# Hipaths Privacy Policy Effective date: July 26, 2026 This Privacy Policy explains how Hipaths ("Hipaths", "we", "us", or "our") collects, uses, stores, shares, and protects information when you use the Hipaths mobile application, character studio, AI image generation tools, credit purchases, notifications, and related services (together, the "Service"). Hipaths lets users create fictional adult character profiles and AI-generated visual content. The Service is not intended for children, and users must be old enough to use the Service under applicable law and app store rules. If you do not agree with this Privacy Policy, do not use the Service. ## 1. Information We Collect We collect information you provide directly, information generated through your use of the Service, and information received from service providers. ### Account and authentication information When you sign in or create an account, we may collect: - Email. - First name and last name, if provided by your sign-in provider. - Authentication provider information, such as Apple or Google account identifiers. - Email verification status. - Session identifiers and access tokens generated by Hipaths. - Sign-in metadata such as IP, user agent, and country inferred from network headers. If you use Sign in with Apple and choose to hide your email, Apple may provide us with a private relay email instead of your real email. ### Character and creative input information When you use Character Studio or content generation features, we may collect and process: - Character settings you choose, such as display name, gender, age range, height, weight, ethnicity, hair style, hair color, eye color, fashion style, visual style, and similar profile attributes. - Manual prompts, selected prompt templates, image size, quality, and other generation settings. - AI-generated character metadata, such as profession, biography, appearance details, image prompts, personalities, and reference sheet prompts. - Generated images, image paths, file size, MIME type, dimensions, generation status, job identifiers, model identifiers, provider task identifiers, and generation metadata. - Content deletion state and moderation/reporting state. Hipaths is designed for fictional adult characters. You must not submit prompts, character settings, names, or other input intended to identify, imitate, or impersonate a real person without appropriate rights and consent. ### Purchase and credit information Hipaths uses a credit-based model. When you purchase or spend credits, we may collect: - Credit balance and credit ledger entries. - Product IDs such as credit pack identifiers. - Purchase event identifiers, transaction IDs, original transaction IDs, store, environment, purchase timestamps, and entitlement identifiers received through app store purchase systems and purchase management providers. - Purchase matching status and related metadata needed to apply credits to your account. We do not directly collect or store your full payment card number. Payments are processed by the relevant app store, purchase management providers, and/or their payment partners. ### Reports and moderation information If you report content, we may collect: - Your user ID. - The reported media content ID. - Report reason, such as nudity, violence, self-harm, intellectual property infringement, or other. - Review status, timestamps, and moderator notes where applicable. ### Notifications and service messages We may create and store notifications related to your account, purchases, character creation, system updates, and general service messages, including read or dismissed status. ### Technical, device, and security information We may collect: - IP, user agent, request IDs, logs, error details, and diagnostic information. - Country inferred from network headers. - Session status, expiration, revocation state, and cache metadata. - Information needed to prevent fraud, abuse, unauthorized access, and repeated failed requests. ### Mobile product analytics Hipaths uses PostHog as a mobile product analytics service to understand how people use the app and improve its reliability and usability. PostHog may process: - A pseudonymous Hipaths account identifier after you sign in. - General app usage and interaction information. - App, device, and technical session information. - Approximate location information derived from network information where available. We use this information for internal product analytics, troubleshooting, reliability monitoring, and product improvement. We do not use PostHog for third-party advertising, and we do not sell personal information. We do not intentionally send your email address, name, character settings, manual prompts, generated images, or payment card details to PostHog through these analytics events. Character settings, prompts, generated images, and purchase information are processed by Hipaths and the service providers needed to provide the features described elsewhere in this Privacy Policy. ## 2. How We Use Information We use information to: - Provide, operate, maintain, and improve the Service. - Authenticate users and manage sessions. - Create fictional character profiles and AI-generated images. - Store and retrieve user-created characters, galleries, generation jobs, and prompt templates. - Process credit purchases, apply credit balances, spend credits for generation features, and restore credits when eligible generation failures occur. - Send transactional and service notifications. - Review reports, moderate content, enforce our Terms of Use, and protect users. - Detect, prevent, and investigate fraud, security incidents, abuse, and policy violations. - Debug errors, monitor reliability, and improve performance. - Comply with legal obligations, app store requirements, and requests from competent authorities. We do not sell your personal information. ## 3. Legal Bases for Processing Where applicable data protection laws require a legal basis, we process personal information based on one or more of the following: - Contract performance, such as creating and managing your account, generating content you request, maintaining credits, processing purchases, and providing the Service. - Legitimate interests, such as securing the Service, preventing fraud and abuse, debugging errors, improving reliability, enforcing our Terms, and protecting users. - Legal obligations, such as tax, accounting, payment, consumer protection, safety, law enforcement, and compliance requirements. - Consent, where required for optional features such as certain notifications, analytics, marketing, or other processing that requires consent under applicable law. ## 4. AI Processing and Generated Content Hipaths uses third-party AI and infrastructure providers to generate text, prompts, metadata, and images. Your prompts, selected character information, and generation settings may be sent to service providers only as needed to provide the requested generation features, safety checks, reliability, and abuse prevention. AI outputs can be inaccurate, unexpected, or similar to existing styles