Last updated: October 14, 2026
2. Information we collect
- Account information you provide: name, email address and password (or Google Sign-In), date of birth, gender, pronouns, city/location, profile photo.
- Content you create: posts, comments, messages, goals, marketplace listings, community posts, polls, check-ins.
- Photos, videos and camera access: for profile pictures, post media, and (iOS only) room scans for the Design a Space feature.
- Approximate/precise location: to show nearby events, experiences, and place check-ins.
- Contacts (count only): with your permission, we read how many contacts are on your device to power the Relationships pillar of your Digital Twin. We never read or store contact names, numbers, or emails.
- Microphone recordings: only when you explicitly start a Voice IQ group clip, enroll your Digital Twin's cloned voice, or choose to listen live to a Twin-placed call.
- Payment and wallet information: top-up amount, Razorpay transaction/order IDs, and — if you request a withdrawal — bank account details (last 4 digits, IFSC, account holder name) for payout processing. We do not store full card or bank credentials; Razorpay processes payment instruments directly.
- Data from services you choose to connect: Apple Health (iOS only), Strava, Spotify, GitHub, Reddit, Gmail/Outlook (for the Twin's read-only email digest features), and Eventbrite — only after you explicitly authorize each one, and only to power your Digital Twin and personalization.
- Usage analytics: screen views, session length, feature interactions, and approximate location (country/region) — tied to your account, used only to improve the app. We do not use a third-party analytics SDK; this is collected and stored in our own backend.
- Device information: push notification token, device/OS version, crash diagnostics.
- WhatsApp (only if you use it): your WhatsApp phone number and the messages you send to our WhatsApp assistant. If you sign up on WhatsApp, your phone number is also your account's sign-in. See section 6.
3. How we use your information
To operate core features (feed, matchmaking, messaging, communities, marketplace, wallet), to compute your Digital Twin and resonance/compatibility scores, to personalize recommendations, to process payments and payouts, and to keep the platform safe (reviewing reports, moderating content, preventing abuse).
4. What we never do
We never sell your personal data. We never use Health, Strava, or any connected-account data for advertising — the app shows no ads and includes no ad SDK. We do not share your private messages with third parties except as required by law.
5. Who we share data with
- Firebase / Google Cloud — authentication, database, backend functions, push notifications, hosting.
- Cloudinary — media (photo/video) hosting.
- Razorpay — payment processing for wallet top-ups and withdrawal payouts.
- AI providers (Google Vertex AI / Anthropic) — to power Digital Twin text generation, content suggestions, and search-grounded features. Conversations you have with your own Twin are processed to generate responses but are not used to train third-party models beyond what each provider's own enterprise terms specify.
- Tavus, ElevenLabs, Exotel, Recall.ai — only if you opt in to Twin video-avatar calling, voice cloning, phone calling, or meeting-join features respectively. Voice/video/call data is sent to these providers solely to deliver the feature you activated.
- Meta (WhatsApp Business Platform) — only if you use WhatsApp. Messages between you and our WhatsApp assistant are delivered through Meta's WhatsApp Business Platform, and are also subject to WhatsApp's own terms and privacy policy.
These providers act as our data processors under their own security commitments and are contractually restricted from using your data for their own purposes.
6. WhatsApp assistant
You can reach your Digital Twin on WhatsApp. This is optional: nothing happens on WhatsApp until you message us. On WhatsApp your Twin helps only with your Hypercurated account: your plans and bookings, events, drafts waiting for your approval, standing tasks and people on Hypercurated. It is not a general-purpose assistant, and its replies are written by AI and can be wrong.
- Connecting: you create a one-time code in the app (Settings → Connect WhatsApp) and send it from your WhatsApp number. We then store your phone number linked to your account, so we know which account a message belongs to. To stop code guessing, we record repeated wrong codes against the number that sent them.
