will provide additional notice when required. A policy update does not authorize us to retroactively use information in a way that requires a new permission.