Privacy Policy

Effective date: 27 September 2026

Last updated: 6 November 2026

Publisher: T-SHAPED APPS LTD

Hype-or-Art (the "Application" or the "Service") is an iPhone app that reads the work of art in front of you. You photograph a work, and the Service recognises it and gives you an AI-generated verdict, an analysis and a spoken narration.

The Application has no accounts and never asks for your name, email address or phone number. This Privacy Policy explains what the Service does process, and why.

Our key commitments

  • We do not sell your personal information for money, and we never use your photographs, readings or position for advertising.
  • The Application shows no ads and contains no advertising SDK. It uses your device's advertising identifier only if you allow tracking in the iOS prompt, and only to learn which of our ad campaigns brought you in. Saying no changes nothing in the Application.
  • Of your photographs, only the crop of the work you choose leaves your iPhone.
  • If you allow location access, your approximate position is used for one lookup and never stored.
  • You can delete any entry in your Archive, and its photograph, analysis and narration, and what you wrote about it under "What's wrong?", are then deleted from our servers.
  • We collect only what we need to provide, secure, support and improve Hype-or-Art.

1. Who We Are and How to Contact Us

The controller responsible for your personal information is T-SHAPED APPS LTD, a private limited company registered in the Republic of Cyprus under company number HE 472504, with its registered office at Griva Digeni 51, Athineon Court, Office 202, 8047 Paphos, Cyprus ("Company," "we," "us," or "our"). T-SHAPED APPS LTD publishes and operates Hype-or-Art.

Privacy and support contact: support@hypeorart.app

Publisher website: https://hypeorart.app

EU representative: not applicable because the controller is established in Cyprus

If a notice shown at the time of collection, such as an iOS permission prompt, is more specific than this Privacy Policy, that notice controls for that processing activity.

2. Scope of This Privacy Policy

This Privacy Policy explains how we collect, use, disclose, retain and protect personal information when you:

  • download, install, access or use the Application;
  • buy or manage a pass or a subscription;
  • contact support or otherwise write to us; or
  • visit the Hype-or-Art website at hypeorart.app.

It does not govern third-party websites, applications or services that have their own privacy notices, even if they are linked from Hype-or-Art. It also does not govern information processed independently by Apple or another third party acting as its own controller.

3. Personal Information We Collect

We collect information directly from you, create some while you use the Service, and receive some automatically. Which of it we process depends on the features you use.

3.1 Information You Provide Directly

Photographs. When you photograph a work of art, or pick a picture from your photo library, the Application cuts out the work and sends only that cropped image to our service. From your library it reads only the one picture you pick. The Application keeps no copy of the full photograph, only a small thumbnail of each recent scan, and the thumbnails never leave your iPhone. Hype-or-Art is meant for photographs of works of art; if a person or other personal information appears in a crop, it is processed like the rest of the photograph.

Approximate position. If you allow location access, the Application sends your position with a scan, rounded to about a kilometre. The Application asks for your location only while you are using it.

Ratings. If you give a card or a narration a thumb up or a thumb down, the Application sends the thumb to our service as soon as you tap it. After a thumb down, the Application asks "What's wrong?"; what you type there is sent only when you send it, and is stored with the thumb. Our service stores each rating with a link to its Archive entry, your install id, whether it is about the card or the narration, the card's language, the AI models and the versions of our instructions and settings that produced what you rated, and when you first rated it and last changed the rating. A new rating of the same card or narration replaces the earlier one, together with anything written with it. Like all traffic between the Application and our service, a rating passes through Cloudflare, and it is stored in our database at Amazon Web Services. Our service does not pass it on to any AI model or other provider, and its logs do not record what you write. People on our team read what you write, and may use AI tools from our service providers to read and sort it, but we do not reply to it: to get an answer, write to support@hypeorart.app. Please leave out your name, your contact details and other personal information. After a thumb up, the Application may ask iOS to show Apple's prompt for rating Hype-or-Art in the App Store; what you do in it goes to Apple, and the Application is not told what you did.

