Privacy
Last updated 7 October 2026
HeyPapin is an AI tutor that explains things by drawing them on a whiteboard. This page says exactly what it stores, what it sends elsewhere, and what it never does. It describes the product as it actually works today — not what it might do later.
You can use HeyPapin without an account
Opening the board, drawing on it, and watching the demo need no sign-in and create no account. Signing in is only required for two things: starting a live session, and saving a board so you can come back to it.
What we store
Your account
If you sign in with Google, we receive your email address, your name, and your profile picture URL. If you sign in with an emailed link, we receive only your email address. There is no password, so there is no password for us to store or lose.
Boards you save
A saved board holds the diagram HeyPapin drew, the title you gave it, your own handwriting on it, and the conversation from that session — what you asked and what HeyPapin answered — so that reopening the board brings back the explanation, not just the picture.
While you are signed in, boards are saved automatically as you work, a couple of seconds after you stop. Boards you do not save — and everything drawn while signed out — are never written anywhere: they live in your browser for that session and are gone when you close it.
A usage record
Each live turn writes one row recording who asked and when, alongside internal service measurements. For visitors without an account, that row holds an IP address instead of a user id. This exists to keep the free tier from being drained by automated abuse, and it is the only reason we keep it.
A diagnostic record
Separately, we record what the app did, so we can find out why it failed somebody. One row can hold: how long you waited before HeyPapin first answered, whether you stopped it while it was still speaking, which browser and operating system you are on, whether your screen is a touchscreen, and — if a turn was refused — which limit refused it. It carries your account id when you are signed in, so that “what happened to this person, in order” is answerable at all.
It never holds anything you typed or said. There is no column that could store your question, and the endpoint that receives these records rejects any field that is not a number, a true/false, or a fixed label from a list we wrote. We added this because the alternative was guessing why people stopped, and we were guessing wrong.
In your browser
Small preferences — board title, speaking speed, whether the side panel is open, stylus mode, whether you have seen the tour — are kept in your browser's local storage. They never reach us. Signing in also sets a session cookie, which is what keeps you signed in between pages — without it you would be signed out on every click.
Google Analytics sets cookies of its own so a returning visit is not counted as a new person. Those are the only cookies here that are not strictly necessary, and you can refuse them in your browser settings or by using a blocker without breaking anything in HeyPapin. We do not run advertising, and nothing here is used to build a profile of you or sold to anyone.
What leaves HeyPapin
Teaching you requires sending parts of what you do to services we do not run. Here is all of it:
| Goes to | What is sent | Why |
|---|---|---|
| An AI model provider, such as OpenAI (ChatGPT), Anthropic (Claude), or OpenRouter | Your question, and a text description of what is on the board | To produce the explanation and the drawing |
| A text-to-speech provider, such as Fish Audio or ElevenLabs | The sentences HeyPapin is about to say | To turn them into speech |
| Your browser's speech recognition | Your microphone audio, while a call is open | To turn what you say into text. In Chrome this is processed on Google's servers, not on your device — this is the browser's own feature, not ours. |
| Our PDF reader | PDFs you upload | To extract the text. It runs on our own deployment, not a third party. The file is held in private storage (Supabase) only while it is being read, then deleted; a daily cleanup removes any that were left behind. Scanned pages, and pages whose content is mostly pictures (common in slides exported to PDF), are sent as images to an AI model so it can read them, such as Google Gemini or one of the providers above; at most 50 such pages are read. When Google Gemini reads them, Google may use those page images to improve its own services. Only the extracted text is kept, as part of your board. For a long document, the text past the first part is also split into passages and stored with a numeric summary of each (made by Google Gemini) so HeyPapin can find the passages that match each question; those passages are only ever searched for you, and are deleted automatically after 30 days. |
| Supabase | Your account, saved boards and their conversations, usage rows, diagnostic rows, passages of long documents for 30 days, and PDFs for the few seconds they are being read | They host our database and sign-in |
| Vercel | Standard request logs, plus anonymous page analytics | They host the site and its speed measurements |
| Google Analytics | Which pages you open, roughly where you are in the world, and what kind of device and browser you use. Not your name, your questions, or anything on your board. | To see which pages people actually read, so we know what to improve. It sets its own cookies to recognise a returning visit. |
If you draw by hand and then ask about it, a picture of your handwriting is sent to the AI model along with your question — handwriting has no text for us to send instead. Everything HeyPapin itself drew is sent as text, never as a screenshot.
Google user data
HeyPapin asks Google for two things only: your email address and your basic profile (name and picture). It does not request access to Gmail, Drive, Calendar, Photos, or any other Google service, and it cannot read them.
Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. That data is used only to create your account and show you which account you are signed in as. It is never sold, never transferred to advertisers or data brokers, and never used to train any AI model.
What we never do
- We do not sell your data, and we do not share it with advertisers or data brokers.
- We do not use your boards or questions to train AI models.
- We do not read your saved boards, except when you ask us for help with a specific one.
- We do not run advertising or tracking pixels.
- We do not keep the text of your questions in our diagnostic records. That is enforced by the database, which has no column able to hold it, not only by our intentions.
How long we keep things
Saved boards stay until you delete them. Usage rows — including the IP address kept for visitors without an account — and the diagnostic rows described above are deleted automatically after 30 days, both on the same nightly job and both on the same clock. Stored passages of long documents follow the same 30 days. Delete your account and everything attached to it goes with it: boards, handwriting, profile. Any usage row still inside that 30-day window survives with the account id removed, because a count with nobody attached is still needed to keep the free tier honest.
After those rows go, a daily tally stays: how many lessons ran, how many minutes, what they cost us. It carries no account id and no IP — nothing in it points back to a person. We keep it so we can see whether HeyPapin is getting better or more expensive over months, which the 30-day rows can never show.
What you can do
- Delete one board — the trash icon next to it on your dashboard.
- Delete your account and everything in it — email us at hello.papinai@gmail.com and we will confirm once it is done.
- Get a copy of your data — same address. We will send your boards and profile as a file.
- Use HeyPapin without any of this — open the board and don't sign in. Nothing is stored.
Children
HeyPapin is built for learners, and some of them are young. We do not knowingly create accounts for children under 13. If you believe a child has signed up, email us and we will remove the account.
Changes
When what the product does changes, this page changes with it, and the date at the top moves. We will not quietly widen what we do with your data and leave this page describing the older, narrower version.
Contact
Questions, deletions, or anything on this page that does not match what you see: hello.papinai@gmail.com. The terms of service cover the rest of the arrangement: what HeyPapin provides, what the weekly allowance is for, and what happens when you leave.