- Signing up on WhatsApp: if you send JOIN, we create a Hypercurated account whose sign-in is your WhatsApp phone number, and reply with a link that signs you in on hypercurated.si. The link works once and expires after 15 minutes; we store only a scrambled (hashed) copy of it. Your number is connected to the account once you finish setting up your profile. If your number already has an account, we do not sign you in by WhatsApp; you sign in the usual way and connect with a code. LOGIN sends a fresh link only to accounts made this way that have no other sign-in method.
- Your messages: the text you send is used only to answer you. Replies are written with Google Vertex AI (Gemini). Your Twin uses your account details for this, but not health data, health-app connections or your scores. The conversation is saved to your account, and you can read it in the app in your Twin's WhatsApp thread.
- We never use your WhatsApp messages to train or improve any AI model.
- Messages that look like health questions, card numbers, one-time passwords or passwords are answered with a fixed message, are not sent to an AI provider, and are not saved to your conversation. Please never send these on WhatsApp.
- Delivery: each incoming message is held briefly so we can answer it exactly once. Its text is deleted as soon as the reply is sent, and its delivery record expires after a day. We keep daily message counts per account and per number to enforce limits.
- Bookings: your Twin books something over WhatsApp only after you send an explicit booking command and then confirm it. It cannot book, pay, send or approve anything from an ordinary chat message.
- Talking to a person: send HUMAN and we record a support request for your account, and a member of our team replies by email.
- We only message you in reply to a message you send. We do not send marketing or promotional messages on WhatsApp. Send STOP at any time and we stop replying to your number; START turns replies back on.
- If a number that is not connected messages us, it receives only instructions for signing up or connecting, at most a few times a day.
- You can disconnect at any time in Settings → Connect WhatsApp. A connection that is unused for 90 days is disconnected automatically, and deleting your account removes the link between your number and your account. Your saved conversation stays in your account until you delete your account, or ask us to remove it at hypercurated.team@gmail.com.
7. Google account data
You can connect Google services to your account. We ask only for the access each feature needs, and only when you choose to connect it:
- Google Calendar (read-only, events only): your Twin reads the events on your own calendar to tell you what is coming up, to suggest meeting times only when you are free, and, if you turn on the meeting notetaker, to join the video calls on your calendar (Google Meet, Zoom, Teams). We keep only the title, start and end time, and video link of upcoming events. We never store descriptions, locations or other attendees' email addresses, and we never create, change or delete events.
- Gmail (send only): your Twin sends an email from your address only after you approve that exact email. We cannot read your inbox.
- YouTube (read-only): we read your own channel's public details and statistics to show them on your profile.
- Your Google email address, so you can see which account is connected.
Data received from Google is used only to provide these features to you. It is never sold, never used for advertising, never shared with anyone except the service providers that run these features for us, and never used to train or improve AI models. Hypercurated's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Your Google sign-in tokens are stored on our servers and are never readable from the app. You can disconnect any Google service in the app at any time; we then delete its stored token, and for Google Calendar the copy of your upcoming events. You can also remove our access at myaccount.google.com/permissions.
8. Your choices
You can disconnect any linked account at any time from Settings. You can control the visibility of your taste, tags, goals, and activity per-item (public / followers / Twin-only / private). You can request deletion of your account and associated data by contacting hypercurated.team@gmail.com.
9. Data retention
We retain your data for as long as your account is active. If your account is suspended or removed for violating our Terms of Service, we retain report and moderation records as needed to enforce that decision and prevent re-registration by the same individual.
10. Children's privacy
Hypercurated is not directed at children and requires users to be at least 17 years old. We do not knowingly collect data from anyone under 17.
11. Security
Data in transit is encrypted (HTTPS/TLS). Firestore access is governed by security rules scoped to each user's own data. Payment instruments are handled by Razorpay's PCI-DSS compliant infrastructure — we never see full card/bank credentials.
12. Changes to this policy
We may update this policy from time to time; continued use of the app after an update constitutes acceptance of the revised policy.