Privacy Policy

What Data We Collect

We collect the following information when you use Huggu:

• Account data: your email address and display name
• Greeting data: recipient name, recipient email, message content, chosen bear character, and anonymous/named preference
• Delivery data: email delivery status (sent, delivered, bounced, opened)

How We Use Your Data

• To deliver your greeting emails to recipients
• To authenticate you and maintain your account
• To show you the delivery status of your greetings
• To improve the product and diagnose issues
• To enforce our Terms of Service and prevent abuse

Legal Basis (GDPR)

If you are located in the European Economic Area (EEA), Switzerland, or the United Kingdom, we process your personal data on the following legal bases:

• Performance of a contract — to deliver your greetings and maintain your account
• Consent — where you have explicitly agreed to our Terms and Privacy Policy
• Legitimate interests — to improve the service, prevent abuse, and ensure security

Anonymous Sending

When you choose to send a greeting anonymously, the recipient does not see your name or email address. However, your account identity is stored internally alongside the greeting for abuse prevention purposes. We do not share your identity with recipients of anonymous greetings, except as required by law or in response to a valid abuse investigation.

Recipient Data

Recipient names and email addresses are stored to deliver greetings and to show you the status of your sends. We do not use recipient data for marketing purposes. Every greeting email includes an unsubscribe link; once unsubscribed the recipient's email is suppressed and no further emails will be sent. Recipients can also request removal of their data by contacting us at jens@huggu.app.

Cookies and Local Storage

Huggu uses the following storage technologies:

• Supabase authentication cookies — required to keep you signed in
• huggu_locale cookie — stores your chosen display language so Huggu renders in the language you selected. It contains only a language code (for example "en" or "de"), no personal data, and expires approximately one year after it is set. It is necessary for language display and is not used for tracking, advertising, or profiling. Because it is required to provide the language you requested, it is exempt from consent requirements under the ePrivacy Directive and GDPR, but we disclose it here for transparency.

We do not use cookies for advertising, tracking across third-party sites, or any purpose beyond the essential operation and improvement of Huggu.

Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS) and at rest, access controls, and regular dependency updates. Personal message content and recipient details are never included in application logs.

International Data Transfers

Huggu operates globally. Your data may be transferred to and processed in countries outside your residence, including the United States and the European Union. Where such transfers occur, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) adopted by the European Commission.

Third-Party Processors

We share data with the following processors as necessary to operate the service:

• Supabase (EU/US) — database and authentication storage
• Resend (US) — transactional email delivery to recipients
• Vercel (US/EU) — web hosting and serverless compute

Data Retention

We retain greeting data for as long as your account is active, plus up to 12 months after account deletion to support abuse investigation and legal obligations. Anonymized analytics data may be retained longer. You can delete your account at any time by contacting us.

Your Rights

You have the right to access, correct, or delete your personal data. If you are located in the EEA, Switzerland, or the UK, you also have the right to data portability and to lodge a complaint with your local data protection authority. To exercise your rights, email us at jens@huggu.app. We will respond within 30 days.

Children

Huggu is not intended for children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes and, where required, seek your renewed consent.