Browse documentation
Early-pilot data notice
The current data inventory and the gates before real customer use.
Current service boundary
hej hosts app-specific support on Vercel and MongoDB Atlas. Accounts and conversations persist on that service. Wird support is operated by Rehan; contact support@wird.app for app support. For hej service help, privacy questions or a wider data-removal request, contact support@ummahsignal.com. Development and production conversations are separate. Other apps require their own authorized setup and published support details.
What is stored
Support records include workspace/apps, customer and installation identifiers, messages, private operator notes, request fingerprints, receipts, theme drafts/publications and durable work state. The MongoDB auth profile additionally stores operator name/email, password hashes, account/session and rate-limit records. SDK bearer credentials are hashed server-side; operator auth sessions use Better Auth’s revocable database session records and browser cookies. These are different credential systems.
On the device and browser
Native credentials, pending identity handovers and action execution state use Keychain. Scoped drafts, exact request envelopes, cached public transcripts and pending prepared photos are private local SDK state, excluded from backup and protected on iOS. Optional staged customer context becomes scoped persistent state once a session exists. Selected but unsent picker photos remain in memory and must be reselected after that view is discarded. Operator drafts may remain in browser local storage; development-harness credentials use tab session storage. Sign-out/account switching fences access, but is not a server deletion receipt.
Infrastructure and optional transfers
The hosting infrastructure is Vercel Node functions in London and a free MongoDB Atlas cluster in AWS Ireland. Database access is restricted to the hej database with a dedicated credential; the owner approved the network access rule needed for Vercel. The free cluster currently has backups disabled; no restore guarantee is offered. Optional AI, Telegram, APNs, subscription providers, billing and account email have independent configuration and verification requirements. Check the workspace’s actual readiness before relying on a delivery or payment. Geist fonts are self-hosted from the pinned package; the current web does not make a Google Fonts request. The native example bundles its own optional fonts, while the SDK defaults to host/system typography.
Customer data controls
Owners and admins can use Settings → Data and privacy for the selected app/environment to search and review a customer, request a private export, type the customer ID to confirm deletion, and follow worker receipts. Exports contain public support messages, permitted profile context, survey answers and owned feedback/votes, never private team notes or provider credentials. Each download is authenticated and expires after 24 hours. Scoped deletion immediately hides the customer’s data, ends access and cancels queued work; a completion receipt is issued only after stored content and applicable private photo objects are removed. Minimal deletion and replay markers prevent old credentials, provider events or restored records from bringing the data back. Downloaded exports, already delivered notifications and Telegram copies remain outside hej’s deletion receipt. Transcript settings default to 365 days per accepted message and photos to 90 days from finalization, with 30-day options; the operator must enable scheduled retention and review effective cutoffs before shortening. The setup status reports whether scheduled cleanup is enabled. No backup restoration guarantee is offered.
Reset is not deletion
Resetting a local session or signing out revokes access but does not erase accepted server records. Hosted owners/admins can request customer or application support exports and deletion in Settings → Data and privacy. Application deletion requires its exact ID, revokes support access immediately and reports completion after scoped content and private-object cleanup. Application exports include internal team notes; customer exports exclude them. Exports contain photo metadata, not photo archives. Workspace owners can open a separate workspace-data review for aggregate export/deletion. It requires the exact workspace ID and acknowledgement that global account and billing records remain; minimal receipts stay available to the original owner account after workspace access ends. Native self-service screens remain separate work. Use service support for wider requests; an email draft is not a deletion receipt. Erasing support data does not cancel hej billing or host-app subscriptions. Recovery stays quarantined until authoritative customer/application/workspace deletion fences and private-object access are reviewed.