1 · Controller
The controller responsible for data processing on this website and in the huddl app is:
Laurence Fink
Karlsbader Platz 14, 65197 Wiesbaden, Germany
Further details are in the Imprint.
Email for data-protection requests: legal@huddl.me
2 · Overview of processing
2.1 Website (huddl.me)
When you visit the website, we process technically necessary connection data (server logs). If you open an invite link, we also retrieve the associated event preview (event name, date, participant count, and display name of the person who invited you) from Supabase. The page for sign-in links (auth callback) only forwards the sign-in parameters it contains to the app.
2.2 Account and profile
- Registration: email address and password (stored only as a hash) or Sign in with Apple or Google, display name, username (@username), date of birth, and the time and version of your confirmation of the Terms and this privacy notice. Your date of birth is used to verify the minimum age of 16 and is not shown to other users. This information is required to use the app; registration is not possible without it.
- Optional profile details: profile picture, bio, phone number, and gender.
- Social features: friend requests and your friends list (search by username) as well as your block list.
2.3 Events, chat, and media
- Events: title, dates (including multi-day or recurring), location, description, cover image, additional event fields, participants, roles (owner, co-host, guest), RSVPs, as well as invitations and invite links.
- Chat: text and voice messages, replies, reactions, mentions, polls, and shared locations.
- Media: photos and videos in the gallery and chat. For photos, we store technical metadata such as capture time, camera model, image dimensions, file size, and original file name, but no GPS coordinates from the image metadata.
- Activity records: for the retention rules (section 7), we store when an event was last meaningfully used (e.g. opened, edited, or a message was sent).
Event content is visible to the authorized participants of that event.
2.4 Location, contacts, and calendar
- Location (optional): Only if you actively use "Current Location" when choosing a place does the app, after your permission, read your device's precise location and convert it into an address using your operating system's geocoding service (Apple or Google). We only store the place you add to an event or chat message.
- Contacts (optional): Only if you actively pick a contact in an event's contact-list field does the app copy that contact's name and the selected phone number. This information is visible to the event's participants. Your address book is not uploaded. Please only add other people's contact details if you are entitled to do so.
- Calendar: When exporting to your calendar, the app writes dates locally to the device calendar you choose. We do not access your calendar data; we only record that an export took place (as an activity record under section 2.3).
2.5 Communication
- Push notifications via Firebase Cloud Messaging (section 4.5), if you allow them in your operating system. You can manage individual notification types in the app under Settings → Notifications.
- Emails: confirmation, password-reset, and email-change emails, required notices about retention and deletion deadlines (section 4.11), and your support requests. We do not send advertising or newsletter emails.
- In-app feedback: category, message, app version, and device information, linked to your user ID.
2.6 Purchases (huddl Pro and Event Pass)
Purchases are processed via the App Store (Apple) or Google Play; Apple and Google process payment data under their own responsibility. Through RevenueCat (section 4.6) we only receive product, transaction, and status data (e.g. which product, purchase date, expiry date, renewal or refund status), but no card or bank details.
2.7 Safety and moderation
- Reports: When you report content, an event, or a user, we store the reported content or user, the reason, optional details, you as the reporting person, and the time, in order to review the report and document the decision.
- Text protection: Before saving, text you write is automatically checked — on your device and on our server — for a small set of unambiguous, severe violations (e.g. direct threats of violence, sexual exploitation, unambiguous hate slurs). No AI, cloud, or image/video analysis is used.
2.8 Operations and product improvement
- Error and performance data via Sentry (section 4.7).
- Product analytics via PostHog (section 4.8), with opt-out.
- Operational measurement: the total media bytes delivered per event, per day and media type, for cost control and to detect abusive usage. These figures contain no record of who accessed content and cannot be attributed to a person.
3 · Legal bases
- Art. 6 (1) lit. b GDPR — performance of contract (account, event, chat, media, and friends features, adding locations and contacts at your request, transactional emails, huddl Pro and the Event Pass)
- Art. 6 (1) lit. f GDPR — legitimate interest (stability, security, moderation and abuse prevention, product improvement and product analytics, cost control, handling feedback; for third-party contact details you add to an event, organizing your event)
- Art. 6 (1) lit. a GDPR — consent (push notifications)
- Art. 6 (1) lit. c GDPR — legal obligation (commercial and tax record-keeping obligations, obligations under the Digital Services Act)
4 · Processors used
We use the following service providers. Where they act as processors on our behalf, processing is governed by an agreement pursuant to Art. 28 GDPR:
4.1 Hosting & database — Supabase
Provider: Supabase Inc., USA
Hosting region: EU (Frankfurt am Main, AWS eu-central-1)
Used for: database, sign-in (auth), realtime updates, and server-side functions (e.g. push delivery, email delivery, address-search proxy, account deletion)
Data processed: account and profile data, event content, chat messages, push registrations, purchase and subscription status, reports, feedback, and metadata and storage paths for uploaded media; for invite links, the event name, date, participant count, and display name of the inviting person
Legal basis: Art. 6 (1) lit. b GDPR (performance of contract) and Art. 6 (1) lit. f GDPR for security, moderation, and operations
Privacy: supabase.com/privacy
4.2 Marketing website & edge hosting — Vercel
Provider: Vercel Inc., USA
Data processed: IP address, timestamp, requested URL including an invite token or sign-in parameter where present, HTTP headers, user agent, and technical server, security, performance, and error data; for invite pages, also the public event preview delivered to the browser
Legal basis: Art. 6 (1) lit. f GDPR (secure, stable, and efficient website delivery) and Art. 6 (1) lit. b GDPR when an invite preview is requested
Privacy: vercel.com/legal/privacy-policy
4.3 DNS & CDN — Cloudflare
Provider: Cloudflare Inc., USA
Data processed: IP address, HTTP headers, and technical connection data
Privacy: cloudflare.com/privacypolicy
4.4 Media storage and delivery — Cloudflare R2
Provider: Cloudflare Inc., USA
Used for: private storage and signed delivery of event photos and videos, thumbnails, event cover images, profile images, and voice messages. The bucket is not public; uploads and downloads use signed, time-limited URLs and a Cloudflare Worker.
