Privacy policy

1. Controller

The controller responsible for processing your data in the HypeNow app and on our websites is:

Fabian Friedrichsen

For privacy questions, reach us through the contact form: https://www.hypenow.app/support?lang=en#kontakt

2. In short

HypeNow shows what is popular in films, series, games and music right now and helps you decide what to watch, play or listen to. We process only what its features need.

HypeNow uses no tracking, no advertising, no advertising identifier and no third-party analytics or crash-reporting SDK. We do not sell data.

The app never asks for your email address or phone number. A name only if you give one: your name in your profile and, for friends features, a display name. We receive an email address only if you write to us or enter it in our contact form (section 14).

3. Our server, our websites and technical logs

The app talks to our own server (api.hypenow.app). Like our websites under hypenow.app, it runs at Cloudflare, Inc. (USA) as our processor, which also hosts our databases. Cloudflare is certified under the EU-US Data Privacy Framework.

For every request — from the app or from your browser — Cloudflare technically processes your IP address, the time, the requested address (for a search, the search term is part of it) and technical details such as the system and app version or the language setting. Our server logs are kept for at most 7 days. A few log lines contain your account’s internal identifier, for example when an account is created, secured with Apple, connected to or disconnected from Steam, or deleted. Cloudflare keeps answers that are the same for everyone — including answers to a search — in a cache, without any link to you.

To prevent abuse we count requests per network address in short-lived counters, which hold the address only as a hash — pseudonymised, never in clear text. When you open our websites in a browser, your browser may report connection errors to Cloudflare (Network Error Logging).

Legal basis: Art. 6(1)(f) GDPR (secure and stable operation).

4. Your device account and your library

As soon as you do something that needs our server — save a title, switch on a bell, allow notifications, connect Steam or use community features — the app automatically creates a device account: a random identifier, with no name, email address or phone number. The account is not anonymous, though: what is stored with it relates to you; it is pseudonymous. The sign-in key stays in your device’s keychain; we store only a hash of it. The key is valid for 90 days and is extended as long as you use the app. Every account gets a Hype ID (“HYPE-” and six characters); you find it in your profile, and anyone you give it to can send you a friend request with it (section 12).

With this account we store your library so it is not lost and moves to a new device when you secure the account with “Sign in with Apple”: watchlist, watched, favorites, ratings (1–10), play states, saved and listened-to music, the titles, games and songs you set up your taste profile with, follows (people, companies, franchises and artists), hype marks, the episode up to which you have watched a series, lists, settings such as region, services, genres, platforms, worlds and music service, your Taste Match and notes switches, and your profile name if you gave one. Notes only if you switch on “Keep notes in your account”; if you switch it off again, we delete them from the server. When you remove something, we keep a note of which entry was removed — without its content — so that your other devices pick up the change.

What you viewed recently, saved searches, favorite cinemas, individually ticked episodes and your HypeSwipe history stay on your device only. So do saved concerts; of these our server receives only the artist (section 8) and, if notifications are on, the planned reminder (section 9).

We keep what is stored with your account until you delete the account, unless this policy names a shorter period.

Legal basis: Art. 6(1)(b) GDPR (providing the app); for notes in the account Art. 6(1)(a) GDPR.

5. Securing your account with Apple

If you secure your account with “Sign in with Apple”, we store only an identifier Apple assigns; the app asks for neither your name nor your email address.

If you delete an account secured with Apple, you confirm this once with Apple. Our server sends the one-time code Apple issues for this back to Apple and so also ends “Sign in with Apple” for HypeNow; we do not store the code. If that fails, the app tells you how to end it yourself in the iPhone settings.

6. Steam (optional)

If you connect Steam, you sign in on Steam’s own page (OpenID); we never learn your Steam password. We store your Steam ID, your Steam display name and the addresses of your Steam avatar and profile, the games in your Steam library with playtimes (in total and over the last two weeks) and when you last played them, your unlocked achievements with their date and, for every day on which a game’s playtime changes, its total on that day. We use this to show ownership, progress and fitting hints.

We request this data with your Steam ID from Valve through the Steam Web API: when you connect, when you refresh, and when the app shows or uses your Steam games (for example in your library or in Gaming) and the last request was a while ago; a game’s achievements when you open the page of a game you own. Disconnecting deletes this data.

