This privacy policy applies to the Huglet app (hereinafter "Application") for iOS and Android mobile devices, developed by Vadim Plămădeală (hereinafter "Service Provider") as a Freemium service. This service is provided "AS IS". Last updated: 12 July 2026.

Huglet connects you with a person you choose so you can send little things to their phone — a drawing or note that appears in their home-screen widget, a recorded "touch" (a vibration pattern), and, on Android, a wallpaper. To make that work, Huglet uses an account and a server. We store only what's needed to deliver your hugs, we never sell your data, and we show no ads. The person you connect with controls exactly what you're allowed to send them.

Huglet creates an anonymous account for you automatically — no email or password required to start. You may optionally link Sign in with Apple or Google, which we use only to let you restore your data on a new device (see Cloud Backup). We do not receive your password from Apple or Google.

• Profile — a display name and emoji you choose, and your device platform (iOS/Android) and widget sizes, so the sender can draw at the exact size you'll see. This is not your legal name unless you type it.
• Connections (pairs) — who you are connected with and the invite codes used to connect, so hugs reach the right person.
• Content you send — drawings, notes, recorded touch patterns, and (Android) wallpapers. Drawings and wallpapers are stored as images on our server so they can be delivered and, for Huglet Plus, kept in your history. Content is visible only to you and the person you sent it to.
• Permissions you set — what each connected person may send you, daily limits, and quiet hours. These are enforced on our server, not just in the app.
• Push token — a Firebase Cloud Messaging / Apple Push token so we can deliver a hug to your device and refresh your widget.
• Diagnostics — crash reports and basic usage analytics (Firebase Crashlytics / Analytics) to fix bugs and improve the app.
• Purchases — if you buy Huglet Plus, our payments partner RevenueCat and the app stores process the purchase and tell us whether your subscription is active. We never see your card details.

• No advertising and no ad networks.
• No selling or renting of your personal data.
• No reading your contacts unless you explicitly choose to invite from contacts — the default is a share link or QR code.
• No location tracking.

Huglet's backend runs on Supabase (database, storage, and functions) hosted in the EU. Push delivery and diagnostics use Google Firebase. Subscriptions use RevenueCat and the Apple App Store / Google Play. These providers process data on our behalf under their own security and privacy terms.

Delivered hugs are kept so the recipient can see them in their widget and, for Huglet Plus, in history. Free accounts keep history for 7 days; older events are removed automatically. You can delete individual items, or your whole account, at any time (see Delete Your Data). When you delete your account we remove your profile, your connections, your stored content, and your push token.

Huglet is intended for people aged 13 and older (16 in some regions). It is not directed at young children, and we do not knowingly collect data from them.

Depending on where you live (for example under the EU/UK GDPR), you have the right to access, correct, export, or delete your personal data, and to object to certain processing. You can delete your data yourself in the app, or contact us using the email below. We will respond within the time your law requires.

Access to your data is restricted by per-user database rules so that only you and the people you're connected with can read your content. We use encrypted connections (HTTPS/TLS). No method of transmission or storage is 100% secure, but we take reasonable measures to protect your information.

We may update this policy as the app evolves. Material changes will be posted here with a new "last updated" date.

Questions or requests: vitp.work@gmail.com.