Privacy notice · version 2026-08-12
Your account is not the product.
This notice explains what Hyped24 collects, why it is needed, what becomes public, and how to exercise your data-protection rights.
Controller and contact
Matthew Anthony Gomez is the controller responsible for this processing. Contact privacy@hyped24.com for privacy questions or rights requests. You may also complain to the data-protection authority responsible for your habitual residence, workplace, or the alleged infringement.
What we collect
- Account email, authentication identifiers, session records, and limited security metadata.
- Your display name, permanent public handle, and confirmation that you meet the 16+ minimum age. We do not request your birth date.
- Community stances, thoughts, reports, and their editing or moderation history once those features launch.
- Essential request and delivery logs needed to operate, diagnose, and protect the service.
- Aggregate public-page analytics such as route, timestamp, referrer, approximate country, browser, operating system, and device category. Private member paths and URL query values are excluded.
Your email, authentication UUID, roles, session data, and age-attestation record are private. Your handle, display name, and visible contributions are public.
Purposes and legal bases
We process account and profile information because it is necessary to provide the account and community service you request. We process narrowly scoped security, abuse-prevention, and aggregate public-page analytics for our legitimate interests in protecting members, understanding whether the beta works, and operating a reliable service. We do not use account data for advertising or unrelated marketing.
Service providers and transfers
Supabase
Database hosting, account authentication, security logs, and backups in the configured EU project region.
Vercel
Website hosting, request delivery, operational security logs, and aggregate cookieless public-page analytics.
Resend
Authentication emails are dispatched through Resend’s Ireland region. Resend stores account data, email metadata, delivery logs, and API records in the United States under its DPA and applicable international-transfer safeguards.
Where data is transferred outside the European Economic Area, the provider’s data-processing agreement and applicable Standard Contractual Clauses or recognised transfer framework are used.
Retention
Account data is retained while your account is active or until deletion is requested. Accounts inactive for 24 months are reviewed annually and receive reasonable notice before deletion. Application-accessible authentication and security logs are limited to 30 days where provider controls permit; unavoidable provider retention is documented operationally. Vercel discards the analytics visitor-session hash after 24 hours, while aggregate reporting remains available only within the configured provider-plan window. Deleted data may remain temporarily in access-restricted backups until those backups expire.
Your rights
Depending on the circumstances, you may request access, correction, deletion, restriction, portability, or object to processing. Email privacy@hyped24.com from your account address, or complete a fresh magic-link verification. We aim to complete verified requests within one month. Some information may be retained where law requires it or where necessary to establish, exercise, or defend legal claims.
Age and cookies
The public beta is for people aged 16 or older. Hyped24 uses only cookies and similar storage strictly necessary to authenticate members, protect sessions, and confirm a fresh account-deletion request. These controls are not used for analytics. Hyped24 does not use advertising, marketing, or optional analytics cookies. Aggregate page analytics use Vercel's cookieless, daily-reset visitor measurement; account, authentication, administration, onboarding, sign-in, and member-profile paths are excluded, and query strings are removed before collection.