Privacy Policy

This Privacy Policy explains how heypcb ("heypcb," "we," "us," or "our") collects, uses, shares, and protects information when you use heypcb.ai and related services (the "Service"). This policy explains our practices. Optional browser analytics and masked session replay are on until you turn them off.

Change optional browser analytics and masked session replay at any time: Privacy choices.

1. Who we are

heypcb is an AI-assisted PCB design product that works with real KiCad project files. The Service is operated at heypcb.ai. For privacy questions, contact us at justin@heypcb.ai.

2. Information we collect

Account information

When you sign in, we may collect identifiers associated with your account, such as:

• Email address (magic link or OAuth profile)
• Name, username, and avatar if provided by Google, GitHub, or another identity provider you choose
• Authentication tokens and session identifiers

We use third-party authentication providers (including Google and GitHub) and an auth backend (currently Supabase). Those providers process identity data under their own policies when you authorize access.

Project and design data

To provide the editor and agent, we process design content you create or upload, including prompts, chat messages, schematic and PCB project files, exports (such as Gerbers), learning annotations, and related metadata (project names, timestamps, revision history).

Your Circuit World profile

Your profile at heypcb.ai/world/<your name> shows the name you claim, the name you choose to go by and — if you add them — a profile photo, a short bio and links to your X, LinkedIn, GitHub or website. Signed-in accounts can see all of it, along with who follows you and whom you follow. Someone who is not signed in sees only your photo, your name and your handle. Nothing on your profile comes from your email address.

A profile photo you upload is re-encoded on our servers, which removes the location and camera details a phone stores in a photo, and is checked there by an image classifier (the open-source NSFWJS model) for nudity and sexual content before anyone sees it. Your photo is not sent to anyone else to be checked. We keep the classifier’s scores for each photo you try, but never a photo it refused. Removing your photo, or your account, deletes it.

Usage and technical data

We may collect:

• Product usage events (features used, model tier selections, errors)
• Device and log data (IP address, browser type, approximate location derived from IP, referrers, timestamps)
• Local preferences stored in your browser (for example local-mode flags and default model settings)

Payments

If paid plans are enabled, billing details are processed by our payment processor. We do not store full payment card numbers on our servers.

Manufacturing and shipping requests

If you ask us to manufacture and deliver a board through a campaign, we collect the selected published board, recipient name, postal address, and any phone number you provide. We also record the relevant plan, manufacturing allowance, component-cost estimate, request status, fulfillment notes, and shipment tracking link. This information is private even though the board you selected was published to Circuit World.

3. How we use information

We use information to:

• Create and secure your account, and keep you signed in
• Run the Service, including the AI agent, board tools, DRC, routing, and exports
• Review, quote, manufacture, and deliver a board when you submit a campaign fulfillment request
• Send service messages (sign-in links, security notices, material product updates)
• Improve reliability, safety, and product quality
• Enforce our Terms of Service and prevent abuse
• Comply with law and respond to lawful requests

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, in the sense those words carry under the California Consumer Privacy Act. We do not use your project files to train public foundation models. To improve reliability and product quality, we may store a redacted technical copy of Inky turns and verification results for up to one year. Raw attachments and project files are not copied into that learning store. From that store we distil short, generic engineering lessons — and those lessons are shared across accounts: once a lesson has been confirmed by successful builds on at least two different accounts and two different projects, it may be quoted as guidance in another customer’s Inky session. Only that one generic sentence is shared, never your design, and a lesson is refused before it is stored if it names your project, a part designator on your board, or one of your board’s net names. Privacy questions and deletion requests can go to justin@heypcb.ai.

4. AI providers and processors

Prompts, relevant board context, and tool results may be sent to language-model providers you or we configure (for example through DigitalOcean or other model gateways) so the agent can design and edit boards. Those providers process content only to fulfill your requests and operate their infrastructure, subject to their terms and privacy policies.

The model providers we run Inky on are OpenAI, Anthropic and DigitalOcean (a gateway to open-weight models), and, when we switch it on, Microsoft Azure OpenAI, which runs OpenAI’s models on Microsoft’s infrastructure under Microsoft’s terms. Which one answers a given message depends on the effort level you choose, on which provider is healthy at that moment, and on which of our provider accounts we are drawing on. OpenAI and Anthropic do not train their models on data submitted through the API plans we use. DigitalOcean serves open-weight models under its own service terms, which make no equivalent commitment; we do not fine-tune any model on your data, and you can keep every message away from DigitalOcean by leaving the effort level at a setting the others serve.

