Privacy Policy

1. What we collect

This policy covers both the HyperPotion website and the HyperGrade mobile app. When you use either, we may collect:

• Account information — email address and authentication credentials (managed by Supabase). If you sign in with Google or Apple, we receive your email address from that provider — nothing else.
• Subscription information — payment status and plan details (managed by Stripe; we do not store card numbers)
• Saved card data (sync) — if you are a Premium subscriber, the cards you save in HyperGrade (photos, grade estimates, centering measurements, titles, tags and notes) sync to our servers so they follow you across devices. Free users' saved cards stay on the device only.
• Feedback — messages you send through the in-app feedback form, with your account attached if you're signed in
• Usage data — pages visited, preferences, and aggregated session metrics
• Technical data — IP address, browser type, device information, and standard server logs

We do not collect Pokemon TCG trading history, real-world identity beyond email, or any data you don't voluntarily provide.

2. Your camera and card photos

HyperGrade uses your camera to photograph trading cards. All grading analysis happens on your device — photos are not uploaded when you scan a card. A photo leaves your device in exactly two cases: you save a card to your collection as a Premium subscriber (it syncs to our servers as part of the saved card), or you choose to share or export it yourself.

Anonymized model improvement: when you delete a saved card (or your account), we may retain an anonymized copy of the card's grading snapshot — the card image, measurements and grade data — with your title, tags, notes and any account linkage removed. This dissociated data helps improve the grading model and cannot be traced back to you.

3. How we use it

We use the information above to:

• Authenticate your account and provide the Service
• Process subscription payments and send billing receipts
• Send transactional emails (account and billing notifications)
• Improve the Service through aggregated usage analysis
• Respond to support requests and prevent abuse

4. Third parties we use

HyperPotion relies on a small set of vetted service providers:

• Supabase — authentication, user profile storage, and database
• Stripe — payment processing and subscription management
• Vercel — hosting and content delivery
• Email service provider — transactional email delivery (specific provider listed in our public README)

These providers have their own privacy policies. We share with them only what they need to perform their function. We do not sell your data to advertisers or data brokers.

5. Cookies and local storage

We use cookies and browser local storage to keep you signed in, remember your preferences (dark/light mode, sort orders), and measure aggregated traffic. You can disable cookies in your browser; some features will degrade.

6. Data retention and account deletion

You can delete your account directly in the HyperGrade app (Settings → Delete account) or by contacting us. Deletion is immediate and permanent: your account, synced cards and profile are removed, and any active subscription is cancelled. Billing records required for legal, accounting and tax obligations are retained by Stripe per their policies, and the anonymized grading snapshots described in Section 2 remain (they contain no link to you). Server logs are retained for up to 90 days.

7. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your account and associated data
• Export your data in a portable format
• Object to processing or withdraw consent

To exercise any of these rights, contact us using the details on the About page.

8. Children

HyperPotion is not directed to children under 13 (or 16 in some jurisdictions). We do not knowingly collect data from children. If you believe a child has provided us with personal information, contact us and we will delete it.

9. International transfers

Our service providers operate in multiple regions. By using the Service, you consent to the transfer of your data to jurisdictions that may have different privacy laws than your own. We use providers that comply with widely-accepted data protection standards.

10. Changes to this policy

We may update this policy from time to time. Material changes will be announced via email or in-app notice before they take effect. The "Last updated" date at the top reflects the most recent revision.

11. Contact

Privacy questions, data requests, or concerns? Contact us — details land on the About page.