1. Home
2. Legal documents
3. Huglet
4. Privacy Policy

This privacy policy applies to the Huglet app (hereinafter "Application") for iOS and Android mobile devices, developed by Vadim Plămădeală (hereinafter "Service Provider") as a Freemium service. This service is provided "AS IS". Last updated: 18 October 2026.

Huglet connects you with a person you choose so you can send little things to their phone — a drawing or note that appears in their home-screen widget, a recorded "touch" (a vibration pattern), and, on Android, a wallpaper. To make that work, Huglet uses an account and a server. We store only what's needed to deliver your hugs and we never sell your data for money. The free version shows ads; Huglet Plus removes them (see Advertising below). The person you connect with controls exactly what you're allowed to send them.

Huglet creates an anonymous account for you automatically — no email or password required to start. You may optionally link Sign in with Apple or Google, which we use only to let you restore your data on a new device. If you link one, our account system stores the identifier that Apple or Google gives us for you and the email address you share with us (Apple may give us a private relay address instead of your real one). We do not receive your password from Apple or Google.

• Profile — a display name and emoji you choose, your device platform (iOS/Android), your time zone, and your widget sizes, so the sender can draw at the exact size you'll see and your quiet hours work in your local time. This is not your legal name unless you type it.
• Connections (pairs) — who you are connected with and the invite codes used to connect (they expire after 7 days), so hugs reach the right person.
• Content you send — drawings, notes, stickers, photos you add to a hug (Huglet Plus), recorded touch patterns (a timeline of vibration strengths — never audio), and (Android) wallpapers, plus when each item was sent and delivered. A hug is sent as one finished picture, so a photo you add travels inside it, at the size of the widget. Drawings and wallpapers are stored as images on our server so they can be delivered and, for Huglet Plus, kept in your history. When neither of you has Huglet Plus, a picture is removed from our server an hour after it is delivered (the recipient's phone keeps its copy). Content is visible only to you and the person you sent it to, except as described under Reports below.
• Permissions you set — what each connected person may send you, daily limits, and quiet hours. These are enforced on our server, not just in the app.
• Reports — if you report something you received, we keep the report and the reported item so we can review it and act on it. This is the only case where we look at content you did not send to us.
• Push token — a Firebase Cloud Messaging / Apple Push token so we can deliver a hug to your device and refresh your widget.
• Diagnostics and usage — crash reports and basic usage analytics (Firebase Crashlytics / Analytics), tied to a random app identifier rather than your name, to fix bugs and improve the app.
• Purchases — if you buy Huglet Plus, our payments partner RevenueCat and the app stores process the purchase and tell us whether your subscription is active. We never see your card details.
• Server logs — our hosting providers keep short-lived technical logs (such as IP address and request time) for security and abuse prevention. When you enter an invite code, we record the attempt with a one-way hash of your network address for 24 hours, so nobody can guess codes by trying many of them.

The free version of Huglet shows ads served by Google AdMob: a single banner on the screen where you draw or write; a full-screen ad shown only after you finish sending something, at most once every few sends; and, only if you choose it, an ad you can watch to use a Huglet Plus feature once (for example a premium brush you picked, for one drawing, or one recorded touch). We never show ads when you receive a hug, and never on the widget. Huglet Plus removes all ads.

When you watch such a chosen ad to the end, Google tells our server so, together with your Huglet account ID, so that the feature you unlocked works once. We keep a record of these unlocks (which kind, when, and Google's reference number for it) for 30 days; it is deleted with your account.

To show and measure ads, Google and its advertising partners may receive your device's advertising identifier and other device identifiers, your IP address, device and app information, and approximate location derived from the IP address. We never share your drawings, notes, touches, wallpapers or the identity of the people you are connected with with advertisers.

