Huddle privacy statement

1. The short version

The sections below say all of that again, precisely, and add the parts that only matter when something goes wrong.

2. Who this statement is from, and who it covers

This statement explains how Huddle handles your family's information. It applies to the Huddle mobile app and to the services behind it. Where data protection law asks who is responsible for the information described here, the answer is Huddle.

It covers everyone who uses the app: the person who created the household, everyone they invited, and the children in it whose accounts an adult set up on their behalf.

It does not cover anything you leave Huddle to do. Opening a link someone posted on the notice board, or managing your subscription in the Google Play app, takes you somewhere with its own rules.

3. What Huddle collects

What you tell us when you sign up

• Email address and password — how you sign in. The password is never stored in a form anyone can read, here or on our servers.
• First and last name, and a preferred name if you set one — so your family sees a person rather than an account.
• Date of birth — used to work out whether an account belongs to an adult, a teenager or a child, which is what decides the permissions and defaults Huddle applies. It is not used for advertising, and it isn't shared outside your household.
• A profile photo, if you add one. Stored in a private bucket that cannot be browsed from outside the app, and served through links that expire.

What your household creates as it uses the app

Everything your family puts into Huddle is stored so that your family can get it back. That includes calendar events and reminders, lists and list items, meal plans, routines and chores, allowance and reward entries, notice board posts, milestones, who's-home statuses, and the household's own name and logo.

This content is visible to the members of your household and to nobody else. It is not scanned to build a profile of you, it is not used to train anything, and it is not shared with other companies except as described under "Who else is involved" below.

What the app collects automatically

• Usage statistics — which screens are opened and in what order, whether something you started was finished, and which Marketplace modules get switched on. This is measured with Google Analytics for Firebase.
• Basic technical details that come with those statistics — app version, device model, operating system version, language, and an approximate region worked out from the network address. Not a street, a postcode, or GPS.
• A random identifier Google Analytics assigns to this installation of the app. It is reset if you reinstall Huddle, and it is not your name, your email, or an advertising ID.
• Diagnostic information when something fails, so that a crash can be understood rather than guessed at.

None of this is collected unless you agree to it. Huddle asks once, the first time you open it, and until you answer — and for as long as the answer is no — nothing is gathered at all. Saying no is not a reduced version of the app; it is the same app, quieter.

Settings › Privacy shows what you chose and changes it whenever you like. Switching it off stops collection rather than merely hiding it — the underlying SDK is told to stop, so its own automatic measurements stop too. The setting belongs to the device it is set on: your answer on your phone is not your answer on the tablet in the kitchen, and nobody in your household can see or change it.

What Huddle never collects

• Your location. There is no location permission, no background tracking, and no geofencing. Who's Home reflects what a person tapped, and nothing else.
• Your contacts, your call history, your messages, or anything else belonging to another app.
• An advertising identifier. The Android permission for one is removed from the app at build time.
• The text of what you write, in the usage statistics. Those record that a list was created and which icon it was given, never what was on it.
• Payment card details. Subscriptions are bought through Google Play, which handles the payment; Huddle never sees the card.

4. The Info Vault

The Info Vault is the part of Huddle meant for the things a family needs to hand but should not leave lying about — NHS numbers, policy details, passport numbers, medical notes. It is treated differently from everything else in the app, and this section is the whole reason it can be.

Vault entries are encrypted on your device, with a key derived from your household's vault passphrase, before anything is uploaded. The passphrase is never transmitted and never stored. What our database holds is ciphertext and two locked copies of the key — one openable by the passphrase, one by the one-time recovery code you were shown when the vault was created.

The consequence is worth stating plainly in both directions. We cannot read your vault, and no one who obtains a copy of our database can read it either. We also cannot recover it for you: if everyone in the household forgets the passphrase and the recovery code is lost, the contents are gone, and there is no support request that can undo that.

Vault screens are also marked so that Android does not photograph them for the recent-apps carousel.