Messages. If you write to us, we receive your email address, the content of your message and anything you attach.

3.2 Information Created When You Use Hype-or-Art

Install token and install id. On first launch our service issues the Application an install token and an install id. The token is a long random key that the Application sends with every request, so that only this install can open your Archive. The Application keeps the token and the id in the iPhone's keychain, on this device only. They are not included in backups and do not move to a new phone. Our service stores the install id and a one-way hash of the token, never the token itself, together with when the install was created and last used.

Archive entries. For each reading our service stores the crop, with its metadata such as a GPS position, the capture time and the camera model removed; two smaller copies that the Application displays; the recognised work; the analysis and the language it is written in; a scan number; and, if you ask for one, the narration audio and its script.

Usage and purchase status. Our service counts how many analyses and narrations each install has used, which enforces the free allowance and usage limits, and records whether the install has an active pass or subscription and until when.

3.3 Information Collected Automatically

When the Application connects to our service, the connection carries your device's IP address, as every internet connection does, and the Application sends your iPhone's language, which sets the language of the analysis and the narration. Our service does not store your IP address. Its logs record the technical details of each request, such as its path, status and duration, and not your photographs, your position, your IP address or your install token.

Adapty's software development kit (SDK) in the Application sends Adapty the install id, your purchases and the technical information the SDK needs to work. The Application configures it not to collect your IP address. The SDK also registers the install with Adapty Attribution, Adapty's service for telling which campaign an install came from. If you allow tracking in the iOS prompt, which the Application shows once, after your first reading, the SDK also collects your device's advertising identifier, the IDFA, and your answer to the prompt. If you do not allow it, iOS gives the Application no advertising identifier and Adapty receives none.

If the Application crashes, it sends a crash report to Firebase Crashlytics, a Google service. The report holds what the Application was doing when it stopped, such as the stack trace and the last error message, technical details of your iPhone, such as its model, iOS version, free memory and free storage, the Application's version, and your install id, so that we can find the crash next to the same install's requests in our service logs. Crashlytics also keeps a random identifier of its own for the installation. A crash report never contains your photographs, your Archive or your position.

The website collects information about visits, as described in Section 9.

3.4 Purchase Information

Passes and subscriptions are sold through the App Store. Apple processes your payment under its own privacy policy, and we never receive your payment-card details. We use Adapty to manage purchases. Adapty receives the details of your purchases, and our service asks Adapty, using your install id, whether your install has an active pass or subscription.

4. Information We Do Not Collect

We do not:

  • ask for your name, email address, phone number or date of birth, or create an account for you;
  • collect your precise location, or read your location in the background;
  • access your contacts, microphone or files, or any picture in your photo library other than the one you pick;
  • collect your device's advertising identifier unless you allow tracking in the iOS prompt;
  • collect payment-card details;
  • sell or rent personal information; or
  • use your photographs or your position for advertising.

If a future feature needs a new category of information, we will update this Privacy Policy and ask for permission or consent where required before collecting it.

5. How and Why We Use Personal Information

We use personal information only for the purposes below and only when we have a lawful basis. For users in the European Economic Area (EEA), the United Kingdom and other places with similar rules, each purpose names its basis under Article 6 of the GDPR.

