Privacy Policy

This Privacy Policy explains how heypcb ("heypcb," "we," "us," or "our") collects, uses, shares, and protects information when you use heypcb.ai and related services (the "Service"). Optional browser analytics and masked session replay are on until you turn them off, except in the European Union, the EEA and the United Kingdom, where neither runs until you accept it.

Change optional browser analytics and masked session replay at any time: Privacy choices.

1. Who we are

heypcb is an AI-assisted PCB design product that works with real KiCad project files. The Service is operated at heypcb.ai. For privacy questions, contact us at justin@heypcb.ai.

2. Information we collect

Account information

When you sign in, we may collect identifiers associated with your account, such as:

• Email address (magic link or OAuth profile)
• Name, username, and avatar if provided by Google, GitHub, or another identity provider you choose
• Authentication tokens and session identifiers
• If you connect a desktop app or create an API key: its name, when it was connected or created, when it was last used, and what you allowed it to do. We store its tokens only in a form that cannot be turned back into the token.

Identity providers you choose to sign in with, such as Google and GitHub, process identity data under their own policies when you authorize access.

Project and design data

To provide the editor and agent, we process design content you create or upload, including prompts, chat messages, schematic and PCB project files, exports (such as Gerbers), and related metadata (project names, timestamps, revision history).

Your Circuit World profile

Your profile at heypcb.ai/world/<your name> shows the name you claim, the name you choose to go by and, if you add them, a profile photo, a short bio and links to your X, LinkedIn, GitHub or website. Signed-in accounts can see all of it, along with who follows you and whom you follow. Someone who is not signed in sees only your photo, your name and your handle. Nothing on your profile comes from your email address.

A profile photo you upload is re-encoded on our servers, which removes the location and camera details a phone stores in a photo, and is checked automatically on our servers for nudity and sexual content before anyone sees it. We keep the result of that check for each photo you try, but never a photo it refused. Removing your photo, or your account, deletes it.

Usage and technical data

We may collect:

• Product usage events (features used, settings chosen, errors)
• Device and log data (IP address, browser type, approximate location derived from IP, referrers, timestamps)
• Local preferences stored in your browser

Payments

Billing details are processed by our payment processor. We do not store full payment card numbers on our servers.

Manufacturing and shipping requests

If you ask us to manufacture and deliver a board through a campaign, we collect the selected published board, recipient name, postal address, and any phone number you provide, along with the request’s status, fulfillment notes, and shipment tracking. This information is private even though the board you selected was published to Circuit World.

If you order boards from heypcb, we keep the order. When you open the order sheet we prepare the board’s manufacturing files and store them privately, whether or not you go on to order. An order keeps those files and the board’s measurements; the options, quantity, destination and shipping you chose; the price you were shown and the version of the order terms you agreed to; any note you write to us; your account’s email address; the payment’s status, amounts, receipt and any refund or dispute; and the recipient name, postal address and phone number you enter on the payment page, with the importer ID you enter there where the destination’s customs need one. For a design somebody else made, the order keeps its author, licence and source. As the order moves we add its manufacturing and shipping references, our messages to you, and a dated history of each step. Where the GDPR or a similar law applies, our basis for all of this is the contract the order is, and keeping its payment records is a legal obligation.

If your plan includes a board we ship to you, we keep what you enter on its claim page: the recipient name, postal address and any phone number. We also keep your account’s email address, the subscription that qualified the claim, and, once the board ships, the carrier, tracking number and date. We use them only to ship the board and to tell you it has shipped. The carrier receives the name, address and phone to deliver it. Where the GDPR or a similar law applies, our basis is the contract your plan is.

If you buy clothes from heypcb Wear, the recipient name, postal address, email address and any phone number you enter, with what you are buying and the shipping you chose, go to our payment processor, which keeps them with the payment. We do not store them in a database of our own. Our team receives the paid order by email so it can be packed and shipped, and the carrier receives the name, address and phone to deliver it. Your browser keeps the bag. Where the GDPR or a similar law applies, our basis is the contract the order is.

3. How we use information

We use information to:

• Create and secure your account, and keep you signed in
• Run the Service, including the AI agent, board tools, design checks, routing, and exports
• Review, quote, manufacture, and deliver a board when you order one from us, submit a campaign fulfillment request, or claim a board your plan includes
• Send service messages (sign-in links, security notices, and messages about your own boards, plan and orders)
• Send product updates, such as news about a new feature or a change that affects you and notes from our team asking how heypcb is working for you, unless you turn them off. Every one carries an unsubscribe link that works in one press, without signing in, and the same choice is in Settings
• Send news and offers (deals, events, newsletters) only if you turn them on in Settings, where they start off. We keep the time you turned them on, and you can turn them off there or from any such email
• Improve reliability, safety, and product quality
• Enforce our Terms of Service and prevent abuse
• Comply with law and respond to lawful requests

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, in the sense those words carry under the California Consumer Privacy Act. We do not use your project files to train public foundation models, and we do not fine-tune any model on your data.

