Privacy Policy

Effective Date: May 24, 2026

This Privacy Policy explains what information Hypebook collects about you when you use Hypebook, why we collect it, who we share it with, and the rights and choices you have. We've tried to write this in plain English. Where a legal term matters, we've kept it and explained it.

1. Who We Are

Hypebook ("Hypebook," "we," "us," "our") provides Hypebook, a portfolio and achievement-tracking service for students. This Privacy Policy applies to the Hypebook websites, mobile experiences, and any related services that link to this policy (together, the "Service").

Our registered office is [to be inserted]. If you have any privacy question, the fastest way to reach us is at privacy@hypebook.xyz.

2. What This Policy Covers

This Policy covers personal information we collect:

  • Directly from you when you create an account, fill out your profile, log achievements, build a resume, or share your work;
  • From a school that invites you to Hypebook or links your account;
  • From verifiers (teachers, mentors, coaches, employers) who confirm or comment on an achievement you logged;
  • From third-party services you connect (for example, signing in with Google or importing a file from Google Drive); and
  • Automatically as you use the Service (for example, basic device and usage information).

It does not cover information about you collected by a school that operates independently of Hypebook, or by a verifier in their personal capacity. When your school uses Hypebook as part of an educational program, the school may also have its own privacy notice that applies to you alongside this one.

3. Information We Collect

Account information

When you create or maintain an account, we collect: your email address, name (if you choose to provide it), phone number (optional), date of birth (optional), and the password or single sign-on credential you use to authenticate. Authentication is handled by our identity provider (see "Service providers" below).

Profile information

You can choose to add: a profile photo, a headline, an "about me" bio, city and country, social profile links, and a custom handle/slug for your public page. None of this is required to use the Service.

Achievement and content information

When you add an achievement, you provide its title, organization, description, dates, category, an optional personal note (visible only to you), and any media files you upload (images, documents, etc.). You may also create posts and collections, and arrange these into a resume.

School information

You may link your account to a school using a school code, choose a school from a directory, or be invited by a school administrator. When you link to a school we may store: the school's identifier, your grade or year, your expected graduation date (when provided by the inviting school), your status as a current or former student, and — if your school chooses to confirm it — a record that your graduation has been verified. You may also upload graduation evidence (e.g. a diploma) for off-cycle verification.

Resume information

If you build a resume, we collect the data you enter into it: work history, education, skills, languages, certifications, and volunteer experience.

Sharing and visibility preferences

We record your choices about what to make public: which achievements you feature on your Hypepage, whether your full public vault is enabled, your theme and layout preferences, and which items are included in your shareable resume.

Information from verifiers

When you request a verifier to "Hype" an achievement, that verifier may provide: their name, position or title, organization or school, a profile image, a written recommendation, and their answer (verified, changes requested, or declined). We collect a verifier's email address from them in order to contact them, but on your Hypepage we display only the domain of their email (for example, "@school.edu") — not the full address.

Information from your school

If your school invites you or links your account, we may receive your name, expected graduation date, and a role assignment (e.g. student, classroom viewer). If your school later confirms your graduation, that confirmation is recorded on your account. If you leave a school, an administrator may record the reason for that departure (for example, transferred or graduated).

Information from third-party sign-in and integrations

If you sign in with Google, our identity provider receives the email address and basic profile details Google releases. If you import a file from Google Drive, we use your access token only to fetch that single file; we do not store the token after the import.

Usage and device information

As you use the Service, we and our processors automatically collect basic technical information: IP address, approximate geographic region, device and browser type, the pages you view and actions you take, and error or performance signals. We use this to operate the Service, prevent abuse, and improve reliability.

Visitor analytics on your public surfaces

When someone visits your public Hypepage, public vault, or shared resume, we log a minimal, anonymous record of the visit so we can show you basic engagement stats on your profile dashboard. Each record contains the surface that was viewed, the time it was viewed, the visitor's approximate country (from the network edge), and the hostname of the page they came from (if any) — for example, "linkedin.com" rather than the full URL. We do not record the visitor's IP address, browser fingerprint, account, or any other identifier. These records are stored against your Hypebook account so only you (and, where applicable, your school) can see them.

4. How We Use Your Information

We use the information described above to:

  • Provide, maintain, and improve the Service — including saving your achievements, building your Hypepage and resume, and surfacing your work on public surfaces you've opted into;
  • Authenticate you and protect your account from unauthorized access;
  • Communicate with you about the Service — for example, transactional emails, verification requests, achievement milestones, and important changes;
  • Operate the verifier ("Hype") flow — including contacting verifiers you nominate and storing their responses against your achievements;
  • Process content with AI when you use AI-assisted features (see "AI and automated processing" below);
  • Generate aggregated statistics and progress charts (for example, achievements per category per month) shown on your profile;
  • Detect, investigate, and prevent fraud, abuse, and security incidents;
  • Comply with legal obligations and respond to lawful requests.

