Privacy policy

Who we are

HereNook is run by [To fill: legal business name], based in Langley, British Columbia, Canada (“HereNook”, “we”, “us”). Mailing address: [To fill: mailing address].

The person responsible for privacy at HereNook is [To fill: privacy contact person]. You can reach them at [To fill: privacy email address].

We follow [To fill: which privacy law applies (BC PIPA and/or PIPEDA) and the regulator to complain to].

Who this covers

• Account holders: people who sign in to HereNook Studio at app.herenook.com to build and run Nooks.
• Visitors: people who open a Nook on gonook.io by link or QR code, and anyone who sends a message through one.
• Website visitors: people who browse herenook.com or use its contact form.
• Businesses we build a sample Nook for from information they have already made public.

A Nook belongs to the business that runs it. What that business does with messages you send it is up to the business and its own privacy practices.

What we collect

Your HereNook account

• Sign-in details: your email address. If you sign in with Google, we also get your name and profile picture from Google. We don’t ask Google for anything else, such as your contacts, Gmail or Drive. If you sign in with an email code, the code is stored only in scrambled form and expires after 10 minutes. You can also add a passkey.
• Sign-in sessions: the device’s IP address and browser type for each session, and when you last signed in. We use these to keep your account secure.
• Your workspace: the people you invite and what they can do.

Your Nooks

Everything you add: your business details, text, links, photos, videos, audio, logos, colours and chosen names. When you upload a photo, we make web-friendly copies to show on your Nook and keep the original file privately.

Messages sent through a Nook

When a visitor writes to a business through its Nook, we collect their name, email address, subject and message, plus any photos they attach where the business allows it. We send a code to check the email address before the message goes through. The business sees the message in its HereNook inbox. Both sides get an email alert with a link, not the message itself.

Visits and insights

• Nooks: we count opens and taps as daily totals. We note roughly where a visit came from (for example Instagram, a search engine, or a QR code) but not the full web address. To count unique visitors, we make a one-day scrambled code from the visitor’s IP address. The secret key behind it is thrown away after that day, so the code can’t be traced back to anyone. No cookies are used for this.
• QR code scans: for each scan of a HereNook QR code we record the approximate country and region, the type of device and browser, the referring site, and a scrambled code made from part of the IP address. These scan records are deleted after 90 days. Totals stay.
• herenook.com: we may use Cloudflare Web Analytics, which counts page views without cookies.

Payments

When paid plans are on sale, Stripe handles checkout. We keep your Stripe customer and subscription numbers, billing email, plan and invoice history. We never see or store your full card number.

When you contact us

If you use our contact form or email us, we keep your email address and message so we can reply. If you ask to hear when HereNook names open, we keep your name and email for that.

Connected services

• Google reviews: if you add a Google reviews Nooklet, we fetch your business’s public rating and recent reviews from Google, including reviewers’ names and what they wrote, and keep them for up to 24 hours before fetching again.
• Instagram and Facebook: see the Social feed section.
• Pixabay: if you add your own Pixabay key, we store it encrypted.

Sample Nooks

When we build a sample Nook for a local business, we use information the business has already published, such as its name, description, photos and contact details. If the owner claims it, we record the email address they claim it with.

How we use it

• To run HereNook: sign you in, show your Nooks, deliver messages, and show you your insights.
• To send emails you need, such as sign-in codes, message alerts and account notices. If we send anything else, such as a welcome offer, you can ask us to stop.
• To take payments and keep the records the law requires.
• To answer questions and give support.
• To keep HereNook safe: stop spam and abuse, and investigate problems.
• To improve HereNook, using totals rather than individual people.

We don’t sell personal information, we don’t show ads, and we don’t use your content or your visitors’ information to train AI models.

Instagram and Facebook (Social feed)

The Social feed Nooklet shows your top 5 Instagram and Facebook posts on your Nook. It only works if you choose to connect an Instagram professional account or a Facebook Page in HereNook Studio. Nobody else can connect your accounts, and visitors to your Nook never connect anything.