To improve reliability and product quality, we may keep a redacted technical record of Inky sessions and their verification results for up to one year. Raw attachments and project files are not copied into it. From these records we may derive short, generic engineering guidance, and that guidance is shared across accounts: once it has been confirmed on more than one account and project, it may be used in another customer’s Inky session. Only the generic guidance is shared, never your design, and guidance that names your project, a part on your board, or one of your board’s net names is refused before it is stored. Privacy questions and deletion requests can go to justin@heypcb.ai.

4. Service providers and AI processing

We use service providers to run the Service. They process data on our instructions and only as needed to provide their services, unless this section says otherwise. They fall into these categories:

• AI model providers. Prompts, relevant board context, and tool results are sent to third-party AI model providers so Inky can design and edit boards. Which provider handles a message can vary. Some of these providers commit not to train on data sent through their APIs, and not every provider makes that commitment. When Inky researches a product on the web, the search goes to a web search provider.
• Code execution. Inky can run code it writes to work out an exact answer. That code runs in an isolated, temporary environment operated by a service provider, which receives the code (which can include values from your design) and nothing else, and the environment is deleted after use. A result the code produces is kept with your board, like its chat.
• Hosting, storage, and backups, including the servers your project files live on and off-site backups of them.
• Authentication and database, which hold your account, sign-in sessions, billing state, the records described in section 3, and your board orders and their files.
• Payments. Stripe processes payments, stores your card and billing address, and collects the shipping details for a board order on its payment page.
• Address suggestions. As you type the street on the heypcb Wear bag page, our servers send what you have typed so far and the country to Photon, Komoot's public address search over OpenStreetMap, to suggest whole addresses. Your name, email and order are not sent.
• Product analytics, session replay, and error monitoring, described below.
• Email delivery for sign-in codes, security notices (a new sign-in, a new app or key with access), invitations, a note when a long job on your board finishes while you are away, renewal reminders, order emails, product updates, and news and offers. It receives your email address, the first name we greet you with, and the message. Notes from our team asking how heypcb is working for you record whether they were opened and which link was pressed. Our other emails carry no tracking pixel or tracked link; for those we record only whether each was delivered, bounced, or reported as spam.
• Sign-in providers such as Google and GitHub, when you choose them.
• Bot protection. Cloudflare runs an anti-bot check on some public forms, such as the free design checker. It runs in your browser, so it sees your IP address and browser signals directly, and it may set a short-lived cookie to remember that you passed.
• Component catalogues and part libraries. Looking up parts sends a part number or search term from our servers. These lookups never carry who is searching: no account, email, project name, or board file.
• Reference pictures. When you ask Inky for a board shaped like, showing or looking like something you name and attach no picture of (a character, an animal, an object, a product), our servers may search the web for pictures of it. The search sends the words describing it, and nothing else: no account, email, project or board. We then download the few public pictures it finds, and the one Inky uses is stored with your project. It never searches for a picture of a person.
• 3D generation. When the Generate 3D panel uses an outside model service, the prompt and any image you attach are sent to it, and nothing else about your account or board.
• Website icons. To show a small icon beside a link in a chat reply, our servers ask an icon service for it by the website’s domain alone.

A current list of the service providers we use is available on request at justin@heypcb.ai.

Circuit World search

When you search Circuit World or ask Explore a question, the question may be sent to an AI model provider to find matching boards. It goes alone, with no account, project or board. When you open a board from a search, press Enter or follow “See all”, we keep the words you searched with your account (your newest 50 searches, with how often and when you last made each) so the search box can offer them again. You can remove one search, or all of them, from the search box at any time, and deleting your account deletes them. A search that several people made recently and that finds a published board may be shown to others as a popular search: the words alone, never who searched or how many.

A board you order

An order needs a manufacturer and a carrier, and they use what we send them under their own terms, to make the boards, ship them and clear customs. Nothing of yours goes to them unless you order boards from us. Our manufacturing partners receive the manufacturing files of the board you ordered and the recipient name, postal address and phone it ships to, with the importer ID where the destination’s customs need one. Shipping carriers receive the recipient name, address and phone to deliver the parcel, and pass what customs requires to the customs authority where it arrives.

