Privacy Policy

This policy was last updated on 9 November 2026.

This policy explains what personal data HyPoster collects, why we collect it, who we share it with and what choices you have. We have tried to keep it short and specific to how the service actually works.

1. Who we are

HyPoster (hyposter.com) is operated by Baojun Han, an individual. We are the controller of the personal data described in this policy. You can reach us about privacy at support@hyposter.com.

2. What we collect

Account details: Your email address, both as you typed it and in a normalised form (for example, without Gmail dots or a “+tag”) that we use to make sure one inbox has only one account. Also your interface language, when you signed up and last signed in, and your account status. If you sign in with Google, also your Google account ID.
Sign-in codes: A one-time code is stored only in hashed form. It expires after a few minutes and is deleted once used.
Network and device information: Your IP address and its network range (the /24 block for IPv4, or the /64 block for IPv6) when you sign up and whenever you request a sign-in code. A random device ID that your browser creates and stores on your device, sent to us with your requests. For each signed-in session, the IP address and your browser’s user agent. Our server access logs also record the IP address and account ID of requests.
What you create: The requests you type, your answers to follow-up questions and your edit instructions; the design strategy, brief and image prompt that our AI writes for you; the generated images; the model and size you chose; and the results of our automatic text check. If you make a poster public, anyone with the link can see the image and its name until you unpublish it.
Assets you upload: The logos, product photos and other images you upload to your asset library, their names, dimensions and colors, and the text description of each image written by our vision model. We re-encode the images and remove EXIF data, such as where a photo was taken.
Points and payments: Your points balance and history, orders (pack, amount, currency, status and Creem reference) and the redeem codes you used. Card and other payment details are entered on Creem’s pages and handled by Creem and its payment partners. We never see your full card number.
Security and anti-abuse records: Records of sign-ups, code requests and gift-point grants, together with IP address, network range and device ID, and risk flags on accounts (for example, when gift points were withheld because the same device or network had already received them). Counts of asks, free re-layouts and cancellations, used to apply usage limits.
Messages: What you send us when you email support.

We do not ask for passwords, your real name, phone number or precise location, and we do not use advertising identifiers.

3. How we use your data

To provide HyPoster: signing you in, generating posters, keeping your past posters and your points balance. Legal basis where the GDPR applies: performance of our contract with you.
To prevent abuse and keep the service secure: limits per device, IP address and network, a daily budget for free gift points, bot checks, and blocking accounts that break our terms. Legal basis: our legitimate interest in protecting the service and keeping the free offer fair.
For billing and accounting: processing payments, refunds and tax records. Legal basis: contract and legal obligation.
To communicate with you: sending sign-in codes, important service notices and replies to your messages. Legal basis: contract and legitimate interest.
To comply with the law and to enforce our Terms of Service.

We do not sell your personal data, we do not show ads, and we do not use your content to train AI models. Whether a new account receives gift points is decided automatically, based on the device, IP address and network signals above. This only affects free points. If you think a decision was wrong, email us and a person will review it.

4. How AI processing works

When you make a poster, your request, your answers and the brief written by our AI are sent through OpenRouter to the text and image model providers needed to produce it, such as ByteDance Seed, Google and Alibaba Qwen. Planning and text-checking steps use text and vision models from providers such as OpenAI, Anthropic and Google. For variations and edits, the earlier image is sent as well. The generated image is also sent to a vision model to check its text.

When you choose assets for a poster, product photos and reference photos are sent to the image model, and every chosen asset is sent to a vision model to read its content. By default a logo is also sent to the image model, so it can be printed on an object in the picture. If you choose sign-off only, it is not sent. Either way, our own software places your original logo on the poster.

These providers process the data to return a result, under their own terms. Some may keep it for a limited time, for example to monitor abuse. We ask OpenRouter to use only providers that do not collect prompts for training. Please do not include sensitive personal data, such as health information or other people’s private details, in your requests.

We share personal data only with service providers that help us run HyPoster, and only as much as they need:

OpenRouter and AI model providers: your requests, AI briefs and images, as described above.
Creem: your email address, billing details and order details when you pay. Creem is our merchant of record. It processes your payment details and the related taxes, and may act as an independent controller for some purposes, such as fraud prevention. When you ask or make a poster, Creem also receives the text of your request and your account ID before generation, to check it against the content policy.
Cloudflare: the Turnstile bot check on the sign-in form receives your IP address and browser signals. Cloudflare also delivers our website, so your traffic passes through its network.
Google: if you choose to sign in with Google, Google confirms who you are and gives us your email address and an account ID. We use them only to sign you in and do not read any other Google data.
Email delivery provider: your email address and sign-in code, so the code can reach you. We use Resend.
Hosting provider: stores our database and generated images. We use Vultr, with servers in the United States.
Google Fonts: our pages load fonts from Google’s servers, so Google receives your IP address and browser information when a page loads.