Legal basis: Art. 6(1)(b) GDPR.

7. Apple Music and HypeNow Listen (optional)

If you connect Apple Music, the app requests your library, recently and frequently played tracks, your ratings and Apple’s recommendations directly from Apple (Apple Music API), to base recommendations on your taste in music. Our server never receives the access key to your Apple Music account; it only provides a general HypeNow developer key. The app keeps a small summary of this on the device (such as your most frequent artists and genres); we never upload the library itself. Genre shares derived from it can enter your taste profile (section 10).

With your permission, HypeNow Listen briefly uses the microphone to recognize a song that is playing. The recording stays on the device; only an audio fingerprint is sent to Apple (ShazamKit) for the match. We store neither the recording nor the fingerprint.

8. What HypeNow watches for you, and your notifications in the app

So that HypeNow can tell you what is happening with your titles, games and artists, the app sends your account a list of what we should watch for you — even if you have not allowed notifications on your device: everything you switched a bell on for (with the events you chose for it), your watchlist and wishlist, series in which you ticked episodes, games you are playing or have paused, artists you saved or follow, the artist of a saved concert, and games with a price alert together with your price target (amount, currency and type of alert). Favorites are not part of it. The app replaces this list with every change; it stays with your account until you change it or delete the account.

Our server matches this list against new events — such as new episodes, a title joining a subscription, prices, releases, sequels and concerts — and puts matching entries into your personal inbox “Notifications” in the app. Notices from friends and the community (section 12) and recommendations from HypeNow (section 11) land there too. We store whether you have read an entry and whether it was delivered to you.

We delete read entries 90 days after they were created and unread ones after a year; an entry about a future date is kept at least until that date.

9. Notifications on your device (push)

If you allow notifications, the app requests a push token for your device from Expo. We store it together with a random identifier of your app installation, details of the system, app version, language, time zone and UTC offset, your settings (worlds, frequency, emoji, whether important ones are always delivered, quiet hours, daily summary and, if chosen, the city for concerts near you — as its centre rounded to about one kilometre, with the radius you chose), everything you switched a bell on for, and technical check values (hashes) for your registration.

We send recommendations and trends from HypeNow as notifications on your device only if you explicitly switch them on; you can switch them off again in Settings at any time (section 11).

Delivery uses Expo’s push service (650 Industries, Inc., USA) and the Apple Push Notification service. Expo receives the push token, the notification’s text (for example the name of a film, game or artist, never a friend’s name) and what the app needs to open it (for example the title’s identifier or the code of a group search invitation). We keep a delivery log for 120 days and the count for your daily limit for 3 days.

Reminders the app schedules itself — for example for a new episode, a release or a saved concert — are delivered by your iPhone itself. So that they count towards your daily limit, the app tells us which reminders are planned for which day (for each reminder an identifier of the title, game or concert, and the day); we delete this two days after the day in question.

Legal basis: Art. 6(1)(a) GDPR (your permission), which you can withdraw in the app and in the iOS settings.

10. Your taste profile (Taste Match)

While “Taste Match with friends” is on (the default), we keep a summary of your taste with your account: genre shares per world, the ids of your favorites, franchises you like, artists you follow, and your ratings only as coarse bands — never the exact values, never your watchlist or history.

We use it to compute Taste Match with your friends, the joint suggestions of “Watch with someone” and group search. If you have both allowed it in Settings, someone who is not your friend can also see a Taste Match with you through your username. Others see percentages and shared preferences, never the profile itself. In group search the other participants see your display name; the app computes the suggestions on the device. For this, the apps of your friends in the group receive your summary, the app of someone who is not your friend only the genre shares of the chosen world. What else we compute from the summary is described in section 11.

If you switch Taste Match off, we delete the summary from the server.

Legal basis: Art. 6(1)(b) GDPR.