We do not sell your personal information. We do not serve third-party advertising and we do not share your personal information with advertisers or data brokers.

5. Lawful Bases for Processing (UK / EU users)

If you are in the United Kingdom, European Economic Area, or another jurisdiction that uses similar concepts, our lawful bases for processing your personal information are:

  • Contract: we need to process your account information, profile, achievements, and resume data to provide the Service you've signed up for.
  • Legitimate interests: we rely on legitimate interests for security, fraud prevention, abuse detection, basic analytics, and improving the Service. We balance these against your interests and rights.
  • Consent: we rely on your consent for optional features — for example, making your vault publicly browsable, sharing your resume by link, or any optional integrations you turn on. You can withdraw consent at any time.
  • Legal obligation: we may need to retain or disclose information to comply with applicable law.

6. Public Profiles, Sharing, and Your Choices

Hypebook is designed so that nothing leaves your private account unless you choose to share it. The main public surfaces are:

  • Your Hypepage: a public portfolio at a shareable link. It shows the profile information you've added and the achievements you've explicitly featured. You control which achievements appear there.
  • Your public vault (opt-in): if you enable this from your settings, visitors to your Hypepage can browse the wider set of achievements you've marked as public. When this setting is off, the public vault is not reachable.
  • Your shared resume: if you generate a shareable resume link, anyone who has that link can view it.

Anything you mark as private (personal notes, items you haven't featured, achievements where you have not enabled vault visibility) is not exposed on any public surface. You can change these choices at any time, and changes apply going forward immediately. Search-engine indexing and caching of pages you previously made public may take time to clear after you make a page private.

7. Verifier Information ('Hypes')

When you ask someone to verify or "Hype" an achievement, they receive a link to respond. The information they provide (their name, position, recommendation text, etc.) is associated with that achievement on your account and may appear on your Hypepage if you choose to display it.

Two things to know about verifier privacy:

  • We collect the verifier's email address so we can contact them. On your public Hypepage we display only the email domain (e.g. "@school.edu") as a credibility signal, never the full address.
  • Verifiers control whether they respond and what they write. They can decline or request changes without writing a recommendation.

8. Schools and Educational Records

When a school administrator invites you to Hypebook or you link your account to a school, the school can see information related to your participation in that school's program. Depending on the administrator's role this can include:

  • Your name and email;
  • Your achievement counts, Hypepage status, and resume status;
  • The details of achievements you've logged and the verifications attached to them;
  • Your graduation status, expected graduation date, and departure information if you leave the school.

When Hypebook is used as part of an educational program in the United States, certain student information may be considered an "education record" under the Family Educational Rights and Privacy Act ("FERPA"). In that context we act as a service provider acting on behalf of the school under the school's instructions for the purposes for which the school engaged us, and the school maintains direct control of these records. Please refer to your school's privacy notice for information about how the school handles your records, and contact your school for FERPA requests.

9. Children's Privacy

Hypebook is intended for users who are at least 13 years old, or the higher minimum age required by their country (for example, 16 in some parts of the European Economic Area, or as otherwise set by national law). We do not knowingly collect personal information from children below that age without appropriate parental or guardian consent through a school program.

If a school enrolls students who are under the applicable age into Hypebook as part of an educational program, the school is responsible for obtaining the consents required under applicable law (for example, the U.S. Children's Online Privacy Protection Act ("COPPA")) and for instructing us on the data processing in accordance with that consent. We will rely on the school's authority and instructions in those cases.

If you are a parent or guardian and believe a child under the applicable age has provided us with personal information without appropriate consent, please contact us at privacy@hypebook.xyz and we will take prompt steps to delete that information.

10. AI and Automated Processing

Hypebook uses third-party AI services to help students get more out of their portfolio. Specifically:

  • When you use the AI resume assistant, the text of the achievements you've chosen to include may be sent to an AI provider to extract and rephrase content for resume sections.
  • When you search for a school that isn't already in our directory, the school name you typed may be sent to an AI provider to suggest matches.
  • We generate vector embeddings of certain text to power features like semantic search inside your own data.

We do not use these AI providers to make decisions that produce legal or similarly significant effects about you. The AI features assist you in building your portfolio — they do not grade, score, or rank you in a way that affects external outcomes without your involvement. If we ever introduce such a feature, we will update this Policy and seek any consent required by law.

