Privacy

When you sign up, YourHero creates an account record through Supabase Authentication (email and password, or Google sign-in). Your profile — handle, display name, headline, bio, avatar, and any social links you add — is stored in our database and is public once you complete onboarding, at yourhero.me/{your handle}.

Case study content you write or record — titles, section text, cover choices, publish details — is stored in our database. Drafts are private to you; published case studies are public. Row-level security in our database enforces that you can only read or change your own drafts and account data.

If you use Voice to capture a case study, your recording is sent to OpenAI for transcription, and the resulting transcript is sent to OpenAI again to be structured into a draft. YourHero does not store the original audio or the raw transcript — only the structured draft that results, and only once it reaches your Write screen and is saved through the normal autosave flow, the same way any other draft is saved.

OpenAI processes the recording and transcript under its own API data controls. YourHero configures the structuring request with store: false, which disables separate application-state storage for that response, but does not by itself disable OpenAI's standard abuse-monitoring retention. See OpenAI's API data controls for current, endpoint-specific details — including retention windows — rather than a fixed number restated here, since that documentation can change independently of this page. We recommend not sharing confidential or sensitive information in a Voice recording.

We use PostHog to understand product usage — a closed, specific set of events (such as when a case study is started, reviewed, or published) rather than a general recording of everything you do. Autocapture and session recording/replay are both explicitly disabled in our PostHog configuration, so your on-screen activity is never recorded, and no event we send ever includes your case study text, a title, a transcript, or your full account identifier.

We also use Google Analytics 4 to measure overall site traffic (page views), separately from PostHog. GA4 does not receive custom product events or your account identifier.

Our servers keep operational logs for the Voice processing pipeline — a request identifier, processing stage, an irreversibly hashed (not your real) account identifier, the audio's size and format, and the detected story type. Logs never include your recording, your transcript, your story content, or your full account identifier.

Draft and published case studies, and your profile, remain stored until you delete them or delete your account. You can permanently delete your account — along with your public profile and case studies — at any time from Settings; this is a real, immediate deletion, not a deactivation.

For questions about your data or this page, contact vahagnkaramyan@yourhero.me.