Data processed: uploaded media content, technical object identifiers and, when content is retrieved, the IP address, HTTP headers, and time-limited access token
Data location: The production bucket was created with the immutable R2 jurisdiction “European Union (EU)”. Cloudflare guarantees that R2 objects using this setting are stored and processed within the EU. The bucket jurisdiction does not automatically cover all Cloudflare account, Worker, log, or other operational data.
Legal basis: Art. 6 (1) lit. b GDPR (providing media uploaded and retrieved by users)
Privacy and data processing: cloudflare.com/privacypolicy · Cloudflare DPA
4.5 Push notifications — Google Firebase Cloud Messaging
Provider: Google Ireland Limited, Ireland (parent company Google LLC, USA)
Data processed: your device's push token, the notification content (e.g. event name, sender name and, for chat messages, a shortened preview), and technical connection data such as the IP address. The link between a push token and your account (together with a random installation ID, platform, and app version) is stored only in our database; we do not send a huddl user ID to Google. On iOS, notifications are additionally delivered via the Apple Push Notification service.
Used for: push notification delivery only; no Firebase Analytics, no advertising
Data location: Google operates Firebase Cloud Messaging on global infrastructure; processing cannot be restricted to the EU (see section 6).
Legal basis: Art. 6 (1) lit. a GDPR (consent via your operating system's permission prompt; can be withdrawn at any time in your device settings)
Privacy: firebase.google.com/support/privacy · policies.google.com/privacy
4.6 Purchase and subscription management — RevenueCat
Provider: RevenueCat Inc., USA
Data processed: pseudonymous user ID (huddl account ID), store transaction and product data (product, purchase and expiry date, price and currency, renewal and refund status), platform (iOS/Android), and technical connection data; no payment details. If you delete your account, we also request deletion of your customer data at RevenueCat.
Legal basis: Art. 6 (1) lit. b GDPR (for huddl Pro and the Event Pass)
Privacy: revenuecat.com/privacy
4.7 Error and performance monitoring — Sentry
Provider: Functional Software, Inc. (Sentry), USA — data stored in the EU (Frankfurt am Main)
Data processed: error reports and stack traces, sampled performance measurements (e.g. app start time), device and operating-system information, app version, and technical connection data. No user ID is attached to error reports; email addresses, links, tokens, and similar details are automatically removed from reports before they are sent.
Legal basis: Art. 6 (1) lit. f GDPR (stability, bug fixing)
Privacy: sentry.io/privacy
4.8 Product analytics — PostHog
Provider: PostHog Inc., USA — EU hosting
Data processed: usage events (e.g. "login", "event created"), screens viewed, app launches and moves to the background, technical app/device information and, during purchases, store offer metadata (product ID, plan, price, currency, entry point, and result). After sign-in, this data is linked to your huddl account ID (pseudonymous). No message content, names, email addresses, or addresses, no IP storage.
Used: only in the huddl app (not on the website)
Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in product improvement); enabled by default with the option to disable at any time in the app under Settings → Privacy & Safety → Usage analytics (opt-out)
Privacy: posthog.com/privacy
4.9 Maps & address search — Google Maps
Provider: Google Ireland Limited, Ireland
- Map preview: If an event or chat message contains a location, the app on iOS and Android automatically loads a small map via the Google Maps SDK when it is displayed. The map area (coordinates) and technical connection data such as the IP address are transmitted to Google. Event owners can hide the map preview for a location field.
- Address search: Search requests pass through our Supabase proxy to the Google Places API; the entered search terms are transmitted, but no huddl user ID is sent to Google.
- Address resolution: To convert between addresses and coordinates, the app uses your operating system's geocoding service (Apple or Google).
- Navigation: If you choose "Navigate", the maps app you select (e.g. Google Maps or Apple Maps) opens with the destination address.
