Legal
Privacy Policy
01About this policy
This policy explains what personal data the HYPURR.STKR app and the website hypurrstkr.xyz (together, the “Service”) collect, why we collect it, who else handles it, and how you can delete it. The Service is run by SJ Partners Co., Ltd. and works together with our Terms of Service.
02What we collect
We collect only what we need to run the Service.
| Data | What it includes | Why |
|---|---|---|
| Sign-in | Your email address, your Google or Apple account ID, and your name if Google provides it. Our login provider, Privy, holds these. Our own servers do not store your email. | To sign you in and set up the wallet the app creates for you |
| Wallets | The address of your in-app (embedded) wallet, any wallets you link to your account, and the signed messages that prove you control them | Your wallet address is your account ID. We use it to check eligibility and to connect orders to you |
| Orders and delivery | What you ordered and its status. If you choose shipping: the recipient’s name, phone number and address. If you choose event pickup: the event, and a short-lived QR ticket that our staff scan | To make, ship or hand over your stickers |
| Payments | The paying wallet, amount, token, network and transaction hash. If we submit a USDC payment for you so that you don’t pay gas, also the payment authorization you signed | To confirm payment and keep order records |
| Agreements | The license messages you sign in the app, including at checkout, with their version and time. For license signatures and orders, also the IP address and app or browser string sent with the request | To keep a record of what you agreed to |
| Notifications (optional) | Your device’s push token, platform (iOS or Android) and time zone; your notification settings and the drops you ask to hear about; and the messages in your in-app Inbox | To send order updates, the drop alerts you ask for, and snapshot reminders in your local time |
| Photo search (optional) | The cropped sticker area (up to 512 pixels) from the camera in the app or website, sent without your account details. When the camera shows the recognition-improvement notice, we keep the photo as described in section 11. Older app versions that say no photo is kept do not contribute photos | To identify the Hypurr and improve recognition |
| Support | Your email address or Telegram name and ID, and what you write to us | To answer you |
| Technical | IP addresses and basic request details in server logs; error records that may include your wallet address | To keep the Service working and to prevent abuse |
What we don’t collect
- Card or bank details. You pay on-chain from your wallet, so we never see them.
- Your private keys or seed phrase. We never ask for them, and no one legitimate will. If you export your wallet key, Privy shows it to you directly; we never see it.
- ID documents, your location, your contacts, or audio from your microphone.
We don’t use advertising, analytics or crash-reporting tools in the app or on the website, and the website sets no advertising or tracking cookies.
On your phone
- Camera — used for sticker recognition. The app does not save photos to your photo library and removes its temporary copy. Recognition photos contributed to us are kept as described in section 11.
- Face ID / Touch ID — optional quick sign-in. The check happens on your device; we never receive biometric data.
- Saved addresses — the delivery addresses you save (up to two) stay on your device. We receive an address only when you ask us to ship an order.
03Blockchain data is public
A wallet address does not show your name, but it can be linked to you if you use it
elsewhere, for example on an exchange or with a .hl name. The Service also
shows public blockchain information, such as which wallets hold Hypurr NFTs (with their
.hl names), snapshot results and recent sales. We also use snapshot records
to send holder share payments and event Vault NFTs.
04Who we share it with
We don’t sell your personal data, we don’t use it for advertising, and we don’t track you across other companies’ apps or websites.
We share data only with the service providers below, and only what each one needs to do its job. We may also disclose data when the law requires it, or to protect the Service and its users from fraud or abuse.
| Provider | What they do for us | What they receive |
|---|---|---|
| Privy | Sign-in and the in-app wallet | Email, Google or Apple account ID, wallet address |
| Google and Apple | Sign-in, and delivering push notifications (Firebase Cloud Messaging, Apple Push Notification service) | The sign-in you make with them; your push token and the notification text |
| Supabase | Database, storage and server functions (Seoul, South Korea) | Account, order, delivery and payment data |
| Contabo | Our cloud server in Japan: payments, minting, notifications and photo search | Wallet addresses, order and payment data, push tokens; search photos (not stored) |
| Cloudflare | Our domain, our support email support@hypurrstkr.xyz, edge services and secure connections to our server | Emails you send to support@hypurrstkr.xyz, push tokens and notification text, support-chat routing IDs, search photos in transit |
| Vercel | Website hosting | IP addresses and request logs |
| Telegram | Our support chat and internal alerts | Your Telegram name, ID and messages if you contact us there; previews of support emails; alerts that may include wallet addresses |
| Blockchain and IPFS services (Hyperliquid RPC, Alchemy, IPFS gateways) | Reading balances, holdings and NFT images; sending transactions | Wallet addresses and transactions; your IP address when the app contacts them directly |
| Hyperliquid Names | .hl name lookups, and free .hl names for Hypurr holders |
The wallet address or name being looked up |
| WalletConnect (Reown) | Connecting an external wallet you choose | Wallet address and connection details |
| Relay (relay.link) | Optional deposits from other chains | Your wallet address, the chain and the amount |
| Zippopotam.us | Filling in city and state from a postcode | The country and postcode you enter |
| Postal and courier services | Shipping and tracking | Recipient name, address, phone number and tracking number |
Other sites and apps you open from the Service, such as OpenSea, block explorers or Telegram, follow their own privacy policies.