or concepts. You are responsible for reviewing generated content before using, sharing, or publishing it. Do not submit: - Personal data of another person without lawful permission. - Prompts, character settings, or generated-content requests involving minors in sexual, suggestive, exploitative, or unsafe contexts. - Pornographic, non-consensual, abusive, hateful, violent, self-harm, illegal, or infringing content. - Prompts intended to impersonate real people, violate publicity rights, or infringe intellectual property rights. ## 5. How We Share Information We may share information with: - Cloud hosting, database, storage, logging, and security providers used to operate, secure, and maintain the Service. - AI generation and related technology providers where needed to generate requested content. - Authentication providers such as Apple and Google, where needed to complete sign-in. - App store, purchase, and entitlement providers where needed to process purchases, verify transactions, apply credits, prevent fraud, and support refunds or disputes. - Professional advisors, legal counsel, auditors, and compliance providers. - Law enforcement, regulators, courts, or other parties when required by law or when we believe disclosure is necessary to protect rights, safety, users, or the Service. - Successors or affiliates in connection with a merger, acquisition, financing, reorganization, or sale of assets. We require service providers to process information only for appropriate service-related purposes, subject to their contracts and policies. ### Service Providers Depending on the features you use, Hipaths may use service providers for hosting, database, storage, security, authentication, app store purchases, entitlement management, AI generation, logging, diagnostics, push notifications, and customer support. These providers may process information only as needed to provide, secure, support, moderate, or improve the Service. If we add crash reporting, advertising, tracking, push notification SDKs, or additional third-party SDKs, we will update this Privacy Policy and applicable App Store privacy labels or Google Play Data Safety disclosures before release where required. ## 6. Storage and Retention We keep information for as long as reasonably necessary to provide the Service, maintain your account, process credits and purchases, comply with legal obligations, resolve disputes, enforce agreements, and protect the Service. In general: - Active session cache entries are short-lived, while account sessions may remain valid until expiration or logout. - Generated character records and gallery items remain available until you delete them or your account is deleted, subject to backups, abuse records, and legal retention needs. - Deleted media may be soft-deleted first and removed from active views before permanent deletion is completed. - Purchase, credit ledger, fraud-prevention, tax, and compliance records may be retained longer where required or reasonably necessary. - Reports and moderation records may be retained to enforce safety policies and prevent repeated abuse. ## 7. Your Choices and Rights Depending on your location, you may have rights to: - Access personal information we hold about you. - Correct inaccurate information. - Delete your account or certain content. - Object to or restrict certain processing. - Request portability of information you provided. - Withdraw consent where processing is based on consent. - Appeal or complain to a data protection authority. To make a privacy-rights request, contact us at support@hipaths.com. Account deletion is available from within the app. We may need to verify your identity before completing certain requests. Some information may be retained when necessary for security, legal compliance, payment records, fraud prevention, dispute resolution, or enforcement of our Terms of Use. ## 8. Account and Content Deletion You may delete your Hipaths account from within the app by going to Settings > Account > Delete Account. When you request account deletion, Hipaths will delete or de-identify personal information associated with your account unless retention is necessary for legal, security, fraud-prevention, purchase, tax, dispute-resolution, moderation, or compliance purposes. Account deletion is permanent. It may remove access to unused credits, generated content, account history, and other data associated with your account. Deleting your account does not automatically refund completed purchases, cancel app store purchases, or cancel subscriptions if any are later introduced. Refund and purchase cancellation requests must be handled through Apple App Store or Google Play where applicable. Generated media may also be deleted from your gallery where the Service provides deletion controls. Deleted media may be removed from active views before permanent deletion from storage and backups is completed. If account deletion cannot be completed immediately, we will process the request within a reasonable period. ## 9. Security We use technical and organizational safeguards designed to protect information, including authenticated sessions, token hashing, session expiration, origin checks for cookie-authenticated web requests, request validation, access controls, and infrastructure security provided by our hosting providers. No method of transmission or storage is completely secure. You are responsible for protecting your account credentials, device, and access tokens. ## 10. Children and Minors Hipaths is not directed to children. We do not knowingly collect personal information from children. Users must not create, request, or generate sexualized, exploitative, or unsafe content involving minors. If you believe a child has provided personal information to Hipaths, contact support@hipaths.com and we will take appropriate steps. ## 11. International Transfers We and our service providers may process information in countries other than where you live. These countries may have different data protection laws. Where required, we use appropriate safeguards for international transfers. ## 12. App Store and Google Play Disclosures Our App Store privacy labels and Google Play Data Safety disclosures should reflect the practices described in this Privacy Policy, including collection of account information, creative inputs, generated content, purchase information, identifiers, product-interaction analytics, diagnostics, and usage or security-related data where applicable. If crash reporting, advertising, tracking, push notification SDKs, or additional third-party SDKs are added later, this Privacy Policy and store disclosures must be updated before release. ## 13. Changes to This Privacy Policy We may update this Privacy Policy from time to time. If changes are material, we may notify you through the Service, email, app store release notes, or another appropriate method. The updated policy will be effective when posted unless a later date is stated. ## 14. Contact For privacy questions, legal notices, or support, contact: Hipaths Support support@hipaths.com https://hipaths.com