5. Why we hold each of these things

Where UK and EU data protection law applies, these are the grounds we rely on.

• To provide the app you signed up for — your account, your household's membership, and all the content in it. Held because it is necessary to perform our contract with you. Without it there is no app.
• To keep the service secure and working — diagnostics, abuse prevention, and backups. Our legitimate interest in running a service that stays up and stays private.
• To understand which parts of Huddle are used, so the next release improves the right things. Your consent, asked for once and withdrawable at any time in Settings › Privacy. Nothing is collected before you give it, and withdrawing it stops collection from that moment.
• To manage subscriptions, trials and receipts. Necessary to perform our contract with you, and in places necessary to comply with tax and accounting law.
• To answer you when you contact us. Necessary to perform our contract, or our legitimate interest in replying to people who write to us.

6. Who else is involved

Your own household

Huddle is a shared app, and sharing is the point. Everyone in your household can see the household's events, lists, meals, routines, notices, statuses and ledger entries, along with your name, preferred name and profile photo. Household admins can additionally manage members, roles and invitations. Vault contents are readable only by members who know the vault passphrase.

The companies that run the parts we do not

Huddle uses a small number of service providers. They process data on our instructions, under contract, and for no purpose of their own.

• Supabase — hosts the database, the sign-in system and the private file storage. This is where your account and your household's content live.
• Google (Firebase / Google Analytics) — the anonymous usage statistics described above, and nothing else. No Huddle account identifier, email or name is sent to it.
• RevenueCat — keeps track of what your household has paid for. It receives the random identifier your account was given and the receipt the store issued. It does not receive your name, your email, or anything from inside the app.
• Google Play — takes the payment and issues the receipt, under Google's own terms and privacy policy. Card details go to Google, never to us.

Everyone else

We do not sell personal information, we do not share it for advertising, and we do not disclose it to anyone else — except where we are legally required to, where it is necessary to protect somebody's safety, or if Huddle is one day transferred to another owner, in which case this statement travels with it and you would be told before anything changed.

7. Where your data is kept

Huddle's database and file storage are hosted by Supabase in a single region, and backups are kept in the same region. Our service providers are international companies, so some of the processing described above — analytics and subscription records in particular — may happen outside the United Kingdom and the European Economic Area.

Where that happens, the transfer is covered by the safeguards data protection law provides for it, which in practice means the standard contractual clauses published by the European Commission and the UK addendum to them.

8. How long it is kept

• Your account and profile — for as long as the account exists.
• Household content — until somebody in the household deletes it, or until the account is deleted. Deleting a list, an event or a vault entry removes it for everyone.
• Anonymous usage statistics — retained by Google Analytics for the period set on the property, after which they are deleted automatically. They are not linked to your account and cannot be traced back to it.
• Subscription and payment records — kept for as long as tax and accounting law requires them, typically six years, because that is not a period we get to choose.
• Backups — overwritten on a rolling schedule. Data deleted from the live service can persist in a backup for a short period before it is cycled out.

9. How it is protected

• Everything between the app and our servers travels over HTTPS.
• Data is encrypted at rest on the server, and the Info Vault is additionally encrypted on your device before it gets there.
• Every table enforces row-level security: the database itself, not just the app, refuses to return one household's rows to another household.
• File storage buckets are private. Images are served through links that expire rather than through public URLs.
• Your sign-in session is held in the phone's own secure keystore, not in ordinary app storage.
• Vault screens are excluded from Android's app-switcher screenshots.

No system is perfect, and anyone who tells you otherwise is selling something. If a breach ever affects your personal data and is likely to put you at risk, we will tell you and the relevant regulator within the time the law allows.

10. Children and family accounts

Huddle is built for households, and households contain children. Accounts for children are created and managed by an adult in the household, who is asked to give consent on their child's behalf when setting one up. If you are a parent or guardian, you can see and change everything about your child's account from Settings › Manage family, and you can remove it entirely.

