Skip to content
HIPPie
Privacy

Privacy Policy

Last updated: 2026-10-17

1. Data Controller

HIPPie is operated by BHware.Co (Representative: ByungHyun Lim; Business Registration No. 579-88-03535; Sejong City, Republic of Korea), which runs the hippie.land website and the HIPPie mobile application. Our Privacy Officer is the representative above. For any privacy matter, contact: admin@bhware.com

2. Data We Collect

  • Account data — Username, email, and password (stored in a non-recoverable form); the nickname, bio and profile photo you enter; the time you confirmed at sign-up that you are 19 or older (your date of birth is checked on your device only and never sent to us); and records of your consent to the Terms and Privacy Policy (document version, display language, app version and time). While you change your email address, we briefly keep the new address awaiting confirmation.
  • Capture and device details — Capture and device details used to confirm that a photo or video was genuinely captured on your device and to prevent forgery: the device signature and signing public key sent at registration, a device identifier converted into a non-recoverable form, the app version, the camera lens used, and the capture time. This includes the per-device public key and attestation receipt issued through Apple's device-integrity service (App Attest), used only to confirm the app is an unmodified genuine install and stored per account and app install. We also store the public keys your device creates for handing over originals and for end-to-end encrypted chats; the matching private keys are never sent to us. If you switch phones and, after an email confirmation, replace your device key with the new phone's, the replacement and its time are kept as an account security record and a notice is sent to your account email.
  • Original records — When the app sends an original file to our server for registration, the server keeps only the minimal information needed to confirm it is an original (such as a non-recoverable fingerprint value and the registration time) and deletes the file right after processing. HIPPie does not keep your original photos or videos on its servers. The only exceptions are the temporary storage used to hand over an original and to send a verified copy, for the periods set out in Section 5.
  • Social and messaging content — Posts, captions, comments, stories, likes, follows and follow requests, blocks, mutes, reports, uploaded media, and direct messages you choose to send through HIPPie. Story view records (who viewed a story and when) are shown to the story's author as a "Viewers" list and are deleted together with the story when it expires. When you edit a post caption, we keep only the time of the edit, not the previous text.
  • Creator and badge activity — Records of HIPPie camera captures, visibility choices, reports, and HIPPie-Verified badge eligibility signals.
  • Technical and log data — IP address and request metadata are used for rate limiting, abuse prevention, and security. Anti-abuse counters do not store your IP, account identifier, or email address themselves — only a value converted with a secret key held solely by our server, from which the original cannot be recovered — and they are automatically deleted within 2 days. When a report is filed, so that reports arriving in a burst from the same connection source count for less when we decide whether to hide content automatically, we store with it not the IP address itself but a value converted per hour with a secret key held solely by our server; that value is deleted within 2 days. If repeated failed sign-ins from several places lock an account, we record that account, the number of failures and the lock time (no IP address); this record is erased when someone signs in to that account successfully, its password is reset or changed, or the account is deleted. Moderation audit logs that include the request IP are deleted after 365 days (1 year). Search terms are used only to show search results and are not kept as a search history. After an unexpected exit, the app asks once whether you want to allow future crash diagnostics. Before you opt in, it stores only a local prompt-needed flag, not the crash stack. If you allow it, future crashes may send HIPPie an obfuscated stack trace, app version, OS version, and error source without an account ID, device ID, authentication token, photo, or video. You can turn this off at any time under Settings ▸ Send crash diagnostics; turning it off also deletes diagnostics not yet sent. These reports are not linked to your account and are deleted within 90 days. We do not send usage analytics and do not use third-party advertising trackers.
  • Payment records — When you buy a paid feature, a transaction reference from the app store. Card and payment-instrument details are handled by the app store, not by HIPPie.
  • Hand-over tracing records — When a creator sends someone a verified copy or hands over an original, the hand-over is recorded (sender, recipient, time). A verified copy carries a mark linked to that record (an invisible tracing mark in photos; the sender's username in videos), so a leaked copy can be traced back to that hand-over after the fact. This does not monitor your device or how you store the file.
  • Data stored on this device — Your original photos and videos are stored in the encrypted vault on this device. The history of end-to-end encrypted chats is also stored on this device, not on our servers, encrypted with a per-account key — it stays when the same account signs in again and is erased when a different account signs in on this device or when the account is deleted. Chat history is not included in iCloud or other device backups; it is included in a backup file you create in the app and can be restored only to the same account. If a different account signs in on the same device and wants to delete originals the previous account left there, we send a confirmation code to the previous account's verified email to get that account owner's approval (the code is not sent to the person asking).
  • Push notifications — Only if you allow HIPPie notifications on your iPhone, we store the push notification device token Apple issued to this device, its environment (development or release build), the language, the app version, when notifications were turned on, and your per-type notification settings. To send a notification we pass Apple’s push notification service (APNs) the device token, the notification type, the public username of the person whose action triggered it (not included for messages in end-to-end encrypted chats), and the identifier of the screen to open when you tap it (a post, user or chat). Comment and message contents, photos and videos are never put in a notification. You can turn off each notification type in the app’s notification settings; types you turn off are not sent to Apple. The device token is deleted when you sign out, delete your account, change or reset your password, confirm an email change, when another account turns on notifications on this device, or when Apple reports the token is no longer valid; notification send records are deleted within 7 days after they are sent or fail (a notification that could not be sent within a day is not sent and is deleted the same way).

