Privacy Policy

Effective date: August 10, 2026

Last updated: October 16, 2026

This Privacy Policy explains how HypUp (“we,” “us,” or “Company”) collects, uses, shares, and protects personal information when you use the HypUp mobile and web applications, related APIs, and websites (collectively, the “Service”).

Privacy requests: privacy@cuetheory.ai

Support: support@cuetheory.ai

By using the Service, you acknowledge this Policy. If you do not agree, do not use the Service.

1. Who we are

HypUp is a social learning platform for passions — sports, activities, arts, and hobbies (for example badminton, painting, or coffee brewing). Users create accounts, follow skill-building Plays, upload Moments (photos/videos) of their practice, interact socially (friends, follows, likes, comments, tags), and may receive automated feedback from CueBot (AI-assisted analysis).

We act as the controller of personal data processed for operating HypUp, except where a service provider processes data solely on our instructions (see Section 6).

2. Information we collect

2.1 Account and profile

• Email address
• Password (stored hashed; we do not store plaintext passwords)
• Full name / display name
• Username (where provided)
• Date of birth (used for age eligibility; Service is 13+)
• Profile photo and profile fields you choose to provide
• Activity “passions,” proficiency, and related preferences
• Coach / expertise application information (if you apply as a coach)

2.2 User content

• Moments (photos, videos, captions, and related metadata such as timestamps and storage region)
• Comments, likes, tags, and similar engagement
• Plays and Tracks you create (including text steps and media you attach or link)
• Messages or reports you send to us (when those features exist)

2.3 Social graph

• Friend requests, friendships, follows, blocks
• Coach–student or buddy relationships you create
• Search queries you run in-product (subject to retention limits)

2.4 Technical and security data

• IP address, approximate network location, and device/browser information used for security, rate limiting, fraud prevention, and diagnostics
• App version, operating system, and crash or error diagnostics
• Authentication tokens / session identifiers
• Push notification tokens (Expo push tokens) when you enable notifications, used only to deliver alerts about activity on your account
• Log data related to Service use (we aim to redact sensitive codes such as one-time passwords from logs)
• Usage activity — for each day you open the app, a record that your account was active that day, how many times, and which activities (for example Badminton) you engaged with. We use it to understand how the Service is used and to support and operate it. It does not include the content you view or create, and it is deleted with your account

2.5 Storage and region signals

• Signals used to store media in an appropriate geographic region (for example based in part on phone country or similar region information)

2.6 Communications

• Email delivery metadata when we send one-time passwords (OTP) or other transactional email
• Content of support emails you send us

2.7 Information we do not currently collect as a product feature

• We do not currently run in-app advertising networks or advertising identifiers for ads. If we add advertising later, we will update this Policy and App Store privacy labels before that release.
• We do not currently offer direct messaging (DMs); if we add them, this Policy will be updated.
• We do not sell personal information for money.

3. How we use information

We use personal information to:

1. Provide the Service — create accounts, authenticate you, show profiles, feeds, plays, and moments.
2. Enable social features — friends, follows, likes, comments, tags, search, and discovery.
3. Store and deliver media — accept uploads and serve content to authorized viewers.
4. AI-assisted analysis (CueBot) — when you request or the product triggers analysis, process relevant Moment media and related context with our AI service providers to generate feedback, scores/badges, and system comments.
5. Send notifications — deliver in-app and push notifications for connection requests, engagement on your Moments (such as hypes and comments), and CueBot analysis completion, when you have granted notification permission.
6. Safety and moderation — automated and manual review of content, enforce rules, suspend accounts, and investigate abuse.
7. Communications — send OTPs, security notices, and service-related email.
8. Security, reliability, and abuse prevention — rate limits, fraud detection, debugging, monitoring.
9. Improve the Service — aggregated analytics and product improvement, based on daily usage activity (see 2.4). Authorized staff may look at which accounts were active, in the minimum form needed (user ID, username and, for adults, name) to operate and support the Service; we do not use this to profile you for advertising, and we do not share it with third parties for their own purposes.
10. Legal compliance — respond to lawful requests, enforce Terms, protect rights and safety.
11. Subscriptions — verify App Store / Play Store purchases and keep your plan in sync (including restore).

Legal bases (where GDPR/UK GDPR or similar applies): contract performance; legitimate interests (security, product improvement, moderation); consent where required (e.g. certain device permissions); legal obligation.

4. AI processing of your Moments

If you use CueBot or related AI-assisted features:

• Your Moment (and related play/cue context) may be transmitted to our AI service providers to generate feedback.
• Outputs may be stored with your account/Moment (for example analysis records or badge results) and may appear as comments from the CueBot system account.
• Do not upload content you do not want processed by AI service providers operating under our instructions.
• Those providers process data under their terms and our agreements with them.

5. How we share information

We share personal information with:

We do not sell personal information. We do not share personal information for cross-context behavioral advertising today.

6. Processors and international transfers

Service providers process data on our behalf under contractual obligations. Data may be processed in India and in other countries where we or our providers operate. Where required, we use appropriate transfer mechanisms as implemented by our providers or our agreements.

7. Retention

We retain personal information for as long as your account is active and as needed to provide the Service, comply with law, resolve disputes, and enforce agreements.

• Account data: until deletion or as required for legal retention.
• Moments and engagement: until you delete them or your account is deleted, subject to backups and legal holds.
• OTPs: short-lived.
• Logs and security records: typically shorter operational windows unless needed for investigations.
• AI analysis records: retained with related Moments / account history unless deleted per product flows.

When you delete content or your account, we will delete or de-identify associated personal data within a reasonable period, except where retention is required by law or for legitimate security/fraud purposes.

8. Your choices and rights

Depending on your location, you may have rights to access, correct, delete, port, restrict, or object to certain processing, and to withdraw consent where processing is consent-based.

How to exercise: email privacy@cuetheory.ai from your account email (or verify ownership). We may need to authenticate the request.

In-product controls (as available): edit profile fields; delete Moments; block users; adjust visibility where the product offers it.

Device permissions: camera, microphone, and photo library access are controlled by your OS; denying permission may limit upload features.

Account deletion: follow the steps at https://app.cuetheory.ai/delete-account (email support@cuetheory.ai from your account email). We will process deletion subject to Section 7.

9. Children

The Service is intended for users at least 13 years old. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it. Parents or guardians who believe a child under 13 created an account should contact privacy@cuetheory.ai. Child safety standards (including CSAE reporting): https://app.cuetheory.ai/child-safety.

10. Security

We use industry-standard measures appropriate to the risk (encryption in transit, access controls, hashed passwords, secret management). No method of transmission or storage is 100% secure.

11. Third-party links and embeds

The Service may embed or link to third-party websites or media (for example demo videos hosted on external platforms). Those services have their own privacy policies. We are not responsible for their practices.

12. App Store privacy disclosures

Apple App Store privacy labels and similar disclosures should be read together with this Policy. If labels and this Policy conflict due to a lag in updates, contact us and we will align them.

13. Changes

We may update this Policy. We will change the “Last updated” date and, for material changes, provide additional notice (e.g. in-app or email) where required. Continued use after the effective date constitutes acceptance where permitted by law.

14. Contact

Privacy: privacy@cuetheory.ai

Support: support@cuetheory.ai

HypUp — https://app.cuetheory.ai

Also see Delete your account.