Links to other sites

Some buttons open another company’s site in a new tab, such as sharing your challenge entry on X or looking up a part in a supplier’s catalogue. Following one sends that site what any visit does (your IP address and browser details) plus what the link itself carries, such as a pre-written post with your board’s title and public link. What happens after you arrive is between you and that site. The editor also lists manufacturers you can send a finished design to yourself; following one of those links transmits nothing of yours.

Automated decisions

Inky is an AI system. When you send it a message it decides, without a person in the loop, which design tools to run on your board and what to change. Those decisions affect your design file and nothing else: we make no automated decision about you that has a legal or similarly significant effect, such as what you are charged or what plan you are offered. Every change the agent makes to a board can be undone from the editor.

When an account is created, and when the free trial is first offered to it, we check the email address and sign-up automatically to prevent abuse, such as temporary email addresses or repeated use of the free trial. A temporary or throwaway address cannot open an account, and an account that fails the trial check can still sign in and choose a plan but gets no free trial. We keep the outcome on the account. If you think we got yours wrong, write to justin@heypcb.ai and a person will look at it.

The one other automated decision is the check a profile photo passes (section 2): when it finds a photo may contain nudity or sexual content, that photo is not used and you can choose another. If you think it got your photo wrong, write to justin@heypcb.ai and a person will look at it. We may also remove a photo that breaks the Terms after someone reports it.

Product analytics and session replay

Optional browser analytics and masked session replay are on until you turn either off in Privacy choices, and a choice you save there always applies. In the European Union, the EEA and the United Kingdom, which we read from your browser’s time zone and never from your IP address, both stay off until you accept them in the cookie banner or in Privacy choices. Turning either off does not affect your access, subscription or ability to design. We retain server-side service records such as account creation, billing outcomes, build results, failures and request timing to operate, secure and improve the Service. Those records do not read browser analytics identifiers and do not record your screen. Where applicable, our basis for these limited operational records is providing the Service and our legitimate interest in keeping it reliable and secure; you may contact us to object to processing based on legitimate interests.

Product analytics runs on a third-party analytics service, keyed on your account’s opaque user id. It records how the product is used and how it performs: the pages and features you use, the steps you reach in signing up, building, checking out and ordering, the requests and steps that were declined (for example by a plan limit or view-only access), with a short machine-readable reason and the plan and usage figures it was judged against (the sentence you are shown is not recorded), your feedback on Inky’s work, and how long operations took and how they ended. When something in the app breaks, the error message and where in our code it came from are recorded so it can be fixed. For some Inky messages, and for every one that fails or is stopped, analytics also receives a technical record of how the agent worked: timings, token counts, sizes, which model answered, and short status codes. Analytics also records the amount and currency of every payment and refund on your account, as our payment processor charged or returned it, and the credit a credit purchase granted. Page addresses are recorded without their query strings, so one-time values that travel in a link, such as a sign-in code, are not sent.

Analytics never records your email or name, your prompts or chat text, Inky’s replies, what was sent to a tool or what it returned, the contents of your boards and schematics (designators, net names, part numbers, geometry), the names or contents of your files, or your card details and payment-processor identifiers.

Session replay, a recording of what a page looked like as you used it, runs until you turn it off (in the EU, the EEA and the UK, only once you accept it), and stops when you turn usage analytics off. Where it runs, it can run across the app, including the board and schematic editor, with every field you type in and all on-screen text masked and every image, canvas and drawing blocked, the board previews on your dashboard and the canvases in the editor alike. A replay shows layout and clicks, never your content or your design, and it is not made when your browser sends Do-Not-Track or Global Privacy Control (GPC). Both signals override a saved choice, and the default, for optional browser analytics and replay. Analytics identifiers use local storage, not cookies, and we do not autocapture clicks or on-screen text. Analytics requests are proxied through heypcb.ai without your sign-in cookies or authentication headers, and the analytics service receives your IP address only shortened, which is enough to estimate your country and city. Error reports have query strings stripped from any address they mention. Product analytics is separate from the records described in section 3.

5. Local mode

The Service may offer a local or offline-oriented mode where cloud account history is limited or unavailable. Local preferences and some session state may still live in your browser. Cloud features such as synced history and OAuth accounts require an online account.

6. Cookies and similar technologies

Necessary cookies and local storage keep you signed in, remember your preferences and protect the Service from abuse. Disabling these in your browser may break sign-in or other features. The anti-bot check on some public forms may set a short-lived security cookie.