3. Purpose of Processing

  • Showing whether a checked copy matches a HIPPie original
  • Operating social, messaging, and creator features you choose to use (including sending push notifications if you allow them)
  • Protecting creators, viewers, and the service from abuse and fraud (including automated checks before publication and report handling)
  • HIPPie-Verified badge eligibility, service improvement, and security
  • Providing search for users, hashtags and posts, and content discovery
  • Sending emails needed to run your account, such as verification codes and account security notices

4. Legal Basis

Under the EU GDPR, processing relies on legitimate interest (Art. 6(1)(f)) for verification, security, and abuse prevention, and on consent (Art. 6(1)(a)) for account creation and optional features. Under Korea's Personal Information Protection Act (PIPA), we process personal data with your consent and as necessary to perform the service (Arts. 15, 22).

5. Data Retention

Account and original records are kept while your account is active or as needed to provide creator proof and viewer checks; you can delete individual records or your account at any time. Where you make a purchase, transaction and consumer records are retained as required by Korean law (e-commerce records for 5 years; consumer complaint and dispute records for 3 years). Originals sent to our server for registration are deleted right after processing, and an upload that never completes is deleted automatically within 48 hours. Additional periods: stories expire after 24 hours (their view records are deleted with them); email verification codes expire after 15 minutes; unconfirmed sign-up requests (email, username, nickname, and the password in a non-reversible form) are deleted after 24 hours; sign-in refresh tokens expire after 7 days. The copy our server renders when you send a verified copy is kept on the server so the recipient can collect it, and is deleted automatically 7 days after it was made, whether or not it was received (an uncollected copy's hand-over record is deleted with it, and the sender can delete it earlier in the app). While an original is being handed over, the original — encrypted so that only the recipient's device key can open it — is deleted within 15 minutes after the hand-over completes or is cancelled, and a hand-over not completed within 48 hours is cancelled automatically. A "Download your data" file is deleted from the server 48 hours after it was made. Anti-abuse counters (which hold only a value converted with a secret key held solely by our server, from which the original cannot be recovered) are deleted within 2 days; moderation audit logs are deleted after 365 days (1 year); opt-in crash diagnostics are deleted within 90 days. Backups of server data that we make for disaster recovery are encrypted, and only the 30 most recent of each kind are kept — older ones are deleted automatically. Where our database provider (Supabase) keeps its own backups, they are deleted when the retention period it sets ends. Deleting your account does not remove data already in a backup until that backup is deleted, but backups are used only for disaster recovery. Your original photos and videos are not kept on our servers (apart from the temporary storage above for handing over originals and sending verified copies) and exist only in the encrypted vault on your device — deleting the app, clearing its data, or losing the device removes that vault permanently, and only a backup file you exported yourself can bring it back.

