Privacy policy

1. Personal Data we collect

Personal Data you provide

• Account information. When you create an account we collect the email address you give us, or the identity your Google or Apple sign-in passes to us, and a phone number if you verify one. If you fill in a profile we collect your name, photo, time zone and the tone you picked.
• Content. What you log and send is Content: ratings for each area, mood and energy, your evening answers, workouts and bests, commitments and the ticks on them, the people you add and when you last reached them, the month’s spend in broad strokes, joy days and rituals, and the documents you send us (statements, reports, photos of them). Messages you exchange with Huppy on WhatsApp are Content too. Content may include information about your health that you choose to log.
• Communications. If you write to us, we collect your contact details and what you wrote.

Personal Data we receive from your use of the Services

• Log data. Your IP address, browser or device type and settings, the date and time of each request, and how you interact with the Services.
• Device data. Device model, operating system, app version, language and time zone, and the push token that lets us deliver notifications to that device.
• Usage and crash data. Which screens you use and what breaks, collected only while usage data is turned on in Settings.
• Approximate location. The general area your IP address points to, used for security and to set your time zone. Huppy does not collect precise location.
• Cookies and similar technologies. huppy.io and app.huppy.io use the cookies and local storage they need to work and to keep you signed in, and may use privacy-respecting analytics to see how the pages are used. Huppy does not use advertising cookies and does not respond to browser Do Not Track signals, because there is no cross-site tracking to turn off.

What Huppy does not collect. Huppy does not currently access your calendar, contacts, precise location, bank accounts or health apps, and does not take payments. If that changes, this policy changes first.

2. How we use Personal Data

We use Personal Data for the following purposes:

• To provide, operate and maintain the Services: to sign you in, store your log, show you your wheel, and send the reminders you asked for.
• To read the documents you send: an AI model extracts figures and dates and proposes an entry, which you confirm or undo. Huppy may use AI models for other tasks in future, such as answering you in the WhatsApp chat. The model performs the task on your data and does not keep it.
• To communicate with you: sign-in codes, your export link, replies to your messages, and notices about the Services or changes to them. Huppy does not send marketing email today; if it does, you will be able to unsubscribe.
• To improve and develop the Services, understand how they are used and fix what breaks, using aggregated or de-identified data where we can and usage data only where you turned it on.
• To keep the Services safe: to detect, investigate and prevent fraud, abuse and security incidents, and to enforce our terms.
• To comply with legal obligations and to protect the rights, privacy, safety and property of Huppy, our users and others.

We may aggregate or de-identify Personal Data so that it no longer identifies you, and use and share that information for any purpose. We keep it in that form and do not attempt to re-identify it unless the law requires us to.

3. Disclosure of Personal Data

We disclose Personal Data in the following circumstances:

Service providers. Companies that work for us under contract and may use Personal Data only to perform their services for us:

We may add or replace providers as the Services change, under the same limits, and keep this table current.

People you share with. If you share a commitment or accept an invite, that person sees the commitment, your ticks on it, your name and your photo. Share only with people you trust; Huppy cannot control what another person does with what you showed them. People you add under Relationships are your own notes; Huppy does not contact them.

WhatsApp. If you turn WhatsApp on, your messages travel through WhatsApp, and Meta’s own terms and privacy policy apply to your side of the conversation.

Legal, safety and enforcement. We may disclose Personal Data to public authorities or other third parties where we believe in good faith that it is required by law, a court order or a lawful request; to enforce our terms or investigate a possible violation of them; to detect, prevent or address fraud, abuse or security threats; to protect the rights, safety or property of Huppy, our users or the public; or to defend against legal liability.

Business transfers. If Huppy is involved in a merger, acquisition, financing, reorganisation, bankruptcy or sale of some or all of its assets, Personal Data may be disclosed to the parties involved in evaluating the transaction and transferred to the successor as part of it. The successor is bound by this policy unless it tells you otherwise.

Affiliates. Entities that control, are controlled by or are under common control with Jo&Ko Ventures, LLC, who may use Personal Data consistently with this policy.

Aggregated or de-identified data. We may share information that no longer identifies you with third parties for the purposes in section 2.

Huppy does not sell Personal Data and does not share it for targeted advertising.

4. Retention

We keep Personal Data for as long as we need it to provide the Services to you, and for legitimate business purposes such as security, resolving disputes and meeting legal obligations. How long depends on the type of data and your settings.