11. How We Share Information

On surfaces you choose to publish

The Hypepage, public vault, and shared resume features described above expose only the information you've explicitly chosen to publish.

With verifiers you nominate

When you request verification, the verifier receives the achievement details and any context you include in your request.

With your school

If your account is linked to a school, school administrators with the appropriate role can view your activity inside that school's program, as described in "Schools and Educational Records" above.

With service providers (sub-processors)

We rely on a small set of trusted vendors to operate the Service. They process personal information on our behalf and only for the purposes we direct. As of the date above, our principal sub-processors include:

  • Clerk — authentication and user identity
  • Cloudflare R2 — media storage
  • Neon — managed PostgreSQL database
  • Resend — transactional email delivery
  • OpenAI — AI-assisted features described above
  • Stripe — payment processing (where applicable)
  • Sentry — error and performance monitoring
  • Vercel — hosting and content delivery for the web app
  • Fly.io — hosting for backend services

We update this list as our infrastructure evolves; the version published on this page is the current one.

In connection with a corporate event

If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to the protections of this Policy.

For legal reasons

We may disclose information if we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Hypebook, our users, or the public.

We do not sell personal information, do not share it with advertising networks, and do not participate in cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.

12. International Data Transfers

Hypebook is operated from, and uses sub-processors located in, several countries. When you use the Service your information may be processed in the United States, Canada, the United Kingdom, the European Economic Area, and other regions where our sub-processors operate.

Where personal information is transferred from the UK or EEA to a country that has not been recognized as providing an adequate level of data protection, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (or the UK International Data Transfer Addendum) with the recipient.

13. Data Retention

We keep your personal information for as long as your account is active, and for a reasonable period after that to comply with our legal obligations, resolve disputes, and enforce our agreements. The specific period depends on the type of data:

  • Account, profile, and content data: retained for the life of your account. When you delete your account, we mark it deleted and stop providing the Service to you; underlying data may be retained for a transitional period before final deletion.
  • Verifier responses ("Hypes"): retained for as long as the associated achievement exists on your account.
  • Public Hypepage / vault content: stops being publicly accessible immediately when you make it private, even if cached copies persist briefly on intermediate networks.
  • Operational logs and security records: retained for a shorter period as necessary for security, abuse prevention, and debugging.

We are finalizing specific retention windows; the up-to-date schedule will be reflected in this section.

14. How We Protect Your Information

We use a combination of administrative, technical, and physical safeguards to protect your information. These include encryption in transit (TLS), access controls and authentication on our systems, secure managed cloud infrastructure, monitoring and logging for security events, and a vulnerability-response process. No system is perfectly secure — we keep working to improve.

15. Your Rights and Choices

Depending on where you live, you have some or all of the following rights with respect to your personal information:

  • Access: ask for a copy of the information we hold about you.
  • Correction: ask us to fix information that is inaccurate or incomplete. You can edit most fields directly in the app.
  • Deletion: ask us to delete your account and personal information. You can begin this from your account settings or by contacting us.
  • Portability: ask for a copy of your data in a structured, machine-readable format.
  • Restriction or objection: ask us to restrict or stop certain processing (for example, processing based on our legitimate interests).
  • Withdraw consent: where we rely on your consent (for example, making your vault public), withdraw it at any time.
  • Complain: lodge a complaint with your local data-protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EEA, your national supervisory authority.

To exercise any of these rights, email us at privacy@hypebook.xyz. We may need to verify your identity before acting on a request and will respond within the time limits required by applicable law.

U.S. state privacy laws: if you are a resident of California, Colorado, Connecticut, Virginia, Utah, or another U.S. state with a comprehensive privacy law, you have rights similar to those above. You also have the right to be free from discrimination for exercising them. We do not sell or "share" your personal information for cross-context behavioral advertising, and we do not process sensitive personal information for inferences about you.

16. Cookies and Similar Technologies

We use a small number of cookies and similar storage mechanisms strictly to operate the Service. These include cookies that keep you signed in, remember your preferences (such as your selected layout and view modes), and protect against abuse. We do not use cookies for third-party advertising or for cross-site behavioral profiling. Where required by law we will surface a separate cookie notice.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the Effective Date above and, where appropriate, notify you by email or through the Service. Your continued use of the Service after an update means you accept the updated Policy.

18. Contact Us

If you have any questions about this Policy or our privacy practices, please reach out:

See also our Terms & Conditions for the rules that govern your use of Hypebook.