A child's date of birth is used to set age-appropriate defaults and permissions inside the household. Children's information is never used for advertising or profiling, and it isn't sold. Nothing in Huddle is directed at children outside a household an adult set up.

If you believe a child's information has ended up in Huddle without a parent or guardian's involvement, write to us at privacy@huddlefamily.app and we will remove it.

11. What the app asks your phone for

• Notifications — so reminders and the daily digest can appear. Reminders are scheduled and delivered by your own device; they are not pushed from a server, and no notification token leaves the phone.
• Camera and photo library — only when you choose a profile picture or a household logo. The image is cropped and shrunk on the device before it is uploaded, and nothing else in your library is read.
• Network access — to sync with the household.

Each of these can be refused or withdrawn in Android's own settings. Refusing notifications switches off reminders; refusing camera access means no profile picture. Nothing else stops working.

12. Your choices inside the app

• Settings › Privacy — switch anonymous usage statistics off on this device.
• Settings › My details — change your name, preferred name, date of birth and photo.
• Settings › Notifications and Settings › Daily digest — choose what the app is allowed to interrupt you for.
• Settings › Manage family — leave a household, or, if you are an admin, remove a member and their access to the household's content.
• Settings › Delete account — erase your account and your data, from inside the app, without asking us.
• The Info Vault — remove entries individually, at any time.

13. Your rights over your data

Under UK and EU data protection law you have the right to ask us for a copy of the personal data we hold about you, to have it corrected if it is wrong, to have it deleted, to ask us to restrict or stop certain processing, to object to processing we carry out on the basis of legitimate interests, and to receive your data in a portable form. Where we rely on consent, you can withdraw it at any time without affecting what was done beforehand.

Some of these you can exercise yourself, immediately, from the settings listed above. For the rest, write to privacy@huddlefamily.app from the address on your account. We will respond within one month, and we will not charge you for it.

One limit is worth knowing in advance: household content is shared. If you ask us to delete an event you created, it disappears for everyone in your household, because there is only one copy of it. And we cannot export the contents of your Info Vault, because we cannot read it — export it from the app while it is unlocked instead.

14. Deleting your account

You can leave a household from Settings › Manage family, which ends your access to its content immediately.

To delete the account itself, go to Settings › Delete account. Step-by-step instructions are on the delete your account page. It is done from inside the app, straight away, without asking us and without waiting for anybody to get round to it. You will be shown exactly what it will remove before you confirm.

• Your profile, your name, your date of birth and your photo are deleted.
• If you are the last member of a household, that household goes with you — its calendar, lists, chores, notices, ledger and Info Vault, permanently.
• If other people are still in the household, it stays and so does what it shares. You are removed from it, and if you owned it, it passes to another member. Deleting your account is not a way to delete a family's calendar out from under them.
• Copies held in backups go as those backups cycle out, which takes a little longer than the live service.
• Subscription and payment records are kept for as long as tax law requires — see "How long it is kept" above.

One thing deleting your account does not do is cancel a subscription. That is held by Google Play rather than by us, and it has to be cancelled there or it will keep billing. If you would rather we did the deletion for you, write to privacy@huddlefamily.app from the address on the account.

15. Changes to this statement

When this statement changes, the version and date at the top of it change too, and the current text is always available in the app under Settings › Privacy and Settings › About. If a change materially affects how your family's information is handled, we will tell you in the app before it takes effect rather than quietly amending the page.

16. Contact us

Questions, requests and complaints about privacy all go to the same place: privacy@huddlefamily.app. Tell us what you are asking for and which account it concerns, and we will come back to you within a month.

If you are in the United Kingdom and you are not satisfied with our answer, you can complain to the Information Commissioner's Office at ico.org.uk. If you are in the European Economic Area, you can complain to the supervisory authority in the country you live in. We would rather you gave us the chance to put it right first.