Privacy Policy

Last Updated: November 4, 2026

HmMaybe ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application HmMaybe (the "App").

Please read this Privacy Policy carefully. By using the App, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address - Used for account identification and communication
• Apple ID information - If you sign in with Apple, we receive your Apple ID identifier and optionally your name and email (as you choose to share)

1.2 Wishlist Content

When you use the App, we store:

• Wishlist items - Product names, descriptions, prices, categories, and notes you enter
• Images - Screenshots and photos you save to your wishlist
• OCR-extracted text - Text automatically extracted from your images to enable search functionality
• Product identifiers - Barcodes, QR codes, and SKUs you scan or that are extracted from images
• Source URLs - Links to products you save from social media or websites
• Tags - Custom labels you create to organize your items

1.3 Location Data

With your permission, we may collect:

• Discovery location - Where you were when you saved an item (latitude, longitude, address)
• Store information - Store name and chain where you discovered a product

Location data is only collected when you actively save items and have granted location permission. You can disable location access at any time in your device settings.

1.4 Device Information

We collect:

• Push notification tokens - To send you price alerts and other notifications you've enabled
• Device identifiers - For authentication and security purposes

1.5 Purchase Information

For subscription management:

• Subscription status - Whether you have an active Pro subscription
• Transaction identifiers - To verify purchases with Apple

We do not receive or store your payment card information. All payments are processed securely by Apple through the App Store.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the App
• Sync your wishlist across your devices
• Enable search functionality using OCR-extracted text
• Send push notifications for price alerts and updates (when enabled)
• Process and manage your subscription
• Respond to your inquiries and provide customer support
• Detect and prevent fraud or abuse
• Comply with legal obligations

3. Data Storage and Security

3.1 Where We Store Your Data

Your data is stored using our application backend on Neon Postgres, with encrypted transport and managed infrastructure controls.

• Encryption at rest and in transit
• Application-level access controls so users can only access their own data
• Operational monitoring, backups, and managed infrastructure

Images are stored in secure cloud storage with access controls that prevent unauthorized access.

3.2 Local Storage

We also store a local copy of your data on your device to enable offline access. This data is protected by your device's security features (passcode, Face ID, Touch ID).

3.3 Security Measures

We implement industry-standard security measures including:

• HTTPS encryption for all data transmission
• Secure authentication via Apple Sign In or email/password
• Row-level security policies in our database
• Regular security updates and monitoring

4. Data Sharing

We do not sell, rent, or trade your personal information. We may share your information only in the following circumstances:

4.1 Service Providers

• Neon - Managed PostgreSQL infrastructure
• Railway - Application hosting and backend runtime
• Apple - App Store, Sign in with Apple, and push notifications

4.2 Product Lookups

When you scan a barcode, the App sends only that barcode to our server, which looks it up in public product data. These services receive at most a barcode or public product text, never your account, your wishlist, your photos, or any other personal data:

• Open Food Facts and Open Beauty Facts - Our server asks these public product databases for the scanned barcode. When they have a photo of the product, the App downloads it from their image servers (images.openfoodfacts.org and images.openbeautyfacts.org), which see the ordinary web request your device makes, including its IP address.
• USDA FoodData Central - We keep a copy of its public Branded Foods data on our own server, so nothing is sent to USDA.
• Anthropic - Reads the ingredient text that Open Food Facts and Open Beauty Facts publish for their own product photos, when our parser cannot, so a product's ingredient list can be filled in. Only that public product text is sent: never your photos, your wishlist, the barcodes you scan, or any personal data.
• Commercial barcode databases - If we turn on a fallback for barcodes the public databases do not know, our server may send that barcode to EAN-Search or UPCitemdb, for signed-in users only. Only the barcode is sent.

4.3 Legal Requirements

We may disclose your information if required by law, court order, or government request, or to protect our rights, property, or safety.

4.4 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

5. Your Rights and Choices

5.1 Access and Portability

You can access and export your wishlist data at any time through the App's settings.

5.2 Correction

You can update or correct your information directly in the App.

5.3 Deletion

You can delete individual items from your wishlist at any time. To delete your entire account and all associated data, please contact us or use the account deletion option in the App settings.

5.4 Notifications

You can manage push notification preferences in the App settings or your device settings.

5.5 Location Data

You can disable location collection by denying location permission in your device settings.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide you services. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal purposes.

7. Children's Privacy

The App is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us, and we will delete such information.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. By using the App, you consent to the transfer of your information to these countries.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

10. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

11. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know whether your personal information is sold or disclosed
• Right to opt out of the sale of personal information (we do not sell your data)
• Right to request deletion of your personal information
• Right to non-discrimination for exercising your privacy rights

To exercise these rights, please contact us at privacy@hmmaybe.com.

12. European Privacy Rights

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent

To exercise these rights, please contact us at privacy@hmmaybe.com.