Privacy Policy

1. What we collect

When you use HyperPotion, we may collect:

• Account information — email address and authentication credentials (managed by Supabase)
• Subscription information — payment status and plan details (managed by Stripe; we do not store card numbers)
• Usage data — pages visited, preferences, and aggregated session metrics
• Technical data — IP address, browser type, device information, and standard server logs

We do not collect Pokemon TCG trading history, real-world identity beyond email, or any data you don't voluntarily provide.

2. How we use it

We use the information above to:

• Authenticate your account and provide the Service
• Process subscription payments and send billing receipts
• Send transactional emails (account and billing notifications)
• Improve the Service through aggregated usage analysis
• Respond to support requests and prevent abuse

3. Third parties we use

HyperPotion relies on a small set of vetted service providers:

• Supabase — authentication, user profile storage, and database
• Stripe — payment processing and subscription management
• Vercel — hosting and content delivery
• Email service provider — transactional email delivery (specific provider listed in our public README)

These providers have their own privacy policies. We share with them only what they need to perform their function. We do not sell your data to advertisers or data brokers.

4. Cookies and local storage

We use cookies and browser local storage to keep you signed in, remember your preferences (dark/light mode, sort orders), and measure aggregated traffic. You can disable cookies in your browser; some features will degrade.

5. Data retention

We retain account data while your account is active and for a reasonable period after deletion to satisfy legal, accounting, and tax obligations. Server logs are retained for up to 90 days. You can request earlier deletion at any time.

6. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your account and associated data
• Export your data in a portable format
• Object to processing or withdraw consent

To exercise any of these rights, contact us using the details on the About page.

7. Children

HyperPotion is not directed to children under 13 (or 16 in some jurisdictions). We do not knowingly collect data from children. If you believe a child has provided us with personal information, contact us and we will delete it.

8. International transfers

Our service providers operate in multiple regions. By using the Service, you consent to the transfer of your data to jurisdictions that may have different privacy laws than your own. We use providers that comply with widely-accepted data protection standards.

9. Changes to this policy

We may update this policy from time to time. Material changes will be announced via email or in-app notice before they take effect. The "Last updated" date at the top reflects the most recent revision.

10. Contact

Privacy questions, data requests, or concerns? Contact us — details land on the About page.