Privacy policy
Draft for legal review. Version [version], effective [date]. [DO POTWIERDZENIA PRZEZ PRAWNIKA: całość]
This policy explains what Huddo keeps about you, why, who sees it and what you can do about it. Huddo is an app for adults who want to stop using vapes or nicotine pouches together with a few friends.
Who is responsible
[Full name or company name of the controller], [postal address], is responsible for your data (the "controller"). Contact for anything about your data: [contact e-mail address].
[Data protection officer or EU / UK representative, if one is required.] [DO POTWIERDZENIA PRZEZ PRAWNIKA]
The short version
- Huddo keeps your daily answer, your usual daily spend, your status for the day and the times you send an SOS. This is information about your health. Huddo keeps it only because you agreed, and uses it only to run the shared timer and count what your pact saves.
- Your pact sees your name, your shape and your status each day: in, not yet or slipped. They cannot read your spend or your answers, but they can work out roughly what you spend from how the shared amount grows.
- Your data is stored on Google Cloud servers in the European Union.
- Huddo has no advertising, does not sell data and does not use your health information for analytics.
- You can delete your account and data in the app at any time (Settings, Delete account) or at [https://domain/delete-account].
Health information
Using Huddo says something about your health: that you use nicotine and want to stop. The following is treated as health information:
| Information | Why | Who sees it |
|---|---|---|
| Your answer to the evening question, yes or no, and when you gave it | to keep or restart the shared timer | only you |
| Your status for today: in, not yet or slipped, and whether you missed the previous evening | to show your pact who has answered | you and the members of your pact |
| Your usual daily spend | to count what the pact saves | only you; the pact sees only the total of all members |
| The times you send an SOS, and the notification it creates | to tell your pact and to limit SOS to one every 15 minutes | the members of your pact get the notification |
| The shared timer, the last restart and the saved amount of your pact | the main screen of the app | the members of your pact |
| What you want to stop (vapes, pouches or both) | to word the first screens | only you; it stays on your phone and is deleted when your pact starts |
The legal basis is your explicit consent (GDPR Article 9(2)(a) and Article 6(1)(a)), which the app asks for before your pact starts, with two boxes that are not ticked in advance. The app keeps a record of which version of the consent text you agreed to and when. [DO POTWIERDZENIA PRZEZ PRAWNIKA: podstawa prawna; dowód zgody dziś zostaje na telefonie, patrz release/CONSISTENCY.md C-2]
You can withdraw your consent at any time in Settings, Withdraw consent. Huddo cannot work without this information, so withdrawing deletes your account and your data and takes you out of your pact. Withdrawing does not make earlier processing unlawful.
What the pact can work out. The shared amount grows by the sum of every member's usual daily spend. In a pact of two, the other person can subtract their own spend from the total. In a pact of any size, the amount changes by exactly one person's spend when they join or leave. Your exact spend is never shown to anyone, but the people in your pact can work it out.
Other information Huddo keeps
| Information | Why | Legal basis | Who sees it |
|---|---|---|---|
| A random account id created when you start or join a pact (no e-mail, no phone number, no password) | to know which pact and data are yours | contract (Art. 6(1)(b)) | nobody but the app |
| Your display name and the shape you picked | so your friends know who is who | contract | the members of your pact, and anyone who opens a live invite link to your pact |
| The name of your pact | shown on the main screen and on the invite page | contract | the members, and anyone with a live invite link |
| Your time zone and currency (set by whoever starts the pact) | the day closes at midnight in that time zone; the amount is shown in that currency | contract | the members |
| A push token for your phone | to send notifications from your pact (Nudge, SOS, the timer restarting). The evening question is scheduled on your phone and needs no token | contract | nobody but the app |
| The times you nudged someone | to limit Nudge to one per person per hour | legitimate interest in preventing nuisance (Art. 6(1)(f)) | the nudged person gets the notification |
| Reports you make or that are made about you: the names at that moment, the reason and an optional note | to keep pacts free of abuse | legitimate interest; Google Play rules for user content | the controller only; nobody in the pact is told |
| Your purchase: a random billing id, the subscription, its renewal and expiry | to know whether the pact is paid for | contract; legal obligation for tax records (Art. 6(1)(c)) | RevenueCat and Google Play |
| Anonymous usage counts: which of 14 fixed events happened (for example "pact created", "paywall viewed"), with the app version, phone model and system | to see which parts of the app work | legitimate interest [DO POTWIERDZENIA PRZEZ PRAWNIKA: czy wymagana zgoda (ePrivacy art. 5 ust. 3)] | PostHog |
| Error reports: what failed in the app, the app version, phone model and system, a random id of the install | to fix crashes | legitimate interest | Sentry |
| Server request logs: time, IP address, device type | security and fixing faults | legitimate interest | Google Cloud |
Huddo does not collect your e-mail address, phone number, contacts, location, photos or year of birth. The age question is asked once on the phone; only the fact that you said you are an adult is kept, on the phone.