  • To recognise the work you photograph, write its analysis and narration, keep your Archive and let you retry a reading, we use your photographs, your Archive entries, your install id and your language. Basis: performance of our contract with you.
  • To tell apart versions of one work by the museum that holds them, we use your approximate position. Basis: your consent, which you give or refuse in the iOS location prompt and can withdraw in Settings at any time.
  • To provide passes and subscriptions and apply the free allowance, we use your install id, purchase status and usage counters. Basis: performance of our contract with you.
  • To keep the Service secure and prevent abuse, including through usage limits, we use the install token hash, install id, usage counters and request logs. Basis: our legitimate interests in a safe and reliable Service.
  • To find and fix crashes, we use crash reports and your install id. Basis: our legitimate interests in an Application that works.
  • To test and improve how Hype-or-Art recognises works and prepares images, we may look at stored crops. Basis: our legitimate interests in improving the Service. You can object, as described in Section 14.
  • To see whether cards and narrations are getting better, and what goes wrong in them, we read the ratings you give and count thumbs by the AI models and versions that produced what was rated. We may use AI tools from our service providers to read and sort what you write. Basis: our legitimate interests in improving the Service. You can object, as described in Section 14.
  • To answer your messages, we use what you send us. Basis: performance of our contract with you, or our legitimate interests in supporting users.
  • To learn which of our ad campaigns brought you to Hype-or-Art, Adapty registers your install and links it to your purchases. Basis: our legitimate interests in measuring our own advertising. If you allow tracking, it also uses your device's advertising identifier. Basis for that: your consent, which you give or refuse in the iOS tracking prompt and can withdraw in Settings at any time.
  • To understand how the website is used, we use the website analytics described in Section 9. Basis: our legitimate interests in running the website.
  • To comply with law and to establish or defend legal claims, we use the information relevant to the obligation or claim. Basis: legal obligation or our legitimate interests.

Where we rely on legitimate interests, we weigh them against the impact on your rights.

6. AI Processing and Automated Decisions

Our service sends your crop to Google's Gemini API, which recognises the work and writes the analysis in English. When the analysis is to be shown in another language, our service sends its text to OpenAI's API, which translates it. When you ask for a narration, our service sends the analysis text to OpenAI, which writes the narration script and, for another language, translates it, and then our service sends the script to Gemini to speak it. These translation and narration steps send only text, never your photograph, your position or your install id. To pin down which work it is, our service also looks up the recognised artist and title in Wikidata, a public knowledge base, and reads the work's article in the English Wikipedia. Wikidata and Wikipedia receive only those names, never your photograph or your position.

These outputs are generated by AI and may be incomplete or wrong. When a work is recognised with high confidence, we may reuse the analysis written about it for other people who photograph the same work. What is reused is text about the work. Your photograph, your Archive entry and your install are never part of it.

Hype-or-Art does not use automated processing to make decisions that produce legal effects or similarly significant effects concerning you.

7. How We Disclose Personal Information

We disclose personal information only as described below and only as far as reasonably necessary.

Service providers and processors. We use the providers listed in Section 7.1 for hosting, storage, content delivery, AI processing, purchase management and email. They may process information only under contract and for the services they provide to us.

Apple. Apple sells passes and subscriptions and processes the related information as its own controller.

Advertising networks. Only if you allow tracking, Adapty passes your advertising identifier and the fact of an install or purchase to the advertising networks that run our campaigns, so they can tell us which campaign brought you in. Each network processes this under its own privacy policy. They never receive your photographs, readings, position or install id.

Professional advisers. We may disclose limited information to lawyers, auditors, insurers, accountants and security specialists subject to confidentiality obligations.

Legal and safety reasons. We may disclose information if we reasonably believe disclosure is necessary to comply with a binding legal obligation, court order or valid government request; enforce our terms; detect or prevent fraud or security incidents; or protect the rights, safety and property of users, the public or the Company. We review requests for legal validity, scope and jurisdiction and seek to disclose only what is legally required.

Corporate transactions. Information may be disclosed in connection with due diligence, financing, reorganization, merger, acquisition or sale of assets, subject to appropriate confidentiality and data-protection safeguards. A successor may use personal information only consistently with this Privacy Policy unless it gives notice and obtains any required consent.

We may disclose aggregated or de-identified information that cannot reasonably be linked to you.

7.1 Current Service-Provider Schedule

A provider receives information only when the feature it serves is used.

