Privacy policy

Information you give us:

• your email address, and your name or profile picture if you sign in with Google;
• the name you choose to be called, and your answers to the questions we ask when you start (what you are here for, your experience);
• the prompts you write, the pictures you generate or hand in, your answers to questions and surveys, and any notes you add;
• messages you send to our support address.

Information created when you use the Academy:

• which lessons and steps you completed, where you are in a course, and how long a lesson was open;
• which courses you bought, what you paid and when, and the status of the payment;
• your credit balance and what it was spent on;
• technical information such as your IP address, browser and device type, and the pages you visited.

We do not receive or store your card number. Card details go directly to Stripe.

• To provide the Academy: signing you in, showing your courses, keeping your progress, generating pictures and checking prompts when you ask. Basis: our contract with you.
• To take payment, send a receipt, and handle refunds and disputes. Basis: our contract with you, and our legal obligations.
• To send emails the service needs, such as sign-in codes and a note that your course is ready. Basis: our contract with you.
• To tell you when a new course opens, only if you ticked the box that asks for it, in a survey or in Settings. Basis: your consent, which you can withdraw at any time in Settings.
• To keep the Academy secure and prevent abuse, including rate limits and fraud checks. Basis: our legitimate interest in a safe service.
• To understand how the Academy is used and improve it, through product analytics. Basis: our legitimate interest, or your consent where the law requires consent.
• To keep records the law requires, such as tax and accounting records. Basis: legal obligation.

We do not sell your personal information. We do not use your prompts or pictures to train AI models.

We use other companies to run the Academy. They process information for us, under contract, and only to provide their service:

• Stripe: payments, receipts, fraud prevention.
• Resend: sending email.
• Railway: hosting the application and its database.
• Cloudflare: storing and serving pictures.
• PostHog: product analytics.
• Upstash: rate limiting, which uses a hashed form of your address or your IP address.
• Google: sign-in, if you choose to sign in with Google.
• OpenRouter, and through it the AI model providers such as OpenAI and Google: generating pictures and checking prompts. They receive the prompt you wrote and any picture you chose to work on. They do not receive your name or email address from us.
• The Hypear marketplace, which we also run: to check whether an email address belongs to a community member.

We may also share information when the law requires it, to protect our rights or the safety of others, or as part of a sale or merger of our business, in which case this policy continues to apply.

We are based in the United States, and the companies above operate in the United States and other countries. Your information is therefore processed outside the country where you live, including outside the European Economic Area and the United Kingdom.

Where the law requires it, we rely on recognised safeguards for these transfers, such as the European Commission's standard contractual clauses.

• Your account, progress and work: for as long as you have an account. If you ask us to delete your account, we delete them within 30 days.
• Purchase records: for as long as tax and accounting law requires, usually 7 years, even if you delete your account.
• Sign-in codes: 10 minutes. They are stored in hashed form.
• Records of AI model calls, which show what was asked for and what it cost: 24 months.
• Analytics: 24 months.

We use a small number of cookies:

• a sign-in cookie, which keeps you signed in. The Academy cannot work without it.
• a preferences cookie, which remembers the look and reading settings you chose.
• a short-lived cookie that carries your email address from the sign-in page to the page where you type the code.
• an analytics cookie set by PostHog, which lets us tell one visit from another.

You can block or delete cookies in your browser. If you block the sign-in cookie you cannot sign in.

Depending on where you live, you have the right to:

• ask for a copy of the information we hold about you;
• ask us to correct it;
• ask us to delete it;
• ask us to limit or stop a particular use of it, including analytics;
• receive it in a portable form;
• withdraw a consent you gave;
• complain to the data protection authority where you live.

To use any of these rights, write to legal@hypear.ai from the address on your account. We answer within 30 days. We will not treat you differently for using your rights.

In the Academy itself you can change the name you are called, and turn off the use of AI on your prompts, in Settings.

The Academy is for adults. We do not knowingly collect information from anyone under 18. If you believe a child has given us information, write to us and we will delete it.

We protect your information with measures such as encrypted connections, sign-in without passwords, access limited to the people who need it, and rate limits. No system is perfectly secure. If a breach affects you, we will tell you as the law requires.

We may change this policy. When a change matters, we will tell you by email or in the Academy. The version and date at the top say which policy is in force.

Privacy questions and requests: legal@hypear.ai. Anything else: support@hypear.ai.