Direct messages: all conversations are now locked with end-to-end encryption. A message is encrypted on the sender's device and can be opened only on the recipient's device; our server keeps only ciphertext it cannot read, for delivery. The server deletes ciphertext within 7 days after delivery is confirmed, and deletes ciphertext the recipient never collects after 365 days. The history of a locked conversation is stored on each person's device, not on our servers (see "Data stored on this device" in Section 2). The text of earlier messages exchanged before end-to-end encryption became the default may still be stored on our servers, and you can delete a single message or a whole conversation at any time — whether you sent it or received it, however old it is — choosing whether it is deleted only for you or for everyone in the conversation. Deleting for everyone erases the message text from our database for both sides at once; deleting only for you removes it from your own view only — the text stays stored for the other participant until every other participant has also deleted it only for themselves (it is then erased at once), it is deleted for everyone, or the retention limit below applies; a daily sweep erases message text nobody can reach any more (for example, after the other account was deleted). Where we set a maximum retention period for messages, earlier message text older than that period is erased even if nobody deleted it; when no such period is set, we do not delete readable messages by age. One exception to deletion: if content is reported, we keep a copy of the reported content and the context needed to review it. That copy survives deletion, is used only to handle the report and any appeal, and is kept no longer than that purpose requires. Because messages sent after a conversation is locked cannot be read by our servers, a report about a locked conversation is reviewed using only what the reporter submits with the report.

Minimal records kept after deletion: when you delete your account, the account and your posts, comments, stories, messages, media and sessions are all deleted. Three things are kept in a limited form, on the basis of our legitimate interest in defending legal claims and responding to repeat abuse. (1) Copies of content included in reports that other users filed — purpose: evidence for handling the report and any appeal. Retention: 12 months from the day the report is closed, after which the copy is deleted automatically. Access: operators only, and each access is written to the audit log. (2) Terms-consent receipts — purpose: proof that consent was given. The account identifier is pseudonymised at deletion, so the receipt no longer identifies you. Retention: 5 years from the day the account is deleted, after which the receipt is deleted automatically. (3) Operator-action audit records — only the fact that an action was taken remains; the target identifier and IP address are removed at deletion. Retention: 365 days (1 year). If an operator deletes their own account, the records of actions they took keep the operator's internal identifier for as long as those records are kept, so it remains clear who acted. In addition, the record that an original was registered (its non-recoverable fingerprint value and the registration time) stays, detached from any owner information, so that nobody can later register the same original as their own.

6. Data Sharing and Sub-processors

We do not sell personal data. Public records show only the creator-facing information needed for viewers to understand an original record. We entrust the processing of personal data only to the service providers below, which HIPPie needs to operate; they process it for no purpose other than the work entrusted to them, protecting security and meeting legal obligations. If a provider or the work we entrust changes, we will update this policy and let you know.

  • Supabase, Inc. (United States) — operating the service database: all information stored on our servers, such as accounts, records, posts and messages
  • Railway Corporation (servers in Singapore) — hosting our servers: handling app and website requests (the information they carry and IP addresses) and temporarily storing verified-copy and original hand-over files
  • Postmark (ActiveCampaign, LLC, United States) — sending verification-code and account-security emails: email address and message content
  • Vercel Inc. (United States) — serving the hippie.land website: visitors' IP addresses and request information
  • Apple Inc. (United States) — device-integrity checks (App Attest: per-device public key and attestation receipt), push notification delivery (APNs: device token, notification type, the public username of the person who triggered it, and the identifier of the screen to open), app distribution, and payment processing if you buy a paid feature (App Store / StoreKit)