  • Amazon Web Services runs our service and its database in its us-east-1 region in the United States. It holds your install record, your Archive entries apart from their images and audio, your ratings, and our service logs.
  • Cloudflare carries the traffic between the Application and our service, stores crops, their smaller copies and narration audio in Cloudflare R2, caches the copies and audio, and forwards email sent to our support address to our support mailbox.
  • Google, through the Gemini API, recognises works, writes analyses in English and speaks each narration script as narration audio. It receives the crops you send and the scripts it speaks, and processes them as our service provider under the Gemini API's paid-service terms, which do not let Google use that content to improve its products. Google may keep it for a limited time to monitor for abuse.
  • OpenAI, through the OpenAI API, translates analyses from English into other languages, and writes narration scripts and translates them. It receives the text of analyses, the scripts it translates and, to translate a script, the analysis in your language, and processes them as our service provider under OpenAI's API terms, under which OpenAI does not use that content to train or improve its models. OpenAI may keep it for up to 30 days to monitor for abuse, and longer only where the law requires it or to protect its services or others from harm.
  • Anthropic provides the AI models our team uses to read and sort what you write under "What's wrong?". It receives those texts and the details of the ratings they come with, and processes them as our service provider on a plan under which Anthropic does not use them to train its models. Anthropic keeps what it receives for as long as its terms for that plan provide.
  • Adapty manages passes and subscriptions. It receives your install id, your purchases and technical information from its SDK, and your advertising identifier if you allow tracking.
  • Google, through Firebase Crashlytics, receives crash reports from the Application, with your install id, and keeps them for 90 days.
  • Netlify hosts the website and runs its analytics endpoint. It receives website requests, including IP addresses, and the website analytics events described in Section 9.
  • Apple sells passes and subscriptions through the App Store, as an independent controller.

Wikidata and Wikipedia, both operated by the Wikimedia Foundation, receive the names of recognised artists and titles, and nothing about you. Providers outside the EEA process information under the safeguards described in Section 10.

8. Sale, Sharing, and Targeted Advertising

We do not sell personal information for money. If you allow tracking in the iOS prompt, we disclose your device's advertising identifier and the fact of an install or purchase, through Adapty, to the advertising networks that run our campaigns. Depending on the law that applies, that disclosure may qualify as "sharing" for cross-context behavioral advertising or as targeted advertising. We never disclose your photographs, readings or position for advertising, and the website loads no advertising or third-party tracking scripts.

You control this on your iPhone. Say no in the tracking prompt, or turn tracking off for Hype-or-Art later in Settings > Privacy & Security > Tracking, and the Application gets no advertising identifier from then on. You can also opt out of a qualifying sale, sharing or targeted advertising by emailing support@hypeorart.app with the subject line "Do Not Sell or Share My Personal Information".

9. The Website, Cookies, and SDKs

The Application contains two third-party SDKs that handle personal information: Adapty's, for purchases and, if you allow tracking, for measuring our ad campaigns, and Google's Firebase Crashlytics, for crash reports, as described in Sections 3.3 and 8.

The website at hypeorart.app is hosted by Netlify. It counts visits with its own first-party analytics. It stores a random identifier in your browser's local storage and a visit identifier in session storage, and records the pages you view, how far you scroll, which sections you see, the site language, the page that referred you and any campaign parameters in the address. Our server adds your IP address and country before passing these events to our analytics service. The website loads no third-party analytics, advertising or tracking scripts.

In the EEA, the United Kingdom and some U.S. states, the website shows a cookie banner. It stores your choice in a cookie named hypeorart_cookie_choice for up to one year.

You can remove the identifiers by clearing your browser's data for the website. The website does not respond to "Do Not Track" browser signals because no uniform standard applies.

10. Data Storage and International Transfers

Your install token and id, and the thumbnails of recent scans, are stored on your iPhone. The rest of the information described in this Privacy Policy is stored by us or our service providers. Our service and its database run on Amazon Web Services in the United States, and our providers operate in the United States and other countries.

If personal information is transferred from the EEA, United Kingdom or Switzerland to a country that has not been recognized as providing an adequate level of protection, we use an approved transfer mechanism where required, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, or another lawful safeguard. We also assess supplementary technical and organizational measures where appropriate.