Your choices. In the European Economic Area, the United Kingdom and Switzerland, Huglet asks for your consent (through Google's consent form) before ads that use your data are shown; if you decline, you still see ads, but they are not personalised. In the US states that give you the right to opt out of the "sale" or "sharing" of personal information, you can do so through the "Do Not Sell or Share My Personal Information" choice. On iOS, Huglet asks permission to track you across other companies' apps and websites (App Tracking Transparency) and respects your answer. You can change or withdraw these choices at any time in Settings → Privacy settings in the app, and in your device's advertising settings (for example by resetting or limiting your advertising identifier).

• We do not sell your personal data for money, and we do not rent it.
• We do not read your contacts.
• We do not collect precise location. (Advertising partners may infer an approximate location from your IP address, as described above.)
• We do not use your microphone. The camera opens only when you choose to take a photo for a hug, and your photo library only when you choose a photo; nothing is read from them otherwise.
• We do not show ads to the person receiving a hug, or on the widget.

Huglet's backend runs on Supabase (database, storage and functions), hosted in the EU (Frankfurt). The following providers process data on our behalf or independently, under their own security and privacy terms:

• Supabase — accounts, database, storage and server functions
• Google Firebase — push delivery (Cloud Messaging), crash reports (Crashlytics), usage analytics and remote settings
• Google AdMob — advertising in the free version
• RevenueCat — purchase and subscription management
• Apple — App Store purchases, push delivery on iOS, and Sign in with Apple
• Google — Google Play purchases, push delivery on Android, and Sign in with Google

Some of these providers (including Google and RevenueCat) may process data outside the European Economic Area, including in the United States. Where data leaves the EEA or the UK, it is protected by safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

We process your data to perform our contract with you (providing the account, delivering hugs, enforcing permissions, handling purchases); on the basis of your consent (personalised advertising and tracking, which you can withdraw at any time without affecting earlier processing); for our legitimate interests (keeping the service secure, preventing abuse, handling reports, fixing crashes and improving the app); and to comply with legal obligations.

Delivered hugs are kept so the recipient can see them in their widget and, for Huglet Plus, in history. When neither person in a connection has Huglet Plus, a delivered picture is removed from our server an hour after delivery, and hugs older than 30 days are removed automatically. If either of you has Plus, the pictures and history between you are kept until you delete them, so the person with Plus can see them again and put one back on their widget. An account that has not been used for 24 months is deleted automatically, together with its data. You can delete individual items, or your whole account, at any time (see Delete Your Data). When you delete your account we remove your profile, your connections, the content stored on our servers, your permissions, and your push token. Because a connection involves two people, the hugs exchanged within a connection are removed with it. A copy already showing in someone's widget is cleared on its next refresh. Reports are kept only as long as needed to handle them. Crash and analytics data held by Google is kept for a limited period (at most 14 months). Technical server logs are kept for a short rolling period. Subscription records held by the app stores and RevenueCat follow their own policies and may be kept for legal and accounting reasons.

Depending on where you live (for example under the EU/UK GDPR), you have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, to withdraw consent, and to complain to your national data protection authority. You can delete your data yourself in the app (Settings → Account → Delete account), or contact us using the email below. We will respond within the time your law requires, and in any case within 30 days.

US state privacy rights. We do not sell your personal information for money. Using an advertising identifier to show personalised ads can count as "sharing" or "targeted advertising" under some US state laws (for example California's). Residents of those states can opt out through Settings → Privacy settings in the app, by turning off ad personalisation or resetting the advertising identifier in their device settings, and can ask to know, correct or delete their data by emailing us. Where technically supported, we honour opt-out preference signals such as Global Privacy Control. We will not treat you differently for exercising these rights.

Huglet is intended for adults aged 18 and older. It is not directed at children or teenagers, and we do not knowingly collect data from anyone under 18. If you believe someone under 18 has given us data, contact us and we will delete it.

Access to your data is restricted by per-user database rules so that only you and the people you're connected with can read your content. We use encrypted connections (HTTPS/TLS). No method of transmission or storage is 100% secure, but we take reasonable measures to protect your information.

We may update this policy as the app evolves. Material changes will be posted here with a new "last updated" date.

Questions or requests: vitp.work@gmail.com.