Privacy
Last updated: November 8, 2026. Operated by HypeHolders ("we"). Questions or deletion requests: message @hypeholders on Instagram.
The short version
- You can play as a guest with no account. We don't ask for an email.
- If you make an account we store your username, a scrambled (hashed) password, and your game stats.
- No ads, no tracking pixels, no analytics companies, and we don't sell anything about you.
- Ask and we'll delete your account.
What we store
If you play as a guest
Nothing is saved after you leave. While you're connected, the server keeps your random guest name, your in-round wallet, and your IP address in memory (see "Anti-cheat" below). A refresh-proof "seat" token lives in your browser tab's session storage so you can reconnect mid-round; it disappears when you close the tab.
If you make an account
- Username (public, see below) and your password, stored only as a salted scrypt hash. We can't see your password.
- Game data: virtual bankroll, best balance, rounds, wins, rugs, streaks, bankruptcies, XP and level, cosmetics you own and wear, and this week's leaderboard stats.
- Login sessions: a random token in your browser's local storage. We store only a hash of it, and keep at most 10 per account.
Anti-cheat and abuse prevention
We use your IP address to keep one connection from playing against itself, to cap open tabs, and to rate-limit logins and sign-ups. IPs are held in server memory while you're connected and in short-lived rate-limit counters; we don't write them to your account.
Trade protection
To stop people trading with their own alt accounts, we keep a short list of salted, one-way hashes of the connections (IP addresses) your account has played from in the last 30 days. A hash can't be turned back into your IP address; we only compare them to block trades between accounts that share a connection.
Error reports
If the game hits a bug in your browser, it sends the error message and your browser's user-agent string to our server logs so we can fix it.
What other players see
Your username, level, title and equipped cosmetics appear in lobbies, the live feed, results, receipts and the global leaderboards, along with your round and weekly results. Receipts you choose to share go wherever you post them. The limiteds you own, their ownership history, your marketplace listings and their sale prices are public.
Third parties
- Hosting: the game runs on Railway, which processes network traffic to serve it.
- Fonts: loaded from Google Fonts, which receives your IP address when your browser requests them.
- Payments: if you buy Hype Coins, Stripe processes the payment on its own secure page under Stripe's privacy policy. We never see or store your card details. We keep a record of each purchase: which pack, the amount, when, its status (paid, refunded, disputed) and Stripe's reference IDs, so we can credit coins and handle refunds.
Kids
HypeHolders isn't directed at children under 13, and they shouldn't make an account. If you think a child under 13 has an account, contact us and we'll delete it.
Keeping and deleting data
Account data is kept until you ask us to delete it, or we remove the account. Message @hypeholders on Instagram with your username; we may ask you to prove it's yours (for example by changing your equipped badge while logged in), then delete it within 30 days. Server logs are kept for up to 30 days.
Changes
If this changes in a way that matters, we'll update the date above and say so in the game.