1 · Controller
The entity responsible for data processing on this website and in the huddl app is named in the Imprint.
Email for data-protection requests: legal@huddl.me
2 · Overview of processing
We process personal data in the following contexts:
- Website visit (huddl.me): server logs; opening an invite link also retrieves the associated event preview from Supabase
- App usage (huddl iOS/Android): account, profile, events, chat, media, settings
- Auth providers: Sign in with Apple or Google
- Communication: support emails, push notifications, auth emails
- Monetization (huddl Pro and Event Pass): purchase and subscription management via Apple/Google in-app purchases and RevenueCat
3 · Legal bases
- Art. 6 (1) lit. b GDPR — performance of contract (account, event features, Pro subscription)
- Art. 6 (1) lit. f GDPR — legitimate interest (stability, security, improvements, product analytics)
- Art. 6 (1) lit. a GDPR — consent (push notifications, marketing emails, optional features)
- Art. 6 (1) lit. c GDPR — legal obligation (tax law for Pro subscription)
4 · Processors used
We use the following service providers. Where they act as processors on our behalf, processing is governed by an agreement pursuant to Art. 28 GDPR:
4.1 Hosting & database — Supabase
Provider: Supabase Inc., USA
Hosting region: EU (Frankfurt am Main, AWS eu-central-1)
Data processed: account data, event content, chat messages, uploaded media; for invite links, the event name, date, participant count, and host display name
Legal basis: Art. 6 (1) lit. b GDPR (performance of contract)
Privacy: supabase.com/privacy
4.2 Marketing website & edge hosting — Vercel
Provider: Vercel Inc., USA
Data processed: HTTP logs, performance telemetry
Privacy: vercel.com/legal/privacy-policy
4.3 DNS & CDN — Cloudflare
Provider: Cloudflare Inc., USA
Data processed: IP address, HTTP headers
Privacy: cloudflare.com/privacypolicy
4.4 Push notifications — OneSignal
Provider: OneSignal Inc., USA
Data processed: device token, notification payload, delivery/read status
Legal basis: Art. 6 (1) lit. a GDPR (consent via OS push opt-in)
Privacy: onesignal.com/privacy_policy
4.5 Subscription management — RevenueCat
Provider: RevenueCat Inc., USA
Data processed: pseudonymous user ID, purchase/subscription status, platform (iOS/Android)
Legal basis: Art. 6 (1) lit. b GDPR (for huddl Pro and the Event Pass)
Privacy: revenuecat.com/privacy
4.6 Error tracking — Sentry
Provider: Functional Software, Inc. (Sentry), USA
Data processed: anonymized stack traces, device info, app version
Legal basis: Art. 6 (1) lit. f GDPR (stability, bug fixing)
Privacy: sentry.io/privacy
4.7 Product analytics — PostHog
Provider: PostHog Inc., USA — EU hosting
Data processed: pseudonymous usage events (e.g. "login", "event created"), technical app/device information and, during purchases, store offer metadata (product ID, plan, price, currency, entry point, and result); no message content, names, email addresses, or addresses, no IP storage
Used: only in the huddl app (not on the website)
Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in product improvement); enabled by default with the option to disable at any time in the app under Settings → Privacy (opt-out)
Privacy: posthog.com/privacy
4.8 Maps & address search — Google Maps
Provider: Google Ireland Limited, Ireland
Data processed: only when actively using address search, maps, or navigation: entered search terms, the selected address or coordinates, and technical connection data. Search requests pass through our Supabase proxy; no huddl user ID is sent to Google. A map view is no longer loaded automatically on event detail pages and is only opened after an active map/navigation action.
Privacy: policies.google.com/privacy
4.9 Authentication — Apple / Google Sign In
Optionally, huddl supports sign-in with Apple ID or Google. Only the data needed for sign-in is transferred (Apple: anonymized email available; Google: name, email).
4.10 Transactional emails — Resend
Provider: Resend Inc., USA
Data processed: email address, content of confirmation or reset emails
Legal basis: Art. 6 (1) lit. b GDPR (account verification)
Privacy: resend.com/legal/privacy-policy
5 · Cookies and similar technologies
Details in the Cookie Notice. Short version:
- Strictly necessary (website):
NEXT_LOCALEstores your language choice; your theme setting (light/dark) is kept in your browser'slocalStorage. Both are required for operation and exempt from consent (§ 25 (2) TDDDG). - We set no tracking, analytics, or marketing cookies on the website. No consent banner is required while this remains the case. We will obtain consent before using non-essential technologies.
- Product analytics in the app (PostHog) is pseudonymous, enabled by default, and can be disabled at any time under Settings → Privacy (opt-out).
6 · Third-country transfers
Some services (Supabase, Vercel, Cloudflare, OneSignal, RevenueCat, Sentry, PostHog, Apple, Google) have US parent companies. Most processing happens in the EU. Where data is transferred to the US, this is based on:
- EU Standard Contractual Clauses (Art. 46 (2) lit. c GDPR)
- EU-US Data Privacy Framework (for certified providers)
7 · Retention periods
| Data category | Retention |
|---|---|
| Account data | Until account deletion |
| Event content and media | Until the event owner deletes the event or their account; existing content above a later plan limit is not deleted automatically when a paid plan expires |
| Chat messages | Until the event/account is deleted or a message is deleted manually |
| Push tokens | Until logout or uninstall |
| Server logs | 30 days |
| Tax-relevant data (huddl Pro / Event Pass) | 10 years (§ 147 AO) |
8 · Your rights
You have the right at any time to:
- Access your stored data (Art. 15 GDPR)
- Rectification of incorrect data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR) — in-app under Settings → Delete account
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing based on legitimate interests (Art. 21 GDPR)
- Withdraw consent with effect for the future (Art. 7 (3) GDPR)
To exercise your rights: legal@huddl.me
9 · Right to lodge a complaint
You have the right to lodge a complaint with a data-protection authority. The relevant authority is typically the one in your federal state of residence or our place of business.
For our place of business in Hesse, this is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)
Postfach 3163, 65021 Wiesbaden, Germany
Email: poststelle@datenschutz.hessen.de
10 · Changes to this policy
We may update this notice when introducing new features or services. We'll communicate material changes by email and/or in-app.
Last updated: August 2026