11. Recommendations from HypeNow

While Taste Match is on (the default), our server regularly computes recommendations for you. It uses your taste profile (section 10), the list of what we watch for you (section 8), the taste profiles of your friends who also use Taste Match and, where your friends have allowed it in their settings, their ratings and favorites. This produces, for example, notices about new titles that fit your taste very well, about titles that fit you and have just entered a Top 10, about titles several of your friends like right now, about joint suggestions with a friend and about a marked change in your Taste Match. In the same way we use your taste profile and, if you share them with friends, your ratings and favorites for such notices to your friends. If you switch Taste Match off, we no longer compute such recommendations for you.

Independently of Taste Match, we let you know when a title we watch for you (section 8) enters a Top 10, and on Mondays we add a preview of how many of your dates are coming up in the next seven days.

These recommendations and notices appear in “Notifications” in the app, even if you have not allowed notifications on your device. We send them to your device only if you explicitly switch on “Picks from HypeNow”; you can switch this off again in Settings at any time.

For community lists, the app shows how well a list fits you (“…% match for you”) and suggests fitting lists under “For your taste”; our server computes this from your taste profile when you open them and does not store the result.

12. Friends and community

For friends features we store your display name, your friendships and friend requests. A request by your Hype ID reaches you without anything to switch on — only people you give your Hype ID to know it. A request by your username reaches you only if you allow “Requests via your username” (default: off). No request reaches you from someone you have blocked or who has blocked you, nor from someone whose request you declined in the last 7 days. If a request does not arrive, the app tells the sender — with that reason if your requests via username are off, without a reason otherwise. You only become friends when you accept a request or you send each other one; you can also share an invitation yourself through which someone can become your friend. Sharing watchlists with a friend needs the agreement of both. Your streaming services count for a friend’s suggestions only if you switch that on (default: off); a friend can then, over time, tell some of your services.

What others see is up to you in Settings; the default is always the most private: profile for friends only, activity, ratings and favorites not shown, no requests via your username. A username and a bio are optional. Lists are private until you share them with friends, by link or publicly; shared lists show their titles and descriptions and, depending on your settings, your name or your username, and anyone with the link can read a list shared by link or publicly, even without an account. Depending on your settings, the feed shows when you publish or hype a list, rate a title (with your rating) or make it a favorite. We keep feed activity for 90 days.

We also store whom you follow and who follows you, which lists you hyped or saved and, if you make your own version of someone else’s list, which list it came from.

Before anything of yours reaches others, you agree to the community rules; we store which version you accepted and when.

We store reports and blocks to keep the community safe. Only our moderators see reports; the reported person never learns who reported. Moderators are notified of a new report by push, without any detail about content or people. If at least three trusted accounts (secured with Apple, at least three days old, not restricted) report the same list, we automatically take it out of discovery, trends and search, and its owner is told in the app; nothing is hidden or removed without a moderator. If a moderator restricts an account, we store the kind, reason and duration until a moderator lifts the restriction or the account is deleted — also after a time-limited restriction has ended. We keep reports until one of the accounts involved is deleted.

Legal basis: Art. 6(1)(b) GDPR; moderation and safety Art. 6(1)(f) GDPR.

13. “Report a problem”, “Report an error” and error reports

If you report a problem, we send your text, the chosen category, the app version and build, the system and the app’s language to our server — without any account or device identifier. We keep reports for 180 days.

If you use “Report an error” to report wrong details about a title, game, song, person, book or one of HypeNow’s lists, we store the entry, what is wrong, your text (if you write one), the title shown and the context (such as the season or trailer and where in the app), your region, the providers shown, whether the app had an account at the time, and the app version, build, system and language — without any account or device identifier. If the app has an account, we use it only to limit the number of reports per account; in these short-lived counters it appears only as a hash. We keep these reports for 180 days too.

If the app crashes or an error occurs, it sends an error report without any account or device identifier: the kind and place of the error, an error message shortened to 200 characters from which the app removes email addresses, links, push tokens, long hexadecimal strings and numbers of five or more digits, the app version, build, system and a count. We count these reports per day and keep them for 60 days.

Legal basis: Art. 6(1)(f) GDPR (finding and fixing errors).

14. Contact form and email

You can write to us through the contact form on our support page, even without the app. We store your message, the topic you choose, the language of the page, the time and a note that the message came through the contact form, together with the reports from “Report a problem” in our database at Cloudflare (section 3), and keep it, like those, for 180 days.

