Privacy Policy
Last updated: 10/03/2026
This policy describes what personal data HypeStation ("the Service") collects, why, and what your rights are.
1. Data controller
Arthur Nespoulous, publisher acting in a non-professional capacity for the HypeStation site.
Contact: nespoulous.arthur34@gmail.com
2. Data we collect
Account data
- Email address
- Password — stored hashed, never in plain text
- Username
- Avatar — chosen among predefined visuals (no file upload)
- Friend code (automatically generated public identifier)
Activity data
- Your verdicts / hype votes on trailers
- Followed games, lists
- Friendships, sent and received invitations
Technical data
- IP address, device and browser type, timestamps, server logs
- Session cookie (web version)
- Push notification token (mobile app), via Firebase Cloud Messaging — see §5; deleted on logout or with the account
No banking data is collected: any donations are processed by Ko-fi, which applies its own privacy policy.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Create and manage your account, provide the Service | Performance of the contract (Terms) |
| Social features (friends, invitations, verdict comparison) | Performance of the contract |
| Push notifications (new trailers…) | Consent (revocable in phone settings) |
| Security, fraud and abuse prevention | Legitimate interest |
| Aggregated and anonymized usage statistics | Legitimate interest |
4. Cookies
HypeStation only uses a strictly necessary session cookie for the app to function (staying logged in). No advertising or third-party tracking cookie is set by us: no consent banner is therefore required.
5. Recipients and processors
- Hostinger — hosting of the application servers and database, on a server located in Paris, France (European Union).
- Google — Firebase Cloud Messaging — delivery of push notifications on the mobile app. May transfer data outside the European Union; governed by standard contractual clauses and the EU–US Data Privacy Framework.
- Google — Firebase Crashlytics — crash reports for the mobile app (app and device state at the time of the crash), without account data. May transfer data outside the European Union; governed by standard contractual clauses and the EU–US Data Privacy Framework.
- Sentry (Functional Software, Inc.) — technical error reports for the website (error message, page, browser), without account data, cookies or IP address. Data stored in the European Union (Sentry EU region); any access from the United States is governed by standard contractual clauses.
- YouTube (Google) — trailers are displayed via the YouTube player and their thumbnails come from YouTube's servers. When a video is played, YouTube / Google may set cookies and collect data under its own privacy policy.
We do not sell or rent your personal data.
6. Retention periods
- Account and associated data: for as long as the account is active, then deleted immediately when the user deletes their account (cascading deletion in the database). Hype votes and verdicts are kept anonymously (with no link to the account) for the community scores. Details: account deletion.
- Technical logs: kept for a maximum of 12 months.
7. Your rights
In accordance with the GDPR, you have the right to access, rectify, erase, restrict, object to, and port your data. You can also delete your account at any time from the website or the app ("Account" page) — see account deletion.
To exercise these rights: nespoulous.arthur34@gmail.com. You can file a complaint with the CNIL (www.cnil.fr).
8. Security
Data exchanges are encrypted (HTTPS/TLS), passwords are hashed, and access to data is restricted to authorized personnel.
9. Minimum age
The Service is reserved for people aged 16 or older.
10. Changes
This policy may be modified. The last update date is shown at the top of the page; in the event of a significant change, you will be informed.