We also run Inky through OpenRouter, a gateway that passes each request to a company hosting the model we choose — today an open-weight model hosted primarily by Modal. We ask OpenRouter to use only hosts that do not store or train on what is sent, and OpenRouter itself does not keep prompts. When the agent researches a product on the web, the search goes through OpenRouter to Perplexity; and a message may be sent through OpenRouter to TypeSafe, whose model decides which group of design tools the message needs.

We also use infrastructure and service providers for hosting, authentication, storage, analytics, and error monitoring. They may process data only on our instructions and as needed to provide their services. Named, by what they do for us:

• Render hosts the web app and the design engine, including the disk your project files live on, and the short-lived store behind our rate limiting and abuse prevention. That store holds counters against a one-way hash of an IP address rather than the address itself, and the entries expire on their own within minutes.
• Cloudflare R2 or Amazon S3, whichever we configure, holds the off-site backup of that disk when it is switched on: the files on it — your boards, design files, chat threads, uploaded images and undo history, and the email addresses of each board’s owner and the people it is shared with — are copied there so a lost or damaged disk can be restored.
• Supabase holds your account, sign-in sessions, billing state, and the learning store described in section 3
• Stripe processes payments and stores your card and billing address; we hold only a customer id and the plan you are on
• PostHog runs the product analytics described below
• Sentry receives error reports, with query strings stripped from any address they mention
• Resend sends our transactional email, such as board invitations and renewal reminders
• Google and GitHub when you choose them to sign in
• Cloudflare runs the anti-bot check in front of the free design checker. It is the one provider whose code runs in your browser rather than on our servers, so it sees your IP address and browser signals directly, and it may set a short-lived cookie of its own to remember that you passed. The check runs on that page only, before any account exists, and it is there so an upload form open to the whole internet is not drained by scripts.

Component catalogues and part libraries

Designing a board means looking parts up, and those lookups leave our servers. They carry what is being searched for and never who is searching: no account id, no email, no project name, and no board file. We send them from our own servers rather than your browser, so the catalogue sees us and not your address.

• tscircuit hosts the open component-search mirror we query for live stock, pricing and assembly availability. It is a community-run service rather than a contracted processor, which is why we send it a search term and nothing else.
• LCSC and EasyEDA receive the part number when we fetch a component’s details and its datasheet, or build its schematic symbol, footprint and 3D model for your board. EasyEDA also receives the search term itself when the mirror above is unreachable and we fall back to its catalogue, on the same terms: what is being searched for, never who is searching
• Firecrawl reads a component’s public catalogue page for us when we need its picture
• GitLab serves the open KiCad 3D model library we download part shapes from

3D generation

The Generate 3D panel turns a sentence or a reference photo into a shape. By default it runs on our own servers and nothing you type or upload leaves them. Where a deployment is configured to use a GPU backend instead, the prompt and any image you attach are sent to that backend to produce the mesh — Replicate, fal, or a Hugging Face Space, whichever is configured. Nothing else about your account or board goes with them. The panel tells you which generator produced a shape.

Links to other sites

Some buttons open another company’s site in a new tab. Following one sends that site what any visit does — your IP address and browser details — plus whatever the link itself carries; what happens after you arrive is between you and that site. Some carry something from your work:

• Post on X, offered once your board is entered in a challenge, opens X with a post already written: your board’s title and its public link on the challenge page. X receives that text as soon as its page opens, whether or not you post it; nothing goes to X unless you press the button.
• A part’s LCSC number in the board inspector links to LCSC’s search for that number. That visit comes from your browser, not our servers, so unlike the catalogue lookups above, LCSC sees your address.

When you send a finished design to a manufacturer, you leave for their site and upload it yourself. JLCPCB, PCBWay and OSH Park are listed in the editor as links; we do not transmit your board to any of them, and what happens after you arrive is between you and that manufacturer.

Automated decisions

Inky is an AI system. When you send it a message it decides, without a person in the loop, which design tools to run on your board and what to change. Those decisions affect your design file and nothing else: we make no automated decision about you that has a legal or similarly significant effect, such as whether you may hold an account, what you are charged, or what plan you are offered. Every change the agent makes to a board can be undone from the editor.

The one other automated decision is the check a profile photo passes (section 2): when the classifier finds a photo may contain nudity or sexual content, that photo is not used and you can choose another. If you think it got your photo wrong, write to justin@heypcb.ai and a person will look at it. We may also remove a photo that breaks the Terms after someone reports it.

