Privacy Policy

1. Data we collect

Account

When you create an account (with your email or Sign in with Apple) we store:

• Email address and a securely hashed password (never in plain text), or your Apple ID token if you use Sign in with Apple. If you choose Apple's “Hide My Email”, we only ever see the relay address.
• First name, username/handle, bio, city, and — optionally — your birthday.
• Your profile photo, if you upload one.

TikTok connection (optional)

If you connect your TikTok account so we can verify your posts, we store:

• Your TikTok handle and public follower count.
• View counts of the videos you submit to HYVE (to show your “Total reach”).
• OAuth tokens that let us read your public videos. These stay on our servers, are never shared, and are deleted when you disconnect TikTok or delete your account. We can never post on your behalf.

Activity in the app

• Activated visits, the unique tag you receive, and the post you submit (platform and link), plus its verification status.
• Vouchers you unlock and redeem, including the redemption details entered at the café (staff name and value) — used for your “Total money saved”.
• Spots you save with the heart.

What we deliberately do NOT collect

• Location: the app uses your location only on your device to show distances to cafés. It is never transmitted to our servers.
• Notifications are generated locally on your phone.
• No advertising ID, no analytics, no tracking of any kind.

2. What we use it for

• Running your account and showing your profile, posts, vouchers and stats.
• Verifying that a submitted TikTok post contains your visit tag and stays online for the required period.
• Preventing abuse (e.g. limits like one post per café per week, one voucher redemption per day, and suspension after repeated violations).
• Letting cafés honour the vouchers you redeem with them.

We do not use your data for advertising, profiling or automated decisions beyond the abuse-prevention rules above, and we never sell it.

3. Where your data lives

Your data is stored with Supabase (our database, authentication and file storage provider) and processed only to provide the service. Photos of spots in the app may be loaded from image providers (e.g. Unsplash); when your device loads an image, that provider receives standard request data such as your IP address, as with any website.

We share data with third parties only in these cases:

• Apple — if you use Sign in with Apple.
• TikTok— if you connect your account, we request your public profile and video data through TikTok's official API.
• Cafés — a café you redeem a voucher with sees the voucher details needed to honour it. Cafés never see your email address.

4. How long we keep it

As long as your account exists. You can delete your account at any time in the app (You → Settings → Delete my account). This permanently removes your profile, photo, visits, posts, vouchers, saved spots, TikTok connection and login — there is no grace period and no backup copy of your account data kept beyond our provider's short-term operational backups.

5. Your rights

Under the Australian Privacy Act 1988 (and the GDPR, if you use HYVE from the EU) you can ask us to access, correct, export or delete your personal data at any time. Most of this you can do yourself in the app (edit profile, change email/password, disconnect TikTok, delete account). For anything else, email us at contact@hyve.sydney — we respond within 30 days.

6. Security

All traffic between the app and our servers is encrypted (HTTPS/TLS). Passwords are hashed, access to your data is protected by row-level security, and post verification runs on our servers — your credentials never leave the authentication provider.

7. Children

HYVE is not directed at children under 13 (or the minimum age for TikTok in your country, if higher). We do not knowingly collect data from children.

8. Changes

If we change this policy, we will update this page and the “Last updated” date. Significant changes will be announced in the app.