Effective August 15, 2026

Privacy Policy

HAP Maker is operated by Stephen C. Young. It is designed to create generic activity illustrations and printable handouts without becoming a patient record system.

Information we collect

• Account email, password hash, email-verification status, the Terms version and acceptance time, optional marketing consent, successful login count and most recent successful login time, and session cookies.
• Stripe customer, subscription, billing-period, and payment-status identifiers. HAP Maker does not receive complete card numbers.
• Create Activity credit balances, ledger entries, pending reservations, generic activity descriptions, generated illustrations, and approved shared activities.
• If you voluntarily report an illustration problem: the reported image, generic generation context, selected problem reason, optional note, review status, and any administrative account adjustment.
• Operational information needed for security, error investigation, and service reliability.
• If you allow analytics, Google Analytics receives limited public-page usage information such as the page path, approximate geography, device category, and visit timing. Query strings, account identifiers, email addresses, activity text, and patient information are excluded.

Patient information

Do not submit protected health information. Names entered in the HAP print field are sent only with the immediate PDF request and are not saved in PostgreSQL, object storage, Stripe, Resend, or the activity catalog. Create Activity text and support messages must remain generic and non-identifying.

How information is used

We use information to authenticate accounts, display successful login totals to HAP Maker administrators, document acceptance of the applicable Terms, provide memberships, maintain Create Activity credit balances, generate and store approved activities, create PDFs, review voluntarily reported illustration problems, administer account adjustments, provide support, prevent abuse, send required account messages, and—only with optional consent—send product updates and offers. If you separately allow analytics, public-page measurements are used to understand visits and improve the website.

Service providers

HAP Maker uses DigitalOcean for application, database, and object storage; Stripe for billing; Resend for account and optional marketing email; OpenAI for Create Activity illustration generation; and, only after analytics consent, Google Analytics for public website measurements. Only information needed for each function is sent. Create Activity text sent to OpenAI must not identify a patient.

Cookies and security

Secure session and CSRF cookies keep you signed in and protect account actions. Google Analytics is not loaded unless you allow it. Your analytics choice is stored locally in your browser and can be changed below. Passwords are stored as salted hashes. Illustration objects are private and served through authenticated application routes. No system can guarantee absolute security.

Review analytics choice

Retention and deletion

Account and membership information is retained while your account is active and as reasonably needed for security, legal, tax, dispute, and payment obligations. You may permanently delete your application account from the account page. Stripe may retain financial records as required by law. Approved generic illustrations may remain in the shared catalog without your account identity.

Your choices

You can update marketing consent, cancel a membership through the Stripe billing portal, and delete your account from the account page. To request access, correction, or help with deletion, email [email protected].

Children and changes

HAP Maker is intended for adult professionals and is not directed to children. Material policy changes will be posted here with a new effective date.

Contact

Privacy questions:

HAP Maker is operated by Stephen C. Young. For privacy questions, email [email protected].