What we ask Meta for

HereNook only reads. It never posts, comments, sends messages, or changes anything on Instagram or Facebook. When you connect, Meta shows you exactly what you are allowing. We ask for:

What we store

• The connection: which account or Page you connected, its name, and an access token from Meta. Tokens are encrypted before we store them, and only our servers can unlock them.
• Post details: for recent posts, the link to the post, its type, date, caption, and its view, like, comment, reaction and share counts.
• Thumbnails: a copy of the picture for each post we show, because Meta's own picture links expire after a few days.

We refresh this every 6 hours. A post you delete or make private on Instagram or Facebook leaves your Nook at the next refresh, and we delete its thumbnail.

How we use it

Only to rank your posts and show your top 5 as tiles on your Nook. Tapping a tile opens the post on Instagram or Facebook. We do not show view or like counts publicly, and we do not use this information for advertising, sell it, or share it with anyone except the service providers listed below that store it for us.

Disconnecting and deletion

• When you choose Disconnect in HereNook Studio, we delete the access token, the stored post details and the thumbnails straight away.
• If you remove HereNook from your Instagram or Facebook settings instead, Meta tells us at https://app.herenook.com/api/v1/social/meta/deauthorize, and we delete the same things straight away.
• If a connection stops working (for example after a password change), your Nook keeps showing the last posts for up to 7 days, then hides them until you reconnect.

Step-by-step instructions are on our Delete your data page.

Who helps us run HereNook

We share information only with the companies that help us provide HereNook, and only as much as each one needs:

Some of these companies store or process information outside Canada, mainly in the United States. There, it may be accessible to courts and authorities under local law.

We may also share information if the law requires it, to protect people from harm, or as part of a sale or merger of HereNook. In a sale or merger, this policy would still apply to it.

What’s public

Nooks are public web pages. Anything you put on a Nook can be seen by anyone with its link or QR code, and search engines may list it. Messages sent through a Nook, insights and your account details are private.

Cookies

• HereNook Studio uses cookies to keep you signed in (for up to 14 days), plus a few others for previews and for claiming a Nook.
• Nooks use a cookie only when someone sends a message, so they can come back to the conversation for up to 30 days.
• herenook.com: we don’t set cookies there. It remembers a couple of display choices in your browser’s own storage.

We don’t use advertising or cross-site tracking cookies. Embedded YouTube, Vimeo or Spotify players follow those services’ own policies. We use YouTube’s privacy-enhanced mode.

How long we keep things

• Your account and Nooks: while your account is open. When you ask us to delete it, we do so as described on Delete your data.
• Messages sent through a Nook: while the business’s account is open, unless deletion is requested.
• QR scan records: 90 days. Daily visit totals are kept while the Nook exists.
• Sign-in and email-check codes: minutes. Sign-in sessions: up to 14 days.
• Google reviews: up to 24 hours before they are fetched again.
• Instagram and Facebook data: until you disconnect, then deleted straight away.
• Billing records: as long as tax and accounting law requires.
• Security and error logs: a short time, for troubleshooting.

Keeping it safe

Everything travels over encrypted connections. Access tokens for connected services and your own API keys are encrypted before we store them. Sign-in codes are stored only in scrambled form. Only people who need access to run HereNook have it. No system is perfectly secure, so if something goes wrong that puts you at real risk, we will tell you and the regulator as the law requires.

Your choices and rights

You can ask to see the personal information we hold about you, have it corrected, or have it deleted. You can also withdraw your consent to something, for example by disconnecting Instagram or Facebook. Withdrawing consent may mean a feature stops working.

Email [To fill: privacy email address] or use our contact form. We will check it’s really you, then reply within 30 days.

If you are not happy with our answer, you can complain to the privacy regulator named in Who we are.

Children

HereNook accounts are for people aged [To fill: minimum age] and over who run a business or project. We don’t knowingly collect information from children. If you think a child has given us information, contact us and we will delete it.

Changes to this policy

When we change this policy, we will update the date at the top. If a change matters, we will tell account holders by email or in Studio before it takes effect.

Contact

[To fill: legal business name], [To fill: mailing address]. Email [To fill: privacy email address] or use our contact form.