Legal

Odyset AB, org. nr 559597-0434, with its registered address at Svärdvägen 21, 182 33 Danderyd, Sweden, is the data controller responsible for the personal data processed under this Privacy Policy.

For privacy, legal, or other enquiries, contact us at hello@odyset.com.

We store your connected Instagram username and the Instagram usernames you add to your private Hintmo spots.

We also store basic account identifiers from the sign-in provider you use, such as Apple or Google. This typically includes a user ID and, where provided, your email address.

If you use Hintmo Plus, we store subscription metadata such as your subscription status and product ID. Payments are handled by the App Store or Google Play, and we do not see or store your card details.

If you submit a report, we store the information needed to review and act on that report.

When you confirm that you are 18 or older, we store that confirmation together with limited technical information, such as your IP address and browser or device information, to record that the age confirmation was made.

Our hosting and infrastructure providers may also process limited technical information, such as IP addresses, device or browser information and request logs, where necessary for security, fraud prevention and service reliability.

We do not use advertising trackers, ad networks, session replay tools, or third-party analytics. We never sell the Instagram usernames in your private Hintmo spots or share them for advertising, marketing or profiling. They are only revealed to another user when a match is created according to the Terms of Service. We do not use your data to train AI models — ours or anyone else's. We do not use your data for advertising profiles or personalized targeting.

We do not send marketing emails or promotional notifications. We may send security alerts, legal notices, material changes to this Privacy Policy, or other important service-related messages about Hintmo. We never send messages about specific people or activity inside Hintmo.

For normal Hintmo users, sign-in sessions are stored locally in the app or browser using local storage. Hintmo does not use cookies for user sign-in, analytics, advertising, or tracking.

A strictly necessary temporary cookie may be used only for access to Hintmo's internal admin tools. This cookie is not used for ordinary users and is not used for analytics, advertising, or tracking.

A small number of service providers help us operate Hintmo. Primary application data is hosted in the EU, while some limited operational data may be processed by these providers in other countries depending on the service used.

• Lovable Cloud, powered by Supabase, for database and authentication, with primary application data hosted in the EU.
• Lovable, for application hosting and operational infrastructure.
• Cloudflare, for content delivery, request routing and related infrastructure.
• Apple and Google, as sign-in providers, depending on which sign-in method you choose.
• Apple App Store and Google Play, for subscription billing.
• RevenueCat, for managing subscription status and purchase entitlements for Hintmo Plus.

Where personal data is transferred outside the EEA, we rely on applicable safeguards such as adequacy decisions or standard contractual clauses where required by law.

The Instagram usernames in your Hintmo spots are never shown to anyone else as a list.

A username is only revealed when a match is created according to the rules described in the Terms of Service. If no match is created, the other person is never told that you added them.

For the full match rules, see How matches work in the Terms of Service.

We process personal data under GDPR on different legal bases depending on the purpose:

Contract (Art. 6(1)(b)) — to provide Hintmo and the features you sign up for, including account access, matches and Hintmo Plus.

Legal obligation (Art. 6(1)(c)) — where we are required to process data to comply with applicable laws.

Legitimate interests (Art. 6(1)(f)) — to keep Hintmo secure, prevent abuse, enforce cooldowns and protect the service from misuse.

For Hintmo Plus, subscription-related data is also processed as necessary to perform the subscription contract.

Under GDPR, depending on the circumstances, you may have the right to access your personal data, correct inaccurate data, receive a copy of your data, request deletion, restrict certain processing, object to certain processing, or withdraw consent where processing is based on consent.

Hintmo does not use automated profiling or advertising personalization.

You can delete your account, your connected Instagram username and your Hintmo spots directly from Settings. For other privacy requests, contact us at support@hintmo.com. We will respond within the time required by applicable law, normally within 30 days.

You also have the right to lodge a complaint with your national data protection authority.

When you delete your account, your personal data is removed from the live app once the deletion has been processed.

Backup copies are removed through normal backup rotation within 30 days.

The limited anti-abuse data described below is kept separately for 100 days and then deleted automatically.

Your age-confirmation record is kept while your account exists and for the 100-day anti-abuse period after deletion, after which it is deleted automatically.

To prevent someone from immediately recreating an account and taking over an Instagram username that was recently connected to another Hintmo account, we keep a small amount of information for 100 days after deletion.

Your connected Instagram username is reserved for 100 days. During that period, it cannot be connected to another Hintmo account. Instagram usernames you had added to your Hintmo spots are not reserved and can be connected by their real owner immediately.

A one-way cryptographic hash (SHA-256) of your email address and the account identifier from your Apple or Google sign-in is kept for 100 days. It is used only to recognise and refuse a new signup from the same identity during the cooldown period.

After 100 days, this anti-abuse data is deleted automatically.

Legal basis: our legitimate interests in preventing abuse and protecting Hintmo (GDPR Art. 6(1)(f)).

Reporting, moderation and account suspension are governed by the Terms of Service above.

If you believe your Instagram username is being misused on Hintmo, contact us at support@hintmo.com. We will review the request and may ask you to verify that you control the Instagram username before we take action.

If we remove or transfer a username following a valid report, the affected user will only see that the username is no longer connected to their account or Hintmo spot. We do not disclose who submitted the report or why.

If we restrict or remove your account, you can appeal the decision by contacting support@hintmo.com.

Hintmo is for people aged 18 and older, as set out in the Terms of Service.

We rely on self-confirmation at sign-in, together with the age-rating controls provided by the App Store and Google Play. We prioritise reports involving minors and aim to review them promptly.

If we learn that an account belongs to someone under 18, we remove the account and apply the standard 100-day re-signup cooldown.

If you are a parent or guardian and believe your child has created a Hintmo account, or if you suspect that any user is under 18, report it from inside Hintmo or contact us at support@hintmo.com.

If we make material changes to this Privacy Policy, we will notify you inside Hintmo before the updated policy takes effect.

Where applicable law requires your consent for a change, we will ask for it before the relevant processing begins.