Legal
Privacy Policy
Last updated 6 September 2026. English is the binding version.
This policy explains what Hereon collects, why, and how long we keep it. Payments are processed by Creem; we do not store your card number.
What we collect
- Files you upload — HTML, CSS, JS, PDFs, and other static files in a zip, stored in object storage so we can serve your public URL.
- App data you choose to remember — if you turn on cloud save, key/value data that the page would have put in localStorage.
- Identity — a signed cookie that identifies this browser, Better Auth sessions for the platform account (email or Google), and a separate app-scoped cookie on a hosted app so that app only sees an id for itself.
- Published app visits — which paths visitors opened on a live app, counted per month, plus a short recent order. This stays with the app, not with a person: we do not fingerprint devices or store query strings.
- Page counts on our own site — which pages of hereon.space were opened, counted per day against the browser cookie above, so we can see how many people visit and which pages they use. No third-party pixel, no advertising network, no cross-site tracking, no fingerprinting, no query strings.
- Billing metadata — plan name, Creem customer/subscription ids, and the email Creem collected at checkout, so we can grant or revoke paid access. Card numbers stay with Creem, the merchant of record.
Cookies
We use one essential HTTP-only cookie to know which apps are yours, and we count page visits on hereon.space with it, first-party. We do not use advertising cookies. The brand site also uses Google Analytics to count page visits; advertising features stay off, and we do not sell that data. Hosted apps may set their own browser storage; that is the app author’s code, not ours, unless you enabled cloud save.
Why we process this
To provide the URL you asked for, keep your apps listed, bill the plan you chose, and stop abuse (size limits, app caps). Legal bases: the contract to provide the service, and our legitimate interest in running and securing it.
Who else sees it
Cloudflare stores files and database rows for us. Creem sees payment and customer email. Google Analytics sees page visits on hereon.space; our own page counts stay in our database and are only shown to the operator. Public URLs are world-readable — do not put secrets in a free or shared page. We do not sell personal information.
How long
Published pages stay while the account exists, subject to plan caps. We may pause public traffic in a month that exceeds visit or bandwidth limits. Free live apps may sleep after 180 days without a public visit. You can export Cloud Data from Studio or export the whole account from Account. You can delete the account from Account after any paid plan is cancelled; that removes your apps and Cloud Data from Hereon. Creem may keep invoices for tax. Email and billing records stay as long as needed for accounts, tax, and fraud prevention.
Your rights
Depending on where you live, you may access, correct, export, or delete personal data, or object to processing. Contact support@hereon.space.
Children
The service is not directed at children under 16. Do not create an account for them.
Changes
If this policy changes in a material way, we will update the date above and, for account holders, mention it in the product when practical.