We may also disclose data when the law requires it, to protect people’s safety or our rights, or to a successor if HyPoster is sold or merged, in which case this policy continues to protect your data.

6. Cookies and local storage

hp_session (cookie): Keeps you signed in. It is an httpOnly cookie, so scripts on the page cannot read it. It lasts 30 days, or until you sign out.
hp_lang (local storage): Remembers your interface language.
hp_device (local storage): A random device ID used to prevent abuse of free points. It stays until you clear your browser’s data for our site.
hp_oauth (cookie): Protects the sign-in when you use Google. It lasts up to 10 minutes and is removed when sign-in finishes.
hp_login_draft (session storage): Holds the request you were writing while you sign in with Google, then puts it back and is removed.

Cloudflare Turnstile may use its own technical storage while it runs the bot check. We do not use advertising or analytics trackers. Everything above is needed for the service to work and to protect it, so we do not show a cookie banner.

7. International transfers

We and our service providers process data in several countries, including the United States, and model providers may process requests in other countries where they operate. Where the law requires it, we protect these transfers with appropriate safeguards, such as the European Commission’s standard contractual clauses. You can ask us for more information about them.

8. How long we keep data

Uploaded assets: until you delete them from your library or delete your account.
Account details: for as long as your account exists.
Requests, AI briefs and generated images: until you delete them or delete your account. A second option you never picked is deleted automatically 30 days after it was made.
Sign-in codes: until used or expired, after a few minutes.
Sessions: 30 days, or until you sign out.
Server access logs: overwritten automatically once they reach a storage limit.
Security records (IP addresses, network ranges, device IDs and events): up to 12 months. After an account is closed, we may keep a minimal record, such as a keyed hash of the normalised email address (not the address itself) and the device ID, for the same period to stop repeated sign-ups for free points.
Payment records: as long as tax and accounting laws require. This is usually up to 7 years.
Backups: deleted data disappears from backups within 30 days.

9. Your rights

Depending on where you live, you may have the right to access your personal data, correct it, delete it, receive a copy in a portable format, object to or restrict certain processing, and withdraw consent where we rely on it. You can also complain to your data protection authority.

To use these rights, email support@hyposter.com from the email address of your account, so we can confirm it is you. We will reply within one month, or sooner if the law where you live requires it.

You can delete a single poster or your whole account yourself on your account page, or email us to do it. Deleting a poster removes its image file and the text of its request and brief. Deleting your account does the same for all your posters, signs you out on every device and removes your email address from the account record. We keep points history and orders for accounting, no longer linked to your email address, and security records for the limited period above. Creem keeps its own payment records. Images you have already downloaded, and copies in a browser cache, are outside what we can delete.

European Economic Area and United Kingdom: you have the rights listed above under the GDPR and UK GDPR, including the right to complain to your local supervisory authority.
Japan: under the APPI you can ask us to disclose, correct, stop using or delete your data. Data provided to service providers outside Japan is described in sections 5 and 7.
South Korea: under the PIPA you can ask to access, correct or delete your data, or to suspend its processing. Overseas transfers are described in sections 5 and 7. Recipients are listed in section 5 and are located in countries including the United States. Data is sent over encrypted connections when you use the service.
California: you can ask to know, delete and correct your personal information. We do not sell your personal information or share it for cross-context behavioural advertising, and we will not treat you differently for using your rights.
Other regions: if the law where you live gives you further rights over your personal data, we will respect them too. Email support@hyposter.com to use them.

10. Security

We use HTTPS, store sign-in codes and session tokens only in hashed form, keep the session cookie out of reach of page scripts, and limit who can access our systems. No system is completely secure. If a breach affects your data, we will notify you and the authorities as the law requires.

11. Children

HyPoster is not intended for anyone under 16, or under the age of digital consent where they live if that is higher. If we learn that we have collected data from a child, we will delete it.

12. Changes to this policy and language versions

We may update this policy. If a change is significant, we will let you know by email or in the product before it takes effect.

This policy is published in Simplified Chinese, Traditional Chinese, English, Japanese, Korean, French, German, Spanish and Russian. If the versions differ, the English version prevails, unless the law where you live requires otherwise.

13. Contact us

Baojun Han
Email: support@hyposter.com