Privacy
Huddle is for deciding where to go with people you already know. That needs very little about you, so we hold very little. This page says exactly what, and what we have gone out of our way not to.
Last updated: not yet published
What we hold
- Your name
- A first name, and a last name if you give one. Your groups see it, because the point is that your friends recognise you.
- A username
- So people can find you to invite you. You can switch that off in Settings, and then nobody can look you up by it.
- Your birthday
- Optional. The day and month drive birthday nudges and star-sign touches. A year, if you give one, is only ever sent back to you. The shape we use to describe somebody else to your group has no field for it at all.
- A photo
- Optional. If you do not add one, you get a drawn avatar generated from your account number, not from your name or your address.
- Your answers
- Your six vibe-quiz answers, your votes, and ideas you save. Quiz answers are what the recommendations are built from.
- Your groups
- Which groups you are in, your role in them, and when you joined.
- Your plans
- Events your groups make, who said they were coming, and where they are meeting.
- Your settings
- Theme, notification choices, quiet hours and your device's time zone, which is how quiet hours know when your evening is.
What we don't hold
On a page like this the absences are the substance, so here they are first.
Your email address is not in our database
Sign-in is handled by a separate identity service that holds your address and nothing else about you. Our own database has no column for it. When we need to email you, the part of the system that sends mail asks that service for the address at that moment, which is why you will never find your address in a Huddle log, an export or an error report. It is also why a deletion is final: after the identity is gone, nothing we keep could find you again.
No analytics, no trackers, no ad tech
- No third-party analytics in the app or on this website.
- No tracking pixel in any email we send, so opening one tells us nothing.
- No advertising identifiers, no ad networks, no data brokers.
- This site loads its own fonts from our own server rather than linking to a font service, so visiting a page does not hand your IP address to anybody else.
We don't sell or share your data
Not to advertisers, not to data brokers, not to anybody. The four services we do use are listed below and each one gets the minimum it needs to do its job.
Personal data is kept out of our logs
Our logs record what happened and which account it happened to: an account number, never a name, an address, a birthday, a photo or a location. This is a rule the code is written to and tested against, not an aspiration.
Location
Huddle's whole trick is finding somewhere that suits everybody, which needs some idea of where everybody is. We keep that as coarse as the job allows.
Your home area
If you set one, we store it rounded to about 110 metres: enough to put you in a neighbourhood, not enough to say which building. It is used for one thing: working out a point that is roughly central for your group.
Setting location sharing to Never in Settings means we refuse to store a home area at all, and your groups' midpoints are worked out without you. That refusal happens on our side, not in the app, so it holds whatever a phone sends us.
Clearing your home area is the other way to take it back, and it takes effect immediately.
Owner: the app and this page disagree
Settings offers three levels and describes them as doing different things: “Always”
says your crew can see roughly where you are, and “During events”, which is the
default, says it only applies from an hour before an event until it ends. Neither is
implemented. Only never changes anything on the server
(app/services/meeting.py), so the other two behave identically and
nothing is ever time-limited.
Fix the app or build the window, then write this section to match. Do not publish a privacy page describing the three levels until one of those is true.
Your group's meeting point
A group's midpoint is calculated from the home areas of its members, and we refuse to show it until at least three people have contributed one. With one contributor the midpoint is that person's home; with two, anybody who knows their own can work out the other's. Three is the point at which it stops being a way to find out where a specific person lives. What your group sees is a neighbourhood name, which survives that rounding, not a doorstep.
While you are using the app
When the app asks for your location to sort places by distance, that reading is used there and then and is not stored. Photos you upload are re-encoded before we keep them, which removes the GPS coordinates that cameras write into image files.
Who else sees any of it
Four services, and what each one actually gets:
- The identity service
- Holds your email address and your sign-in credentials, and nothing else about you. It is the only place your address exists.
- Object storage
- Holds your photo, if you added one. Links to it are signed and expire shortly after they are issued, so an old link stops working.
- An email provider
- Gets the address and the message, because that is what sending an email is. Nothing addressed to one person is assembled from your data at send time: it is written out when it is queued, already filtered for what you are allowed to see.
- An AI model
- Gets no data about you. It is shown a venue's name and its public map tags, and asked to label the kind of place it is. It never sees a person, a group, a plan, an answer or a location.
Places themselves come from OpenStreetMap, which is a public map. We read from it; we never send anything to it.
How long we keep it
- Your account — until you delete it. We do not expire inactive accounts.
- After you delete it — minutes. Your profile, photo, answers, settings, home area and group memberships go; plans you were part of keep your reactions under the name “Someone” so that four other people do not lose a night out. Nothing in that points back at you.
- Backups — they catch up within 30 days, and then it is gone there too.
- Admin records — actions our administrators take are logged and kept for a year, then deleted automatically.
How to delete your account has the steps and the full list.
Children
Owner: fill this in before launch
- The minimum age, and how it is enforced. The app asks for a birthday but it is optional and we do not verify it, so whatever this section claims has to match that. Both app stores ask the question at submission.
Your rights
Owner: needs a lawyer, not a developer
- Who the data controller is — the registered name and address of whoever is accountable for this data.
- Your rights under Ghana's Data Protection Act 2012, which governs the Accra launch: access, correction, deletion, and how to exercise each.
- How to complain — the Data Protection Commission, and the route to it.
- Our lawful basis for each kind of processing above.
- Where the data lives and what happens when it crosses a border.
- GDPR and UK GDPR equivalents, needed before any EU or UK city. The PRD treats legal pages as per-market configuration for this reason, so this section will need to vary by where the reader is rather than being replaced.
Two of these you can already act on without asking us. You can delete your account yourself from inside the app, and you can change or switch off every email we send from your email preferences or in Settings. A data export in JSON is promised and not built yet.
Changes to this page
Owner: fill this in before launch
- How we tell you. Email is the honest answer, and we have a “Huddle news” preference that would carry it.
Getting in touch
Owner: fill this in before launch
- A contact address for privacy questions. Both app stores require one that works, and so does the deletion page.