Your health information is never put in notifications, analytics events, error reports, purchase records, store product names or logs.
What others can see without opening the app
- Notifications. Notification titles can appear on your lock screen. The evening question is "Did you keep the pact today?". Notifications from your pact name the sender, for example "Maja asked for support." or "Maja is waiting for you.". You can turn them off in the system settings.
- Widget. If you add the widget, it shows the jar, the timer and your friends' shapes on your home screen.
- Share picture. A picture you choose to share shows the jar, the timer and the amount. It has no names.
- Invite link. Anyone who has a live invite link to your pact can see the pact name and the names and shapes of its members. Links expire after 7 days or when the pact is full.
Who processes your data for us
| Company | What for | Where | Safeguard for transfers |
|---|---|---|---|
| Google (Firebase, Google Cloud) | database, sign-in, server functions, web pages, logs | European Union (Firestore eur3, functions europe-west1); some Firebase services are global | Google Cloud data processing terms; standard contractual clauses / EU-US Data Privacy Framework [DO POTWIERDZENIA] |
| Google (Firebase Cloud Messaging) | delivering notifications | global | as above |
| RevenueCat, Inc. | checking purchases and renewals | United States | RevenueCat DPA with standard contractual clauses [DO POTWIERDZENIA] |
| PostHog Inc. (PostHog Cloud EU) | anonymous usage counts | European Union (Germany) | PostHog DPA [DO POTWIERDZENIA] |
| Functional Software, Inc. (Sentry, EU data storage) | error reports | European Union (Germany) | Sentry DPA [DO POTWIERDZENIA] |
Full list with contacts: [https://domain/privacy#processors] (legal/subprocessors.md).
Payments are made through Google Play. Google is responsible for its own processing of your payment and your Google account under the Google Privacy Policy.
Huddo does not sell your personal information and does not share it for advertising. The app contains no advertising and no advertising id.
How long
| Information | Kept |
|---|---|
| Your account, name, shape, push token | until you delete your account |
| Your status, answers and daily spend | until you leave the pact or delete your account |
| Pact name, timer and saved amount | until the last member leaves; the saved amount stays in the pact, with no name on it, after you leave |
| Notifications waiting to be sent | 7 days |
| Invite links | 7 days |
| Reports | [period, for example 12 months after the report is closed] [DO POTWIERDZENIA PRZEZ PRAWNIKA] |
| Purchase records | [period required by tax law] [DO POTWIERDZENIA PRZEZ PRAWNIKA] |
| Error reports | [Sentry retention, 90 days on the current plan] [DO POTWIERDZENIA] |
| Usage counts | [PostHog retention] [DO POTWIERDZENIA] |
| Server request logs | 30 days [DO POTWIERDZENIA] |
Deleting your account
In the app: Settings, Delete account. This deletes, at once, your sign-in account, your name, shape, answers, daily spend, status, push token and the notifications to or from you, and takes you out of your pact. Without the app, use [https://domain/delete-account] or write to [contact e-mail address]; we answer within one month.
What stays after deletion: the money your pact has saved stays in its jar as a number with no name; the pact's timer stays as it is; reports you made stay without your id; reports about you stay for the period above as a safety record; purchase records stay for the period tax law requires. Deleting your account does not cancel a subscription. Cancel it in Google Play, under Payments and subscriptions.
Your rights
You can ask for access to your data and a copy of it, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Write to [contact e-mail address]. We answer within one month. You can complain to a data protection authority, in Poland the President of the Personal Data Protection Office (UODO, uodo.gov.pl), or the authority where you live. [DO POTWIERDZENIA PRZEZ PRAWNIKA]
Adults only
Huddo is only for people aged 18 or over. The app asks for your year of birth before anything else and does not keep it. If we learn that someone under 18 uses Huddo, we delete their account.