Optional browser analytics and masked session replay are on until you turn either off in Privacy choices, and a choice you save there always applies. Turning either off does not affect your access, subscription or ability to design. We retain server-side service records such as account creation, billing outcomes, build results, failures and request timing to operate, secure and improve the Service. Those records do not read browser analytics identifiers and do not record your screen. Where applicable, our basis for these limited operational records is providing the Service and our legitimate interest in keeping it reliable and secure; you may contact us to object to processing based on legitimate interests.

Product analytics runs on PostHog, keyed on your account’s opaque user id. It records which steps of the product you reach — sign-in, creating a board, running a build turn, checking a design you upload, starting checkout — and never your email or name, your prompts or chat text, tool inputs or outputs, board or schematic content, part numbers, net names, or file contents. It also records the steps you arestopped at: when your plan or free allowance means we decline to start a board or run an Inky message, we record that it was declined, the short machine-readable reason (for example that a plan is needed, or that the free trial is used up), your plan, and the figures the decision was made against — how many boards you own, the board limit, and what share of your free trial has been used. The sentence you are shown is not recorded, and neither is anything about the board you asked for: no name, no id, no description. The free trial is charged from what a message actually costs to run, so a message that runs and then fails is still counted; what we record is that share as a percentage, never a balance or an amount of money. Page addresses are recorded without their query strings, so one-time values that travel in a link — a sign-in code, a checkout session id — are not sent. When something in the app breaks, the failure itself is recorded so it can be found and fixed: the error message and the code location it came from — with query strings stripped from any web address they mention — plus, for each request to the design engine, which kind of operation it was, whether it succeeded, and how long it took. When heypcb itself declines a request before it reaches the engine, it records that it did so and why — view-only access, a plan limit, or a malformed address — together with which plan you were on. When a file you import is declined because of the file itself — a zip with no board in it, a kind of file the importer does not read — it records that it was declined, the short machine-readable reason, and for a zip with no board one word for what it held instead (a board file the importer could not use, schematics, an older KiCad schematic, fabrication files, a project file only, part libraries, or none of these). Never the file’s name or anything inside it. Inside the board editor it records which of the four surfaces — schematic, PCB, 3D, product — you were on and for how long, and which named editing command you ran, from which menu, palette or toolbar, and on which surface. Those names are fixed identifiers from the app’s own command list; the wording you see on the button is not sent, because some of it is built from your own work. What you had selected, what a command changed, and every part of the board itself — designators, net names, part numbers, geometry — are never recorded. The editor counts one more thing about itself: when the design engine answers an edit you have just made with something different, so the canvas changes under you, it records that it happened, on which canvas, to how many items and of what sort — a wire, a junction, a note. Never which wire, which net, or where. It also records how the expensive operations ended, in more detail than whether they worked: running verification, the design-rule check or the electrical-rule check, auto-routing, checking whether a board can be ordered, exporting the manufacturing files, and generating the 3D view each record which of five endings they reached — finished, finished with something left unmeasured, declined before anything ran, timed out, or failed — together with how long it took and the counts involved. For verification, the names of any checks that did not run are recorded, so a green result that measured nothing is visible as one; for the order gate and a blocked export, the short fixed identifiers of the checks that blocked it. The findings themselves are never recorded — not a violation’s message, not the nets or designators it names, and not the name of the file you download. Before an account exists, it records that an idea was submitted from the home page and whether there were any words in it — never the words — and that a sign-in was started, by which of the four doors (a provider, an emailed link, or a password) and whether a destination was waiting, never your address and never the destination itself. When a plan wall is shown, it records the short machine-readable reason and which screen showed it, once per reason per screen. After a subscription exists: a change of plan records the plan moved from, the plan moved to, the billing interval, and whether that was a move up, a move down or a switch of interval; a cancellation records the plan that ended; and switching the extra-usage limit records that it moved and in which direction. No amount is recorded on any of those — the direction is worked out by comparing plan names, never prices. It also records how you judgeInky’s work, because that is how we tell whether it is getting better or worse: after a build turn that changed your board, the letter grade and score our own checker gives the board, and the fixed names of the checks that failed — never the sentence a check writes about them, which can quote your designators and net names. When you keep or undo a set of agent edits, we record which you chose and how long the prompt was up; when you undo or redo, we record how many steps it moved and in which direction, which control you used and roughly how recently the agent had touched the board. When you rate an Inkyanswer with a thumb, and the rating is stored, we record whether it was up or down — never the note you may write with it, and never which message it was about. Screen contents, prompts, and design data are never part of these reports. The one money-shaped value analytics carries is the dollar size of a completed credit purchase; card details, invoices, and payment-processor identifiers stay with our payment processor. Session replay — a recording of what a page looked like as you used it — runs until you turn it off, and stops when you turn usage analytics off. Where it runs, it can run across the app, including the board and schematic editor, with every field you type in and all on-screen text masked and every image, canvas and drawing blocked — the board previews on your dashboard and the canvases in the editor alike, so the artwork of your design, your part numbers and your prompts are never part of a recording. A replay shows layout and clicks rather than your content or your design, and it is not made when your browser sends Do-Not-Track or Global Privacy Control (GPC). Both signals override a saved choice, and the default, for optional browser analytics and replay. Analytics identifiers use local storage, not cookies, and we do not autocapture clicks or on-screen text. Analytics requests are proxied through heypcb.ai without your sign-in cookies or authentication headers. PostHog receives your IP address only shortened, with its last part removed, which is enough to estimate your country and city; the full address never leaves our servers. Local-mode identities are never identified. Product analytics is separate from the learning store described in section 3 and is not governed by it.

