Privacy Policy

Hub Data, Inc. is the data controller for personal information collected through the Services.

For questions about this Policy or to exercise your privacy rights, contact us at the email above.

We collect the following categories of personal information when you use the Services:

2.1 Account information

• Email address
• OAuth identifiers (Google or Discord) when you sign in via a third-party provider
• Username and password (if you create an account with email/password)
• Date of account creation

2.2 Profile information (provided by you)

• Age, gender, height
• Skin tone, hair color, eye color
• Languages spoken
• Education level, job, skills
• Country and region
• Any other profile fields you choose to complete

This information is optional but enables eligibility for a broader set of tasks. You control what you share and can edit or delete profile fields at any time.

All physical descriptors (such as skin tone, hair color, and eye color) are voluntarily self-reported by you and are not derived through biometric analysis, facial recognition, or any automated measurement.

2.3 Identity verification information (KYC)

• If you choose to verify your identity, we use Didit, a third-party KYC provider, to perform verification.
• During verification, Didit collects identity documents (government ID, selfie, liveness check) and processes them on our behalf.
• Hub does not store your identity documents. We only store the verification status (verified / not verified) and the date of verification.
• For Didit's own privacy practices, see https://didit.me/privacy.

2.4 Uploaded content

• Photos, videos, and other media you submit through the App as part of completing tasks
• Descriptions, captions, bounding boxes, and metadata you add to uploads
• Egocentric video recordings made within the App
• Motion sensor data: accelerometer, gyroscope and device-orientation readings captured while you record, stored alongside the video so each take can be checked against your head movement.
• Microphone audio: the sound recorded with each video, so the dataset keeps the full context of the task.
• Equipment metadata you provide (camera model, device used)

2.5 Camera and camera roll access

• When you choose to upload from your camera roll, the App accesses photos you select. We do not access photos you have not selected.
• When you use in-app capture (camera or video recording), the App accesses your device's camera while recording.
• You can revoke these permissions at any time in your device settings.

2.6 Location information

• For certain egocentric tasks, the App may request access to your device's location to verify task context (e.g., recording in a specific environment).
• Location access is only requested when needed and only with your explicit permission.
• You can revoke location access at any time in your device settings.

2.7 Device and technical information

• Device model and manufacturer (e.g., iPhone 14, Samsung Galaxy S23)
• Operating system and version
• App version
• Device identifiers (anonymous, used for analytics and crash reporting)
• IP address (collected automatically when you access the Services)
• Push notification tokens (only if you grant notification permission)

2.8 Financial information

• Wallet address — the EVM-compatible cryptocurrency wallet address you provide to receive USDC payouts on the Base network. You can edit this at any time.
• Transaction history — records of rewards earned, bonuses, and payouts processed through the Services.
• We do not collect bank account information, credit card numbers, or government-issued financial identifiers.

2.9 Usage and interaction data

• Tasks you've viewed, started, completed, or skipped
• Upload submission history and review outcomes
• Time spent in the App, screens viewed, features used
• In-app notifications you've received and interacted with

We use the information we collect for the following purposes:

3.1 To provide the Services

• Create and manage your account
• Match you with tasks for which you are eligible
• Process and review your uploads
• Track your contribution history, reliability score, and earnings
• Process payouts to your wallet
• Send transactional notifications (upload approved, reward credited, etc.)

3.2 To improve the Services

• Analyze how users interact with the App to identify bugs, performance issues, and opportunities for improvement
• Develop and test new features
• Diagnose technical problems

3.3 To communicate with you

• Send service-related notifications (in-app, push, email)
• Respond to support requests and inquiries
• Notify you of important account changes, policy updates, or service announcements
• Send communications about Hub programs, bonuses, and news by email, through our official channels, and through ads shown to existing users on third-party platforms (see Section 4.6). You can opt out at any time via the unsubscribe link in our emails or at privacy@hub.xyz

3.4 To protect the Services and our users

• Detect and prevent fraud, abuse, and policy violations
• Enforce our Terms of Service
• Comply with legal obligations

3.5 For research and AI development

• Uploaded content (images, videos, audio, and accompanying metadata) is the core data product of the Services. With your consent provided through these Terms, we use this content to:
  • Build and improve AI training datasets
  • License datasets to enterprise clients (see Section 4)
• Profile data you provide may be associated with your uploads to add demographic context to datasets, but only in anonymized or aggregated form (see Section 4).