Security
All traffic between the app and our services is encrypted (HTTPS / TLS). Data at rest on Google Cloud is encrypted by Google. The database refuses every write from the app except your own push token; every other change goes through server functions that check who you are and that you are in the pact. Only the people who run Huddo can open the database console, with two-step verification. [DO POTWIERDZENIA: kto ma dostęp]
If a breach puts your data at risk, we tell the supervisory authority within 72 hours and tell you without undue delay.
Consumer health data privacy policy (Washington and other US states)
This section is the consumer health data privacy policy required by the Washington My Health My Data Act (RCW 19.373) and similar laws in other US states. [DO POTWIERDZENIA PRZEZ PRAWNIKA: Nevada SB 370, Connecticut]
Categories of consumer health data we collect, and why. Your daily yes or no answer about staying within your own limit; your status for the day (in, not yet, slipped) and missed evenings; your usual daily spend; the times you send an SOS; the shared timer and its restarts; what you want to stop (kept on your phone only); and the fact that you use an app about stopping nicotine, which can be inferred from your account, push token and purchase. We use it only to run the shared timer, show your pact who has answered, count what the pact saves, and send the notifications you expect.
Sources. You, through the app. Your pact members' actions change shared data (the timer, the saved amount).
Categories of consumer health data we share. Your status for the day, the shared timer and the saved amount are shown to the members of your pact, which you choose to join. The notification that you asked for support is sent to them. We do not sell consumer health data.
Third parties and affiliates we share it with. Members of your pact (other users you invited or who invited you). Processors acting on our behalf: Google (Firebase, Google Cloud, Firebase Cloud Messaging). No other third parties and no affiliates. RevenueCat, PostHog and Sentry do not receive consumer health data, apart from the fact that you use the app.
Your rights. You can confirm whether we collect your consumer health data, access it, see the list of third parties above, withdraw consent, and have it deleted: in the app (Settings, Delete account) or by writing to [contact e-mail address]. We answer within 45 days. If we refuse, you can appeal by replying to our answer; if the appeal is refused you can contact the Washington State Attorney General (https://www.atg.wa.gov/file-complaint). [DO POTWIERDZENIA PRZEZ PRAWNIKA]
Changes
When this policy changes, the new version is published here with a new date. If a change affects what you agreed to, the app asks you to agree again before you continue.
Processors (subprocessors)
Draft, 13.10.2026. Derived from package.json and the services in src/services/ and functions/. Contract status: none of these contracts has been accepted yet; the owner accepts them when creating each account. [DO POTWIERDZENIA PRZEZ PRAWNIKA: każdy wiersz]
| Processor | Service | Data | Health data | Location | Contract to accept | Transfer safeguard |
|---|---|---|---|---|---|---|
| Google Ireland Ltd / Google LLC | Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Scheduler, Secret Manager, Cloud Logging, Firebase Hosting | everything stored for the app (legal/data-map.md section 1) | yes | EU: Firestore eur3, functions europe-west1; Authentication is global | Google Cloud Data Processing Addendum (accepted in the Cloud console, Privacy & Security) | SCC / EU-US Data Privacy Framework [DO POTWIERDZENIA] |
| Firebase Cloud Messaging | push token, notification title with a display name | yes (an SOS notification) | global | as above (Firebase terms) | as above | |
| RevenueCat, Inc. (USA) | purchase validation | random billing id, purchase tokens, app and OS version | no; the RevenueCat DPA forbids Art. 9 data, and the app sends none | USA | RevenueCat DPA, https://www.revenuecat.com/dpa/ | SCC |
| PostHog Inc. (PostHog Cloud EU) | product analytics | event names from a closed list, random id, device and app defaults | no | EU (Frankfurt) | PostHog DPA (in the PostHog account) | not needed for EU hosting; PostHog's own subprocessors [DO POTWIERDZENIA] |
| Functional Software, Inc. (Sentry), EU data storage | error reports | error stack, device and app data, random install id | no | EU (Germany) | Sentry DPA (in the Sentry organisation settings) | SCC for support access from the USA [DO POTWIERDZENIA] |
| 650 Industries, Inc. (Expo) | EAS Build | source code at build time; no user data | no | USA | Expo terms and DPA [DO POTWIERDZENIA] | SCC / DPF [DO POTWIERDZENIA] |
Independent controllers (not processors): Google Play / Google Commerce (store, payments, install referrer), the user's own Google account backup (see release/CONSISTENCY.md C-1).
When a processor is added or changed: update this file, legal/data-map.md, the privacy policy table "Who processes your data for us", and the Data safety answers in release/app-content.md.