Legal basis: Art. 6 (1) lit. b GDPR (displaying and selecting event locations)
Privacy: policies.google.com/privacy
4.10 Authentication — Apple / Google Sign In
Optionally, huddl supports sign-in with an Apple ID or Google account. Only the data needed for sign-in is transferred (Apple: email address — optionally as a private relay address — and name; Google: email address, name, and profile picture link). Apple and Google process the sign-in under their own responsibility. When you delete your account, we revoke an existing "Sign in with Apple" connection.
4.11 Transactional emails — Resend
Provider: Resend Inc., USA
Data processed: email address; content of confirmation, password-reset, email-change, or retention emails (in particular the deadline and, where applicable, event name)
Legal basis: Art. 6 (1) lit. b GDPR (account verification and contractual retention notices) and Art. 6 (1) lit. f GDPR (documented, fair advance warning before deletion)
Privacy: resend.com/legal/privacy-policy
5 · Cookies and similar technologies
Details in the Cookie Notice. Short version:
- Strictly necessary (website):
NEXT_LOCALEstores your language choice; your theme setting (light/dark) is kept in your browser'slocalStorage. Both are required for operation and exempt from consent (§ 25 (2) TDDDG). - We set no tracking, analytics, or marketing cookies on the website. No consent banner is required while this remains the case. We will obtain consent before using non-essential technologies.
- Product analytics in the app (PostHog) is pseudonymous, enabled by default, and can be disabled at any time under Settings → Privacy & Safety → Usage analytics (opt-out).
6 · Third-country transfers
Some services (Supabase, Vercel, Cloudflare, RevenueCat, Sentry, PostHog, Resend, Apple, Google) have US parent companies. Account, event, and chat data as well as media metadata are stored with Supabase in Frankfurt am Main; error reports are stored with Sentry and analytics data with PostHog in the EU. Private media objects are stored and processed in a Cloudflare R2 bucket with EU jurisdiction. This R2 jurisdiction applies to the objects in the bucket, not automatically to all account, Worker, log, and operational data of the US provider Cloudflare. Push notifications (Firebase Cloud Messaging) are delivered via Google's global infrastructure; processing outside the EU, in particular in the US, cannot be ruled out. Where data is transferred to the US, this is based on:
- EU Standard Contractual Clauses (Art. 46 (2) lit. c GDPR)
- EU-US Data Privacy Framework (for certified providers)
7 · Retention periods
| Data category | Retention |
|---|---|
| Account and profile data | Until account deletion. On deletion, your own events are deleted, your photos and videos in other people's events are removed, and your chat messages in other people's events are replaced by a neutral placeholder without content or link to you. |
| Event content and media | Until the event owner deletes the event or account, an event/media/storage violation remaining after Pro or Event Pass access is remedied after 90 days, or there has been no meaningful signed-in event activity for 24 months. Automatic deletion is preceded by the notices, choices, protections, and final re-check in sections 9.3–9.5 of the Terms. The inactivity period for existing content starts no earlier than introduction of the rule. |
| Retention status, selections, notice and deletion log | For the open retention case; completed case and delivery records are generally kept for up to 400 days afterwards for troubleshooting, accountability, and notice deduplication. |
| Chat messages | Until the event/account is deleted or a message is deleted manually |
| Declined invitations | 14 days after the decline |
| Push tokens | Until you sign out on the device, delete your account, or Firebase reports the token as invalid (e.g. after uninstalling the app) |
| Reports and moderation decisions | Until the reporting person's account is deleted; the link to a reported user is removed when that user's account is deleted |
| In-app feedback | As long as needed to handle it and improve the product; when you delete your account, the link to your account is removed |
| Server and security logs available to us | generally no more than 30 days; longer for a specific security incident where required for investigation or by law |
| Database backups | Daily backups are overwritten after 7 days; deleted data may remain in a backup until then |
| Media delivery per event (bytes per day and media type) | 400 days; contains no record of who accessed content |
| Purchase and subscription status in your account | Until account deletion |
| Records relevant under commercial and tax law (e.g. store sales and payout reports) | According to statutory periods (§ 147 AO, § 257 HGB), up to 10 years |
8 · Your rights
You have the right at any time to:
- Access your stored data (Art. 15 GDPR)
- Rectification of incorrect data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR) — in-app under Settings → Danger Zone → Delete Account
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing based on legitimate interests (Art. 21 GDPR) — for product analytics directly in the app under Settings → Privacy & Safety → Usage analytics
- Withdraw consent with effect for the future (Art. 7 (3) GDPR) — for push notifications in your device settings
To exercise your rights: legal@huddl.me
9 · Right to lodge a complaint
You have the right to lodge a complaint with a data-protection authority. The relevant authority is typically the one in your federal state of residence or our place of business.
For our place of business in Hesse, this is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)
Postfach 3163, 65021 Wiesbaden, Germany
Email: poststelle@datenschutz.hessen.de
10 · Changes to this policy
We may update this notice when introducing new features or services. We'll communicate material changes by email and/or in-app.
Last updated: September 2026