Entering an email address is optional. Only if you enter one can we reply; we then store it with your message and delete it with it.

We do not store your IP address with your message. To prevent abuse we count messages per network in short-lived counters, which hold the address only as a hash, and check whether the form was sent from our own page and within a plausible time; we store nothing of this check. The form works without scripts and cookies. Our moderators are notified of a new message by push, without naming its content, its sender or an email address.

If you send us an email, we process your email address and your message in order to reply.

15. Usage statistics (only with your consent)

Only if you switch it on does the app count, anonymously, how HypeSwipe and community lists are used — for example which titles or lists shared publicly or by link were viewed, saved or shared — and send these totals without any account, device or session identifier to our server, which adds them up per day. Kept for 180 days. Legal basis: Art. 6(1)(a) GDPR.

16. Content your device loads directly

The app loads images, trailers and previews directly from their providers, which technically receive your IP address and apply their own privacy policies: TMDB (film and series images), YouTube/Google (trailers, music videos and their thumbnails), Apple (artwork, music charts and 30-second previews; in HypeSwipe the preview of the song shown starts by itself while the sound is on, and the app sometimes loads the next one in advance), Valve/Steam, IGDB, Twitch, Ticketmaster, Wikimedia Commons and the Cover Art Archive/Internet Archive (images).

The app partly searches and looks up music directly at Apple (iTunes Search API) — for example when you search for music, open an album, an artist or a song, or the calendar looks for concerts of the artists you follow. Apple then receives your search term or the entry’s identifier directly from your device.

Trailers play through YouTube in privacy-enhanced mode (youtube-nocookie.com); the app loads the player’s script from www.youtube.com. YouTube receives the video’s identifier and learns that it is played in HypeNow. In HypeSwipe the trailer of the title shown starts by itself, and the app already prepares the next one — YouTube then receives this information even if you do not tap play. The YouTube player can store settings in the app’s storage (for example about captions) that persist across app starts. HypeNow uses YouTube API Services; YouTube’s Terms of Service (https://www.youtube.com/t/terms) and Google’s Privacy Policy (http://www.google.com/policies/privacy) apply.

The app opens links to streaming services, shops or ticket vendors only when you tap them; the provider’s own terms then apply.

17. Data our server requests from third parties

Our server requests charts, ratings, game data, prices, concerts, cinemas and music data from TMDB, FlixPatrol, MDBList, IGDB/Twitch, Steam, Ticketmaster, Apple, MusicBrainz and ListenBrainz, the Cover Art Archive, Wikidata, Wikimedia Commons, YouTube and OpenStreetMap (Nominatim, Overpass). These providers receive search terms — such as the place you enter in the cinema search — and names and identifiers of titles, games or artists, but no identifier of your account. Exceptions: if you have connected Steam, we request your Steam data from Valve with your Steam ID (section 6), and when an account secured with Apple is deleted, our server sends Apple the one-time code (section 5). The city for concerts near you is used only on our server, to filter dates.

Game prices come from Steam (Valve), through the Steam Web API. For watched games we store the current Steam price, the lowest price we have seen and price changes in our database at Cloudflare (see above; processing in the USA is possible). These price records contain nothing about you.

18. Deletion and export

You can delete your account at any time in the app: Profile › gear (Settings) › Account › “Delete HypeNow account”. The row appears while your device is signed in to an account. The deletion takes effect immediately and cannot be undone. We then delete your account’s data on the server: library, settings, taste profile, the list of what we watch for you including price targets, your notifications in the app, lists, username and profile, friendships, follows, activity, push registration, the link to “Sign in with Apple”, Steam connection and Steam data, reports and blocks. Other devices signed in to the same account are signed out the next time they connect; what is stored locally on them stays there.

How deleting works step by step, and what remains afterwards, is also explained at https://www.hypenow.app/account-deletion?lang=en.

Afterwards the following remains: an empty record of your account with its internal identifier, its creation and deletion date and your Hype ID, so that the identifier and the Hype ID are never issued again — likewise, with a reference to your account, for earlier device accounts that were merged into your account; if your device was registered for notifications, an emptied record of your app installation (a random identifier and a point in time); if you had a username, for 30 days a block on its simplified spelling so that nobody takes it over right away — this record does not point to your account and, once the block has ended, is deleted the next time any username is changed; log lines for up to 7 days (section 3); and copies in backups of our database (restore points at Cloudflare and backups we make before changes to the database).