The canvas’s “For you” order remembers, in a first-party cookie on this device, which posts you have seen and opened and which order you chose, so your next visit shows you something new. It also uses your hearts, replies and follows on heypcb. We use these only to order your feed, never for advertising. The other orders use none of it.

We remember your privacy choices for 180 days in a necessary first-party cookie containing only the choices, their version and the date you made them. It contains no advertising or analytics identifier. In the EU, the EEA and the UK, a second necessary cookie, deleted when you close the browser, records only that this browser is asked before any optional collection. We stop optional collection and remove this browser’s analytics identifiers when you turn usage analytics off. That does not erase previously collected records; contact us to request deletion. Global Privacy Control and Do-Not-Track keep optional collection off.

Essential, minimized error reports continue so we can diagnose faults. Browser error reports do not include interaction breadcrumbs, session recordings or performance traces. Server-side security, account, billing and service records described above continue independently of these browser choices. We do not use advertising pixels or sell or share personal information for cross-context behavioural advertising.

7. How we share information

We share information only as needed:

• With service providers who help us run heypcb (section 4)
• With PCB manufacturers, component suppliers, shipping carriers and, through the carriers, the destination’s customs authority, only when needed to quote, make, and deliver a board you ordered from us or asked us to fulfill
• When you choose to export, download, or share project files yourself
• If required by law, regulation, legal process, or to protect rights, safety, and integrity of the Service and users
• In connection with a merger, acquisition, financing, or sale of assets, with notice where required

8. Designs imported from public repositories

Some boards in Circuit World were not published by a heypcb user. We import them from public repositories that contain KiCad projects and hold each one under a placeholder profile until its author claims it. Terms section 6 describes the practice; this section describes the personal data in it, because the people concerned are not our users and have not signed anything.

CAD World similarly imports openly licensed designs, 3D scans and artworks from public repositories, Zenodo and Wikimedia Commons. We store source files, source and maker links (a maker's profile page, or their ORCID iD where the source gives one), the source revision, licence, the maker's public name or account name, and public project metadata. These identify and credit the design and help people find it. We also generate pictures and 3D previews from the files. CAD World has no account claim feature; the same removal request below applies.

For imported boards, what we copy is what the repository publishes: the project files, the repository URL, the revision we copied, the owner's public login and the licence the repository declares. The login is the only personal data among them, and we store it for one reason: to credit the author on the board and to recognise them if they claim it. We do not collect an email address, build a profile, or contact anyone whose work we import.

If you claim a board, we additionally record which account claimed it and when. The login we match against comes from the repository host's own sign-in, not from anything you type.

You can have an imported design taken down at any time, without an account and without explaining why: write to justin@heypcb.ai. Removal takes the design out of the catalogue and deletes the copy we hold, and we keep only the record that we removed it, which is what stops it being re-imported. Where the GDPR or a similar law applies to you, our basis for holding this data is our legitimate interest in running a gallery of real hardware designs, and your objection under this paragraph ends it.

9. Data retention

We retain account and project data for as long as your account is active and as needed to provide the Service. We may retain limited logs and backups for security, fraud prevention, and legal compliance for a reasonable period after deletion.

You can delete a board yourself from its menu on the dashboard, and you can delete your whole account from Settings. Deleting a board removes its project files, chat threads, uploaded images and undo history from our disk at once. Deleting the account also removes every board you own, the learning records derived from your sessions, your billing record with us, and your sign-in identity; any subscription is cancelled at the same time. Boards you published to Circuit World are copies you chose to make public and are withdrawn separately from the board’s Circuit World page. Board orders are kept, as the list below says. You may also ask us to do any of this by emailing justin@heypcb.ai.

How long each kind of data lasts if you do not delete it sooner:

• Account and profile (email, name, avatar, sign-in sessions; your Circuit World name, photo, bio, links and follows, and the photo check’s results): for as long as the account exists
• Connected devices and API keys: until you revoke one in Settings or it expires, and deleted with the account; the record of a revoked or expired one is deleted 30 days later
• Boards and design files (projects, schematics, PCB files, exports, uploads, chat threads, undo history): for as long as the account exists, and removed with the board or the account; the manufacturing files an order sheet prepares are the exception, kept as board orders say below
• Email choices and sends (your email choices, an address that bounced or reported our email as spam, and the delivery record of each update or offer we sent you): for as long as the account exists, and deleted with it. A new account made later with the same address starts with the default choices
• Learning records (the redacted technical record of Inky sessions described in section 3): one year from the session, deleted automatically after that
• Billing records (plan, subscription state, usage ledger, invoices): seven years, because tax and accounting law requires us to keep them. With board orders below, they are what outlives a deleted account; billing records carry no design content
• Manufacturing and shipping requests (selected published board, address, phone if supplied, fulfillment notes, and tracking): while your account exists and as needed to make, deliver, support, and account for the order; after delivery you may ask us to remove contact and shipping details that we are not required to keep
• Boards your plan includes (recipient name, address, phone if supplied, the subscription that qualified the claim, carrier and tracking): while your account exists. Deleting your account deletes the claim. After delivery you may ask us to remove the shipping details, and we will
• Clothing orders (recipient name, address, email, phone if supplied, what was bought and its shipping): kept by our payment processor with the payment under its policy, and in our team’s order email as needed to ship, support and account for the order. After delivery you may ask us to remove the shipping details from that email, and we will
• Board orders (the order’s record and its manufacturing files, options, price, payments, shipping name, address, phone and importer ID, and tracking): as needed to make, deliver, support, and account for the order, and its payment records for seven years, as the billing records above are. Deleting your account does not delete your orders, paid or not: the link to your account is removed, and the rest of each order, including the email address it was placed with and its files, is kept. After delivery you may ask us to remove the shipping name, address, phone and importer ID, and we will. The manufacturing files the order sheet prepares when you open it are kept in the same private storage whether or not you order; today they are not deleted when you delete the board or your account, and you may ask us to delete the ones no order was made from
• Payment-processor events: 30 days on our side; our payment processor keeps its own records under its policy
• Product analytics: keyed to an opaque id, kept up to two years, then aggregated or deleted
• Error reports: 90 days
• Server and security logs: 30 days, longer only where we are investigating abuse or are required to preserve them
• Deletion records: we keep a dated note that an account was deleted, carrying no email, name or content, because it is how we prove the deletion happened

Encrypted backups lag these periods and roll off within 35 days.

10. Security

We use industry-standard safeguards appropriate to the nature of the data we process, including encryption in transit and access limited to the people who need it. No method of transmission or storage is fully secure; you use the Service at your own risk and should keep exports of designs that matter to you.

If personal information of yours is exposed by a breach of our systems, we will tell you and the regulators who require it, without undue delay and within the deadline the law where you live sets (72 hours of our becoming aware, under the GDPR). The notice will say what happened, what data was involved, and what you can do about it. To report a vulnerability, write to inky@heypcb.ai; we will not pursue anyone who reports one in good faith and gives us a reasonable chance to fix it.

11. International transfers

We are based in the United States and process information there and in other countries where our providers operate. Those locations may have different data-protection laws than your home country.

Where we move personal information out of the EEA, the UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum where it applies), or on an adequacy decision covering the destination, and we hold our providers to the same terms. Ask us at justin@heypcb.ai and we will tell you which mechanism covers a particular transfer.

A board you order is the one transfer that works differently. Its manufacturing files and the recipient’s name, postal address, phone and importer ID go to our manufacturing partner in China, and from there to the carrier and the customs of the destination, because the boards are made and shipped from there. China has no adequacy decision; we send these only because you asked us to have boards made there and delivered to you, which the GDPR and the UK GDPR allow as a transfer necessary for that contract (Article 49(1)(b)). Nothing else of yours goes there, and nothing at all unless you order.

12. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or export personal information, or to object to or restrict certain processing. To exercise these rights, contact justin@heypcb.ai. We answer within 45 days, and tell you if we need longer. We will not treat you differently for exercising them. You may also revoke OAuth access from your Google or GitHub account settings, and download every board you own as a KiCad project or a zip from the editor at any time.

If you are in the EEA, UK, or similar jurisdictions, our legal bases include performing our contract with you (a board order among them), legal obligations such as keeping payment records, legitimate interests in operating and improving the Service, and consent where required (for example certain cookies or marketing).

If we say no

You can appeal any request we refuse. Reply to our refusal, or write to justin@heypcb.ai with the word "appeal" in the subject. A different person reviews it and answers you in writing within 45 days, saying what we decided and why. If we still say no, you may complain to your state attorney general, or in the EEA and UK to your data-protection authority, and we will tell you how to reach them.

13. Children

The Service is not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will take appropriate steps.

14. Changes

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date. Material changes may also be communicated in-product or by email when appropriate. Continued use of the Service after changes become effective constitutes acceptance of the updated policy.

15. Contact

Questions about this Privacy Policy: justin@heypcb.ai
Website: https://heypcb.ai
Related: Terms of Service