3.6 Automated processing

We use automated systems to support the operation of the Services, including:

• Task matching — algorithms determine which tasks you are eligible for based on your profile information, location, device capabilities, and task requirements.
• Reliability scoring — automated systems calculate a reliability score based on your submission history, review outcomes, and platform activity. This score affects the tasks available to you and your standing on the platform.

These automated processes are necessary for the efficient operation of the Services. If you have questions or concerns about how automated processing affects your account, contact us at privacy@hub.xyz.

We share information in the following ways:

4.1 With enterprise clients (anonymized / aggregated only)

Hub licenses AI training datasets to enterprise clients (such as research labs and technology companies). When we share data derived from your uploads:

• Uploaded content (the images, videos, audio you submitted) may be included in these datasets, since this content is the purpose for which it was collected and submitted.
• Demographic metadata (age range, gender, skin tone, language, location at country level) may accompany content in anonymized or aggregated form only.
• Personally identifying information — your name, email, wallet address, exact location, IP address, account credentials, or identity verification documents — is never shared with clients.

We require all enterprise clients to agree to data handling terms that restrict use of the data to the purposes described in their contract. A Data Processing Agreement (DPA) is executed with each enterprise client, and a list of subprocessors is available on request at privacy@hub.xyz.

4.2 With service providers

We share information with third-party service providers who help us operate the Services. These providers are contractually bound to handle your information securely and only as instructed by us. They include:

• Didit — identity verification (KYC)
• Cloud hosting providers — to store and process data
• Payment processors — to facilitate USDC payouts on the Base network
• Analytics and crash reporting tools — to monitor app performance
• Email delivery providers — to send transactional emails
• Push notification providers — to deliver push notifications to your device

A current list of subprocessors is available on request at privacy@hub.xyz.

4.3 For legal reasons

We may disclose information if required to do so by law, subpoena, court order, or other legal process, or if we believe in good faith that disclosure is necessary to:

• Comply with applicable law
• Protect the rights, property, or safety of Hub, our users, or others
• Investigate and prevent fraud or security incidents

4.4 Business transfers

If Hub is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you (via in-app notification or email) before your information is transferred and becomes subject to a different privacy policy.

4.5 With your consent

We may share information for other purposes with your explicit consent.

4.6 With advertising platforms (custom audiences)

To reach people who already use the Services with communications about our programs and bonuses, we may send advertising platforms, such as Meta (Instagram and Facebook), a list of contact details of existing users: email, phone number, name, city, state, postal code, and country. These values are converted to hashes (SHA-256) before they leave our systems. The platform uses the hashes only to identify which users hold an account with it and to show them our communications; it does not receive the data in readable form and, under its terms, deletes the hashes once matching is complete. We never send uploaded content, earnings, identity-verification data, or tax identifiers.

We do this on the basis of our legitimate interest in communicating with existing users about programs they already take part in. You can object at any time via the unsubscribe link in our emails or at privacy@hub.xyz, in which case you are removed from subsequent lists. You can also hide Hub's ads in the platform's own ad settings.

We do not sell your personal information to third parties.

Depending on where you live, you may have the following rights regarding your personal information:

5.1 Universal rights (available to all users)

• Access — request a copy of the personal information we hold about you
• Correction — update or correct inaccurate information through your profile, or by contacting us
• Deletion — request that we delete your account and associated personal information (see Section 5.4 for limitations)
• Portability — request a copy of your information in a portable format
• Withdraw consent — withdraw consent for processing where consent is the basis (e.g., revoke camera, location, or notification permissions in your device settings)
• Object — object to certain types of processing
• Restrict — request restriction of processing in certain circumstances

5.2 For users in the European Economic Area, UK, and Switzerland (GDPR)

• You have all the rights listed above
• You have the right to lodge a complaint with your local data protection authority
• Our legal bases for processing are: (a) performance of a contract (providing the Services), (b) your consent (for optional features like location and notifications), (c) our legitimate interests (improving the Services, preventing fraud), and (d) compliance with legal obligations