You may request information about the relevant transfer safeguard by contacting support@hypeorart.app.

11. How Long We Retain Information

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Service, honor your choices, maintain security, resolve disputes and comply with legal obligations.

In particular:

  • Archive entries, with their crop, smaller copies, analysis and narration, are kept until you delete them. They do not expire, and deleting the Application does not delete them.
  • Deleting an entry removes it from our database, deletes its images and audio from storage and clears them from Cloudflare's cache.
  • While its entry exists, a rating is stored with a link to that entry. Deleting the entry deletes what you wrote under "What's wrong?" and the rating's link to the entry. The thumb stays in our database for as long as we operate the Service, with your install id, whether it was about the card or the narration, the card's language, the AI models and versions that produced what you rated, and when you first rated it and last changed the rating, so that our count of what works does not change when entries are deleted. The install id stays so that many ratings from one install count as one person's view rather than many people's.
  • A "What's wrong?" text that our team has already read and sorted with Anthropic's AI models also exists outside our database, with Anthropic. Deleting the entry does not delete that copy: Anthropic keeps it for as long as its terms provide, as described in Section 7.1.
  • If a scan fails before its analysis is ready, we keep the crop for 24 hours so that you can retry, and then delete it.
  • Your approximate position is not retained. Our service discards it once the scan is answered.
  • The install record, with its install id, token hash, usage counters and purchase status, is kept while we operate the Service. It is not deleted automatically when an install stops being used.
  • An analysis reused for other people who photograph the same work does not identify you and may be kept after you delete your own entry.
  • Our service logs are kept for 30 days.
  • Crash reports are kept by Firebase Crashlytics for 90 days.
  • Database backups are kept for seven days, so the database record of a deleted entry, and the text of a rating that was deleted or replaced, can remain in a backup for up to a week.
  • Support emails are kept for as long as reasonably necessary to respond, document the resolution, handle a dispute or comply with law.

12. Security

We use technical and organizational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. They include:

  • encryption in transit between the Application, the website and our service;
  • storing only a one-way hash of each install token;
  • keeping original crops in a storage bucket with no public access, separate from the one that serves the smaller copies;
  • an encrypted database;
  • access controls that limit our service to its own configuration and secrets; and
  • request logs that leave out photographs, positions, IP addresses and tokens.

No system is completely secure. You are responsible for protecting your iPhone. Please tell us at support@hypeorart.app if you believe your information has been compromised.

If a breach occurs, we will investigate and give notice to affected individuals, regulators or others when required by applicable law.

13. Your Controls and Choices

You can:

  • delete any entry in the Archive, which deletes its photograph, analysis and narration, and what you wrote about it under "What's wrong?", from our servers;
  • allow, refuse or later turn off camera, photo library and location access in the iPhone's Settings; scans work without location access;
  • manage or cancel a subscription in your App Store account settings; and
  • write to support@hypeorart.app with any other request.

Deleting the Application from your iPhone does not delete your Archive from our servers and does not cancel a subscription. Delete the entries you want removed before you delete the Application, because afterwards the Application may no longer be able to reach them.

Because there are no accounts, we cannot find your data by your name or email address. If you ask us for access to, or deletion of, data that you cannot reach in the Application, tell us what you can about it, such as the dates and the works, and we will act on the request as far as we can identify the data it concerns.

14. Privacy Rights in the EEA, United Kingdom, and Switzerland

Subject to applicable law and exceptions, you may have the right to:

  • obtain confirmation of whether we process your personal information and receive a copy;
  • correct inaccurate or incomplete information;
  • request deletion of personal information;
  • restrict processing;
  • object to processing based on legitimate interests, including our review of stored crops;
  • receive information you provided in a structured, commonly used, machine-readable format and transmit it to another controller where technically feasible;
  • withdraw consent at any time, without affecting prior lawful processing;
  • receive meaningful information about qualifying automated decision-making; and
  • lodge a complaint with your local data-protection authority.