05How long we keep it
- Account data (wallet links, notification settings, push tokens, license signatures): while your account exists. We delete it when you delete your account (section 6).
- Inbox messages: a message you delete is erased after 30 days, and every message is erased 12 months after it was sent.
- Delivery details: kept with your order until you delete your account. Copies held while a payment is being confirmed are cleared within 30 days.
- Order and payment records: kept for accounting and to handle disputes, including after you delete your account, but without your name, phone number, address or IP address.
- Support messages: kept in our mailbox or support chat for as long as we need them to help you.
- Logs: IP-based abuse limits are kept for about a day and internal alerts for up to 12 months. We remove your wallet address from error records when you delete your account.
- Camera recognition photos: contributed photos and their recognition records are kept for up to 12 months, then deleted (section 11). Photos from older app versions that say no photo is kept are not stored.
06Deleting your account
In the app: open .MY, tap Settings (the gear icon), then Delete account. You confirm with a free, off-chain signature from your wallet and a final slide.
By email: write to support@hypurrstkr.xyz from any device. We will confirm the request with you before deleting.
If a payment or a Vault NFT mint for your wallet is still being processed, deletion waits until it settles. Please try again a little later.
What happens
- Right away: you are signed out everywhere; your push devices, notification settings and Inbox are deleted; your wallet links are switched off; your delivery details and IP addresses are removed from your orders and records; and we ask Privy to delete your sign-in account.
- Within 7 days: the remaining records tied to your wallet, such as wallet links, pickup and shipping requests, license signatures and unfinished payment data, are erased. Until then, the same wallet cannot sign in again.
- What stays: order and payment records without your name, phone number, address or IP address (your wallet address remains as the transaction reference); a record that the account was deleted, plus a small technical record that keeps old sign-ins and push tokens switched off; and anything on the public blockchain (section 3).
07Your choices
- See, correct or delete your data: email support@hypurrstkr.xyz. We reply within 30 days and may need to check that the request comes from you. You can also delete your account in the app at any time (section 6).
- Notifications: turn each type on or off in Settings → Notifications, or turn them all off in your phone’s settings.
- Camera and Face ID / Touch ID: allow or block them in your phone’s settings. Without them, photo search and quick sign-in won’t work, but the rest of the app will.
Depending on where you live, you may have other rights under local law, including the right to complain to a data protection authority.
08Security and where data is stored
We use encrypted connections, limit who on our team can access personal data, and keep server keys and secrets out of the app. No system is completely secure, so we cannot promise absolute security. If a breach affects your personal data, we will let you know.
We are based in South Korea. Our providers store and process data in South Korea, Japan, the United States and other countries where they operate.
09Changes
We may update this policy. We will post the new version on this page with a new effective date. If a change is important, we will also tell you in the app.
10Contact
| Operator | SJ Partners Co., Ltd., Republic of Korea |
|---|---|
| support@hypurrstkr.xyz | |
| Telegram | @stkr_support_bot |
11Camera recognition photos
When you use a camera that shows the recognition-improvement notice, we keep the cropped sticker area of your photo (up to 512 pixels), the matches shown, the Hypurr you choose and the time, to improve recognition. The owner reviews these photos to help correct recognition results. Photos from older app versions that say no photo is kept are not stored.
These records are not linked to your account, wallet or device. A random identifier for each camera session and the shot number group photos from that session only; we do not attach an IP address, user agent or sign-in token to them.
We keep camera recognition photos and their records for up to 12 months, then delete them. To request deletion, email support@hypurrstkr.xyz with the approximate time and a description of the photo so we can find it.