HeyTinyBot.com and the Tiny connected robot. Effective September 22, 2026.
The controller of the hosted Hey Tiny service is Alexey Efremov, operating as BadenMan Studio. Contact: privacy@heytinybot.com. The controller is based outside the European Union, the European Economic Area, and the United Kingdom.
This policy covers heytinybot.com, hosted Tiny accounts, connected Tiny devices, and related support. It does not govern a self-hosted installation operated entirely by you. The hosted service is not directed to children and accounts may be created only by people aged 18 or over. An adult account holder is responsible for household use of a connected robot.
| Category | Purpose | Retention |
|---|---|---|
| Account data: email, password hash, optional display name, sign-up and login dates | Create and secure your account, send service messages, and restore access | Until account deletion |
| Legal acceptance record: document version, timestamp, IP address, and browser identifier | Record your acceptance of terms and privacy notices | For the account lifetime and up to three years afterward where needed to establish or defend legal claims |
| Device data: device identifier, pairing token, name, personality, settings, firmware version, and last connection | Pair, operate, update, and troubleshoot Tiny | Until the device is unpaired or the account is deleted |
| Environmental and status history, where supported: temperature, humidity, mood, and connectivity | Show history and operate device behavior | Up to 90 days |
| Raw microphone audio | Wake-word verification and speech recognition | Processed in memory and deleted immediately after the request; not stored as conversation history |
| Recognized text and Tiny's reply | Generate a response | Not retained after the request when memory is off; encrypted conversation history for up to 180 days when memory is enabled |
| Messages and deliberate voice replies | Deliver a message between an account and its paired robot | Audio for up to 7 days; message records for up to 30 days |
| Essential cookies and session identifiers | Keep you signed in and protect the service | Until sign-out, expiry, or revocation |
| Security logs: IP address, request time, error and performance information | Prevent abuse, diagnose faults, and maintain service security | Normally up to 30 days, longer only when required to investigate an incident or comply with law |
We process account and device data to perform our contract with you; security logs for our legitimate interest in operating a safe and reliable service; optional memory and non-essential communications with your consent; and records where necessary to meet legal obligations. You may withdraw consent at any time without affecting earlier processing.
We use hosting, email delivery, speech-processing, and AI-inference providers to operate requested features. They receive only the information required for their task. Raw audio is sent only to the configured speech service; AI text providers receive recognized text and limited device context, not your password or account email. Providers and hosting locations may be outside your country. Where required, we use an available lawful transfer mechanism and contractual safeguards.
The current international production providers and locations will be listed here before hosted voice service becomes generally available. Changing a provider does not allow us to use your data for a new purpose without updating this notice.
Depending on where you live, you may have rights to know or access your data, correct it, delete it, restrict or object to processing, receive a portable copy, and withdraw consent. California residents may also request information about collection and disclosure and may opt out of sale or sharing; Hey Tiny does not sell or share personal information for cross-context behavioral advertising.
Send a request from your account email to privacy@heytinybot.com. We may ask for proportionate verification. EEA and UK users may also complain to their local data-protection authority.
We use encrypted transport, password hashing, access controls, rate limiting, and encryption at rest for optional conversation memory. No online service can promise absolute security. When you delete your account, active account, device, and optional-memory data are removed or anonymized, subject to short backup cycles and records we must retain for legal claims or security.
We will post material changes here and, where appropriate, notify account holders before they take effect. If a change requires new consent, the affected optional feature will remain disabled until consent is provided.