To exercise a right, contact support@hypeorart.app. We may ask for information reasonably necessary to confirm that the data concerns you; without an account, that usually means details of the entries in question. We will respond without undue delay and within the period required by applicable law, generally one month under the GDPR, subject to a permitted extension for complex or numerous requests.

You may complain to the supervisory authority in the country where you live, work or believe an infringement occurred. The supervisory authority for the Company in Cyprus is the Office of the Commissioner for Personal Data Protection, 15 Kypranoros Street, 1061 Nicosia, Cyprus; https://www.dataprotection.gov.cy.

15. United States Privacy Rights

Residents of certain U.S. states may have rights to know or access, correct, delete or obtain a copy of personal information; opt out of sale, targeted advertising or qualifying profiling; limit certain uses of sensitive personal information; withdraw consent; and appeal a denied request.

We do not discriminate against you for exercising a privacy right. To submit a request, contact support@hypeorart.app. We may ask for information reasonably necessary to confirm that the data concerns you. An authorized agent may submit a request when permitted by law, but we may require proof of authorization and may verify the request directly with you.

We respond within the time required by applicable law. For qualifying California requests, this is generally within 45 days, subject to a legally permitted extension. If we deny a request and your state provides an appeal right, you may appeal by contacting support@hypeorart.app with the subject line "Privacy Appeal."

15.1 California Notice at Collection

We collect the following categories of personal information, for the purposes described in Section 5, and disclose them as described in Section 7:

  • Identifiers: install id; your device's advertising identifier, if you allow tracking; and, as received by our providers, IP address.
  • Commercial information: pass and subscription status and purchase details.
  • Internet or other electronic network activity: website visits, as described in Section 9, and the ratings you give in the Application, with anything you write with them.
  • Geolocation data: approximate position rounded to about a kilometre, used for one lookup and not stored.
  • Audio, electronic or visual information: the photographs you send and the narration audio generated for you.

We do not sell personal information for money. If you allow tracking, the advertising identifier and install and purchase events are shared for cross-context behavioral advertising as described in Section 8, and you can opt out as described there. We do not use sensitive personal information to infer characteristics about you. Retention periods are described in Section 11.

California residents may also request information about certain disclosures for third parties' direct-marketing purposes under California's "Shine the Light" law. Because we do not disclose personal information to third parties for their own direct marketing, we have no such disclosures to report.

16. Children

Hype-or-Art is not directed to children under 16. Under the Terms, a person under 16 may use it only with a parent's or legal guardian's agreement, and we do not knowingly collect personal information from children under 16 without it.

Because there are no accounts, we do not know a user's age. A parent or guardian who believes a child has used Hype-or-Art can delete the child's entries in the Archive on the child's iPhone, or contact support@hypeorart.app.

Age thresholds and parental-consent rules differ by jurisdiction. Where local law sets a higher minimum age or requires additional age-assurance or parental-consent steps, those rules apply.

17. Third-Party Services and Links

Hype-or-Art may link to third-party content or services. We do not control those third parties' privacy or security practices. Review their notices before providing information. Linking to a service does not mean that we endorse its privacy practices.

18. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to Hype-or-Art, our data practices or applicable law. We will post the updated policy and revise the "Last updated" date. If a change materially affects how we use personal information or reduces your rights, we will give additional notice through the Application or the website and ask for consent where required.

Your continued use of Hype-or-Art after an update does not replace consent where the law requires fresh consent.

19. Contact Us

Questions, concerns or privacy requests may be sent to:

T-SHAPED APPS LTD

Griva Digeni 51, Athineon Court, Office 202

8047 Paphos, Cyprus

Registered in the Republic of Cyprus, company number HE 472504

Privacy, support, rights requests, appeals and security reports: support@hypeorart.app

Publisher website: https://hypeorart.app

Please do not send photographs of other people or other sensitive information by email unless your request needs it.