Buying in the app
The app calls router.buy(minTokensOut, to) with ETH. The router buys on the Pons curve (or the Uniswap v4 pool after graduation) and shields the result straight into the vault, credited to you. With buyToStealth, the purchase lands on a fresh stealth address instead.
Buying elsewhere
HYDD is a plain ERC-20, so any wallet, aggregator or the Pons site can buy it. That HYDD is public until you shield it.
Slippage
The app quotes the trade first and passes a minimum output. If the price moves past it, the transaction reverts and nothing is spent.