In addition, entries in other people’s “Notifications” that go back to something you did — for example that you follow them, hyped or saved one of their lists, or published a list — stay until they are deleted under the periods in section 8; internally they carry your account’s identifier, entries about a list you shared or published also its title. Other people’s feed entries about your lists are no longer shown and are deleted 90 days after they were created. Reports from “Report a problem”, “Report an error” and the contact form, and error reports, contain no identifier of your account and are deleted under their own periods (sections 13 and 14).

Deleting only the app does not delete your account on our server; if you reinstall the app on the same iPhone, it can use the account again. If you never secured the account with Apple, you can no longer reach it once your device is lost or reset, you sign out, or you do not use the app for 90 days. Such an account still stays stored on our server; there is currently no automatic deletion of unused accounts. So please delete your account in the app before you remove the app.

You can export your data in the app: Profile › gear (Settings) › My Data (“Your data” in older app versions) › “Export library”. The file contains what is stored on your device — library, lists, follows, price targets, reminders, concerts, cinemas, saved searches and settings — but not what exists only on our server, such as your Steam data, your notifications in the app, friendships, your community profile or your Hype ID. You can request access to all data about your account (section 20). What exists only on your device is deleted with the app — except the entries in the keychain (such as the sign-in key), which iOS may keep after the app is deleted.

19. Recipients and transfers outside the EU

Recipients are our processors Cloudflare (server, database, websites) and Expo (push delivery), and Apple (push delivery, Sign in with Apple, Apple Music, ShazamKit). Data may be transferred to the USA on the basis of the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

If you connect Steam, Valve receives your Steam ID (section 6). The providers whose content your device loads directly (section 16) receive your IP address; when you search for music, Apple also receives your search term. Their own privacy policies apply to these providers, and they too may process data in the USA.

20. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time with effect for the future.

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR (sections 3, 12 and 13), you can object to this at any time on grounds relating to your particular situation.

You can lodge a complaint with a data protection supervisory authority, in particular in the state where you live.

For any privacy question, and to exercise your rights, write to us through the contact form (https://www.hypenow.app/support?lang=en#kontakt).

21. Children and teenagers

HypeNow is for people aged 13 and over. If you are under 16, what rests on your consent — notifications, usage statistics and notes in your account — needs your parents' consent (Art. 8 GDPR). Everything else works without it.

If we learn that someone under 13 uses HypeNow, we delete the account.

22. HypeNow in your browser

You can also use HypeNow in your browser at www.hypenow.app/app. Without signing in, everything stays in your browser: what the app stores on your device (section 4), the web app keeps in your browser’s local storage for www.hypenow.app; it creates no device account in the browser. You can delete this data in the web app’s settings (“Reset local data”) or by deleting the site data of www.hypenow.app in your browser.

If you sign in with “Sign in with Apple” in your browser, you use the same HypeNow account as in the app (sections 4 and 5), and the web app syncs your library with that account. For the sign-in the page loads a script from Apple (appleid.cdn-apple.com) and opens Apple’s sign-in window (appleid.apple.com); Apple technically receives your IP address and processes the sign-in under its own privacy policy. As in the app, HypeNow asks Apple for neither your name nor your email address.

After you sign in, our server sets a cookie (__Host-hn-session). It holds your account’s sign-in key in encrypted form, cannot be read by the page’s scripts, is only sent encrypted (HTTPS) and only to www.hypenow.app, and lasts at most 90 days; we remove it when you sign out and when you delete your account. HypeNow sets no other cookies, none for advertising or statistics either. The cookie is strictly necessary for the sign-in you explicitly use (Section 25 (2) no. 2 TDDDG); section 4 applies to your account’s data.

So that the web app starts quickly and can show a notice without a connection, it keeps its own program files in your browser’s storage (service worker). They contain nothing about you; it never stores answers about your account.

Like the app, the web app loads images, trailers, previews and music search directly from the respective providers (section 16). Notifications on your device (push), HypeNow Listen and the connections to Apple Music and Steam are not available in the browser.