7. International Data Transfer

All of the sub-processors above process personal data outside Korea. We entrust this processing because it is necessary to perform our service contract with you, and under Article 28-8(1)(3) of Korea's Personal Information Protection Act we disclose the following here. Data transferred, recipients and purposes: each item of Section 6. Countries: the United States (Supabase, Postmark, Vercel, Apple) and Singapore (Railway servers). Timing and method: transmitted over encrypted network connections whenever you use the service. Retention: until the entrusted work ends or you delete your account, or for any retention period set in Section 5. Recipients' contact: each company's privacy inquiry channel (supabase.com, railway.com, postmarkapp.com, vercel.com, apple.com). How to refuse and the effect: we cannot provide the service without these transfers, so if you do not want them you can choose not to sign up or delete your account, in which case you cannot use the service. Transfers to Apple for push notifications happen only if you allow HIPPie notifications on your iPhone; if you do not, you can still use the rest of the service. Data of EEA residents is transferred under appropriate safeguards such as standard contractual clauses or an adequacy decision.

8. Your Rights

  • Right of access — Review your account and original record history in the app.
  • Right to rectification — Correct your nickname, bio, profile photo, post captions and email address directly in the app. Changing your email address requires a code sent to your current address, your password, and a code sent to the new address, in that order; we then notify your previous address, and you must sign in again on every device.
  • Right to erasure — Delete individual records, messages or conversations, or your account. Even a suspended account can request its own deletion by signing in to the app. Deletion may be put on hold while a legal retention obligation or a preservation request from an authority applies; in that case we direct you to support. Evidence copies of reported content are kept for their existing retention period regardless of account deletion. (GDPR Art. 17 / PIPA Art. 36)
  • Right to object / restrict — Make an individual original record private, or switch your whole account to private so that only followers you approve can see your posts and stories. Muting a user hides their posts and stories from your own feed and stories only, and they are not told. Making your account private does not close verification links you already shared — to close a link, change that record's visibility. Where the law gives you that right, you can also ask us to stop optional processing.
  • Right to data portability — In the app under Settings ▸ Download your data, after an email confirmation, download your account information, posts, comments, likes, follows, block and mute lists, stories, messages stored on our servers, reports you filed, activity records, export and hand-over history, capture records and consent records in a machine-readable format (JSON). The file carries a server signature against forgery and leaves out security data such as passwords and verification codes. About other people it contains only identifiers already in your own records (such as whom you follow or the other party in a hand-over), not their profiles. Your data download does not include other people's device identifiers (the recipient device information of an original hand-over) or operational records of a preservation measure taken under law or at an authority's request. Your original-record history is available separately through the proof copy download.

For requests you cannot complete in the app, contact us at admin@bhware.com — we respond within one month (extendable where the law allows for complex requests) and provide access or portability copies in a machine-readable format (JSON). Even while the re-consent screen for updated terms is shown, you can download your data or delete your account directly from that screen. EU residents may also lodge a complaint with their supervisory authority; Korean residents may contact the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972) or the Privacy Infringement Report Center (privacy.kisa.or.kr, 118).

9. Adults Only

HIPPie is an adults-only service for users aged 19 and over. We do not knowingly collect personal data from anyone under 19, and we do not offer registration with the consent of a legal guardian. If you believe a person under 19 has provided personal data, contact us and we will delete it.

10. Automated Decisions

HIPPie-Verified badge eligibility is determined automatically from your camera-origin records and account signals. This does not produce legal or similarly significant effects on you, and you can contact us for a human review of any badge decision. Posts and comments go through an automated check before publication, and content held by that check is not published until an operator reviews it. When the review ends, we tell you the result (published or removed) in the app's notifications, and by push notification too if you allowed push. These notifications carry neither the reviewing operator's details nor the rule that applied.

11. Security

We use reasonable security measures for accounts, original records, and viewer checks, including encrypted connections, protected (non-recoverable) passwords, an on-device encrypted vault, rate limits, account lockout, and abuse prevention. Direct messages are protected with end-to-end encryption (X25519 key agreement, keys that change with every message, and ChaCha20-Poly1305 encryption), so our server cannot read them, and an original you hand over is encrypted so that only the recipient's device key can open it. No online service can promise perfect security.

12. Contact

For privacy inquiries, or to reach our Privacy Officer: admin@bhware.com