For a share of Inky messages, and for every one that fails or is stopped, PostHog also receives a step-by-step record of how the agent worked on it. For each step: which AI provider and model answered, how many tokens it read, wrote and took from cache, how long it took, and the size in bytes of what the agent was sent — how many messages, how much of it was new since the step before, and where an earlier part changed. For each design tool the agent ran: the tool’s name, how long it took, whether it succeeded as a short fixed code, and the size in bytes of what the agent sent the tool and of what the tool returned. And how the message ended, with the short fixed code of any failure. Only sizes, names, counts and codes are sent — never your prompt, Inky’s reply, what was sent to a tool or what it returned, or the text of an error.

5. Local mode

The Service may offer a local or offline-oriented mode where cloud account history is limited or unavailable. Local preferences and some session state may still live in your browser. Cloud features such as synced history and OAuth accounts require an online account.

6. Cookies and similar technologies

Necessary cookies and local storage keep you signed in, remember your preferences and protect the Service from abuse. Disabling these in your browser may break sign-in or other features. The anti-bot check on the free design checker may set a short-lived security cookie.

The canvas’s “For you” order remembers, in a first-party cookie on this device and only on the canvas’s own pages, which posts you have seen, opened and read, so your next visit shows you something new; it also remembers which order you chose. We read it only to order your feed — never for advertising or analytics. “For you” also uses what you already did on heypcb: your hearts, replies and follows, and the kinds of Circuit World boards you hearted. Hot, New and No replies yet order the canvas without any of it.

We remember your privacy choices for 180 days in a necessary first-party cookie containing only the choices, their version and the date you made them. It contains no advertising or analytics identifier. The PostHog browser SDK, its local-storage identifier and replay run until you turn them off. A browser that keeps no cookies could not remember that choice, so it is not measured. We stop optional collection and remove this browser’s analytics identifiers when you turn usage analytics off. That does not erase previously collected records; contact us to request deletion. Global Privacy Control and Do-Not-Track keep optional collection off.

Essential, minimized error reports continue so we can diagnose faults. Browser error reports do not include interaction breadcrumbs, session recordings or performance traces. Server-side security, account, billing and service records described above continue independently of these browser choices. We do not use advertising pixels or sell or share personal information for cross-context behavioural advertising.

7. How we share information

We share information only as needed:

• With service providers who help us run heypcb (auth, hosting, AI, payments)
• With PCB manufacturers, component suppliers, and shipping carriers only when needed to quote, make, and deliver a board you asked us to fulfill
• When you choose to export, download, or share project files yourself
• If required by law, regulation, legal process, or to protect rights, safety, and integrity of the Service and users
• In connection with a merger, acquisition, financing, or sale of assets, with notice where required

8. Designs imported from public repositories

Some boards in Circuit World were not published by a heypcb user. We import them from public repositories that contain KiCad projects — today, public GitHub repositories — and hold each one under a placeholder profile until its author claims it. Terms section 6 describes the practice; this section describes the personal data in it, because the people concerned are not our users and have not signed anything.

CAD World similarly imports openly licensed mechanical designs from public GitHub repositories. We store source files, repository and maker links, the source revision, licence, public maker name or login, public project metadata and upstream counts observed when fetched. These identify and credit the design and help people find it. We also generate pictures and 3D previews from the files. CAD World has no account claim feature; the same removal request below applies.

For imported boards, what we copy is what the repository publishes: the project files, the repository URL, the commit we copied, the owner's GitHub login and the licence the repository declares. The login is the only personal data among them, and we store it for one reason — to credit the author on the board and to recognise them if they claim it. We do not collect an email address, build a profile, or contact anyone whose work we import.

If you claim a board, we additionally record which account claimed it and when. The GitHub login we match against comes from GitHub's own sign-in, not from anything you type.