5.3 For California residents (CCPA / CPRA)

• You have the right to know what personal information we collect, use, share, or sell
• You have the right to delete personal information we have collected from you
• You have the right to correct inaccurate personal information
• You have the right to opt out of the "sale" or "sharing" of personal information (we do not sell personal information)
• You have the right not to be discriminated against for exercising your privacy rights

5.4 Exercising your rights

To exercise any of these rights, contact us at privacy@hub.xyz. We will respond within 30 days (or sooner if required by your jurisdiction). You can also delete your account directly at https://platform.hub.xyz/settings or in the App by going to Profile → Account → Delete account. Step-by-step instructions are at hub.xyz/delete-account.

5.5 Limitations on deletion

When you delete your account:

• We delete your personal account information (email, profile data, wallet address) within 30 days.
• We retain certain information where required by law (e.g., transaction records for tax and regulatory purposes).
• Uploaded content that has already been included in datasets licensed to enterprise clients cannot be retracted from those clients' copies, since you agreed to its use in datasets at the time of upload. Future use is stopped, and any unfulfilled licensing of that specific content ceases.

5.6 For users in Brazil (LGPD)

You have the rights provided by the Brazilian General Data Protection Law (Law No. 13,709/2018), including those listed in Section 5.1, and you may lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD). Our legal bases are: (a) performance of a contract (providing the Services and paying you), (b) your consent (optional features such as location and notifications), (c) our legitimate interests (improving the Services, preventing fraud, and communicating with existing users about programs they take part in, see Section 4.6), and (d) compliance with legal obligations.

The Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we discover that we have collected personal information from a person under 18, we will delete it promptly.

If you believe we may have collected information from someone under 18, contact us at privacy@hub.xyz.

Hub Data, Inc. is located in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States and in other countries where our service providers operate.

For transfers from the European Economic Area, UK, and Switzerland, we rely on the European Commission's Standard Contractual Clauses or other approved transfer mechanisms.

For users in Brazil, international transfers follow the LGPD and ANPD Resolution CD/ANPD No. 19/2024, relying on standard contractual clauses or another mechanism recognized by the ANPD.

We retain your personal information for as long as your account is active and for the periods described below:

We take reasonable and appropriate technical and organizational measures to protect your information from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit (TLS) and at rest
• Access controls and authentication for our systems
• Regular security reviews and audits
• Restricted access to personal information on a need-to-know basis

No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we work to protect your information using industry best practices.

10.1 Cookies

The App does not use cookies. The Hub website (platform.hub.xyz) uses cookies and similar technologies as described below:

The website may use measurement pixels from advertising platforms, such as the Meta Pixel, to measure the results of our own campaigns. We do not serve third-party ads on the Services.

You can manage or disable cookies through your browser settings. Disabling strictly necessary cookies may prevent you from using certain features of the website.

10.2 Cross-app tracking

We do not track your activity across other companies' apps or websites, and we do not share your data with advertising networks so that third parties can advertise to you. The only sharing with advertising platforms is the one described in Sections 4.6 and 10.1: reaching existing users with our own communications and measuring our campaigns. The Hub App does not use Apple's IDFA or Google's Advertising ID.

The Services may contain links to third-party websites or integrate with third-party services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party service you interact with.

Key third parties we integrate with:

• Didit (identity verification) — https://didit.me/privacy
• Google (OAuth sign-in) — https://policies.google.com/privacy
• Discord (OAuth sign-in) — https://discord.com/privacy
• Meta Platforms (custom audiences and ad measurement) — https://www.facebook.com/privacy/policy
• PostHog (product analytics: which screens are opened and which actions are taken in the app) — https://posthog.com/privacy
• Sentry (crash and performance reports) — https://sentry.io/privacy/

We may update this Privacy Policy from time to time. When we do, we will:

• Update the "Last updated" date at the top of this Policy
• Notify you of material changes via in-app notification, email, or other appropriate means
• For significant changes affecting how we use your existing information, we will obtain renewed consent where required by law

Your continued use of the Services after changes take effect constitutes acceptance of the updated Policy.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, contact us:

For European users, you may also contact your local data protection authority.