• Until you delete it. Your Content and account information stay until you delete the entry or your account. After the 30-day grace period that follows an account deletion request, your data is removed from our live systems and falls out of backups within a further 7 days.
• Deleted automatically. WhatsApp messages after about 30 days (the answers you gave stay in your log); a device’s push token when you sign out on that device; export files 7 days after the link is sent.
• Kept longer. We may keep Personal Data for longer where the law requires it, for example under a lawful subpoena; to address fraud, abuse or security incidents; to resolve disputes or enforce our terms; and as a record of your consents and of your deletion request, so we can show we honoured them.

In setting these periods we weigh why we hold the data, how sensitive it is, the risk of harm from unauthorised use and the legal requirements we are under.

5. Data controls

In Settings you can:

• Turn each consent on or off: WhatsApp check-ins, document reading, usage and crash data. Each is recorded with its version and the time you set it. Turning one off stops that processing going forward; it does not undo what was already done.
• Delete any entry, document or person you added.
• Export your data. A download link normally arrives by email within 24 hours, and in any case within 30 days, and works for 7 days. We may ask you to confirm your identity first.
• Delete your account. It closes at once and the 30-day grace period starts; sign in during those 30 days to cancel. How to delete your account.
• Turn WhatsApp off, or reply STOP in the chat.
• Manage notifications on each device through its operating system.

6. Your rights

Depending on where you live, you may have the right to access the Personal Data we hold about you, to correct it, to delete it, to receive a copy in a portable format, to withdraw a consent, to restrict or object to certain processing, and to complain to a regulator.

You can exercise most of these rights yourself in Settings (section 5). For anything else, write to hello@huppy.io from the email address on your account. We may need to verify that it is you before we act; if we cannot, we may be unable to honour the request. We respond within 45 days, and tell you if the law allows us longer. We do not treat you differently for exercising a right. Where the law allows, you may use an authorised agent, who must show written permission, and you may appeal a decision we make by writing to the same address.

A note on accuracy. The entries Huppy proposes from a document come from an AI model and can be incomplete or wrong. Check them before you rely on them, use Undo to reject one, and tell us at hello@huppy.io if something about you is recorded incorrectly.

Where your data is processed. Huppy processes and stores Personal Data on servers in the United States. If you use the Services from elsewhere, your data is transferred to, stored and processed in the United States, where privacy law may differ from your country’s, and we apply this policy to it wherever it is.

7. Children

The Services are not directed to children under 13, and Huppy is for people aged 16 and over. We do not knowingly collect Personal Data from anyone under 16. If we learn that we have, we delete the account and its data. If you believe a child has an account, write to hello@huppy.io.

8. Security

We use commercially reasonable technical, administrative and organisational measures to protect Personal Data from loss, misuse and unauthorised access, disclosure, alteration or destruction: encryption in transit and at rest, database rules that let each person reach only their own data and what was shared with them, keys and tokens held in a managed secret store and never in the app, and access by our own people limited to what is needed to run, support and secure the Services. No system or transmission is fully secure, and we cannot guarantee that Personal Data will never be accessed without authorisation. Keep your sign-in to yourself and your device locked. If a security incident affects you, we notify you as the law requires.

9. Additional U.S. state disclosures

Some state privacy laws require specific disclosures. The table reads with sections 1 to 4 above.

Depending on your state and subject to exceptions, you may have the right to know what Personal Data we process about you and to access it in a portable format, to delete it, to correct it, and to be free from retaliation for exercising these rights. We do not sell Personal Data, do not share it for cross-context behavioural advertising, do not process it for targeted advertising, and do not use sensitive Personal Data to infer characteristics about you beyond showing you your own entries. Where state law treats health-related entries as consumer health data, this policy is also our consumer health data privacy notice. To exercise a right, use Settings or write to hello@huppy.io; verification, authorised agents and appeals work as described in section 6.

10. Changes to this privacy policy

We may update this policy from time to time. When we do, we post the new version here with a new effective date. For a material change we tell you in the app or by email before it takes effect, unless the law requires another form of notice. Using the Services after the effective date means the new version applies to you.

11. Data controller

Jo&Ko Ventures, LLC, a Delaware limited liability company, is the controller of, and the business responsible for, the Personal Data described in this policy.

12. How to contact us

Write to hello@huppy.io with any question or request about this policy. Include the email address on your Huppy account so we can find you.