You can have an imported design taken down at any time, without an account and without explaining why: write to justin@heypcb.ai. Removal takes the design out of the catalogue and deletes the copy we hold, and we keep only the record that we removed it, which is what stops it being re-imported. Where the GDPR or a similar law applies to you, our basis for holding this data is our legitimate interest in running a gallery of real hardware designs, and your objection under this paragraph ends it.

9. Data retention

We retain account and project data for as long as your account is active and as needed to provide the Service. We may retain limited logs and backups for security, fraud prevention, and legal compliance for a reasonable period after deletion.

You can delete a board yourself from its menu on the dashboard, and you can delete your whole account from Settings. Deleting a board removes its project files, chat threads, uploaded images and undo history from our disk at once. Deleting the account also removes every board you own, the learning records derived from your sessions, your billing record with us, and your sign-in identity; any subscription is cancelled at the same time. Boards you published to Circuit World are copies you chose to make public and are withdrawn separately from the board’s Circuit World page. You may also ask us to do any of this by emailing justin@heypcb.ai.

How long each kind of data lasts if you do not delete it sooner:

• Account and profile (email, name, avatar, sign-in sessions; your Circuit World name, photo, bio, links and follows, and the photo check’s scores) — for as long as the account exists
• Boards and design files (projects, schematics, PCB files, exports, uploads, chat threads, undo history) — for as long as the account exists, and removed with the board or the account
• Learning records (the redacted technical copy of Inky turns described in section 3) — one year from the turn, deleted automatically after that
• Billing records (plan, subscription state, usage ledger, invoices) — seven years, because tax and accounting law requires us to keep them; this is the one category that outlives a deleted account, and it carries no design content
• Manufacturing and shipping requests (selected published board, address, phone if supplied, quote snapshot, fulfillment notes, and tracking) — while your account exists and as needed to make, deliver, support, and account for the order; after delivery you may ask us to remove contact and shipping details that we are not required to keep
• Payment-processor events — 30 days on our side; Stripe keeps its own records under its policy
• Product analytics — keyed to an opaque id, kept up to two years, then aggregated or deleted
• Error reports — 90 days
• Server and security logs — 30 days, longer only where we are investigating abuse or are required to preserve them
• Deletion records — we keep a dated note that an account was deleted, carrying no email, name or content, because it is how we prove the deletion happened

Encrypted backups lag these periods and roll off within 35 days.

10. Security

We use industry-standard safeguards appropriate to the nature of the data we process: encryption in transit, access limited to the people who need it, and secrets kept out of the code we ship to your browser. No method of transmission or storage is fully secure; you use the Service at your own risk and should keep exports of designs that matter to you.

If personal information of yours is exposed by a breach of our systems, we will tell you and the regulators who require it, without undue delay and within the deadline the law where you live sets — 72 hours of our becoming aware, under the GDPR. The notice will say what happened, what data was involved, and what you can do about it. To report a vulnerability, write to inky@heypcb.ai; we will not pursue anyone who reports one in good faith and gives us a reasonable chance to fix it.

11. International transfers

We are based in the United States and process information there and in other countries where our providers operate. Those locations may have different data-protection laws than your home country.

Where we move personal information out of the EEA, the UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum where it applies), or on an adequacy decision covering the destination, and we hold our providers to the same terms. Ask us at justin@heypcb.ai and we will tell you which mechanism covers a particular transfer.

12. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or export personal information, or to object to or restrict certain processing. To exercise these rights, contact justin@heypcb.ai. We answer within 45 days, and tell you if we need longer. We will not treat you differently for exercising them. You may also revoke OAuth access from your Google or GitHub account settings, and download every board you own as a KiCad project or a zip from the editor at any time.

If you are in the EEA, UK, or similar jurisdictions, our legal bases include performing our contract with you, legitimate interests in operating and improving the Service, and consent where required (for example certain cookies or marketing).

If we say no

You can appeal any request we refuse. Reply to our refusal, or write to justin@heypcb.ai with the word "appeal" in the subject. A different person reviews it and answers you in writing within 45 days, saying what we decided and why. If we still say no, you may complain to your state attorney general, or in the EEA and UK to your data-protection authority, and we will tell you how to reach them.

13. Children

The Service is not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will take appropriate steps.

14. Changes

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date. Material changes may also be communicated in-product or by email when appropriate. Continued use of the Service after changes become effective constitutes acceptance of the updated policy.

15. Contact

Questions about this Privacy Policy: justin@heypcb.ai
Website: https://heypcb.ai
Related: Terms of Service