Privacy Policy
In short: we keep the minimum the game needs. No ads, no tracking, no selling data. You sign in with your email and a code, no passwords. You can delete your account at any time.
1. Data controller
Camilo Buitrago, an individual (Colombian ID C.C. 1.024.526.498) domiciled in Pereira, Risaralda, Colombia ("we"), is the controller of your personal data in the HugDeck app and on this website. Privacy contact: privacidad@hugdeck.com · phone +57 322 560 5639.
This policy follows Colombia's Law 1581 of 2012 and Decree 1377 of 2013 and also serves as our privacy notice. If you live elsewhere, you also have the rights your local law gives you (see section 8).
2. What we collect
| Data | Why |
|---|---|
| Email address | To create your account and send you the sign-in code (we don't use passwords). We don't send you marketing. |
| Name (the one you choose) | To show it to your partner in the app and in notifications. |
| Date of birth (optional) | If you give it, to check that you are 18 or older. It can only be set once. |
| User ID | A random code that identifies your account in our systems and our providers'. |
| Couple and game activity | Your couple and invites; your decks and cards; the cards you play and receive with their status and dates; the short reasons you give when you can't fulfil one; reactions; the cards you vetoed. This is the game itself. |
| Card choice details | Whether you live in the same city (yes or no) and what you have at home (dog, car, bike, plants), so we don't deal cards you can't fulfil. Both members of the couple see it. |
| Reminder preference | Whether you want reminders about cards you still have to fulfil. |
| Language and time zone | To show the app and notifications in your language, and to know when each day and round starts for the couple. |
| Device push identifier | To send you push notifications (through OneSignal), if you allow them. Notifications never say which card was played on you. |
| Purchase history | To know whether your couple has HugDeck Pro: product, transaction ID, expiry and status (through RevenueCat). We do not receive your card or payment details; Apple or Google handle those. |
| Technical data | Our infrastructure providers log technical data for each request (such as IP address and time) for security and troubleshooting. |
We do not collect your location, contacts, photos, microphone or advertising ID. We don't use analytics or tracking tools, in the app or on this site, and this site sets no cookies.
3. How we use it and on what basis
- To provide the service (account, game, couple, notifications, Pro): based on the authorization you give us when you create your account, and to perform our terms.
- Security and abuse prevention: our legitimate interest in protecting the service and its users.
- Legal, accounting and tax obligations, and to answer your requests.
We don't sell or rent your data, show ads, build advertising profiles or track you across other apps or sites.
4. What your partner sees
Your partner sees your name, how many cards you have left (never which ones), the cards you play on them, your responses to theirs (including your reason if you say you can't), reactions, your shared album and, if one of you paid for Pro, who paid. Your email and date of birth are never shown to your partner.
5. Who we share it with
Only with providers that help us run the service (processors), under contract and only for that purpose:
- Supabase: database, authentication and server functions, where the app's data is stored. Region: United States (Ohio).
- Resend: sends the sign-in code emails.
- OneSignal: sends push notifications. It receives your user ID, your device's push ID and the notification text (which may include your partner's name).
- RevenueCat: manages subscriptions. It receives your user ID, your couple's ID in the app and your store purchase data.
- Apple and Google: distribute the app and process payments as independent controllers, under their own privacy policies.
We may also disclose data when a competent authority requires it under the law.
International transfers: these providers may process data outside Colombia, for example in the United States or the European Union. By using HugDeck you authorize that transfer; we require providers to apply appropriate security and confidentiality measures.
6. How long we keep it
- While you have an account, we keep your data so the game works.
- If you delete your account, we immediately delete your email, name, date of birth and language. The history you shared with your partner stays with them, without your name or account (details on the delete-your-account page).
- The couple's purchase records are kept for 10 years for accounting and tax obligations and to handle refunds or fraud.
- Backups expire automatically within 30 days. Technical logs are kept for each provider's retention period.
7. Security
Data is encrypted in transit (HTTPS/TLS). Each user can only read their own couple's data, and important changes go through server functions that validate every step. We don't use passwords: access depends on your email. No system is perfect; if an incident affects your data, we'll tell you and the authorities when the law requires it.
8. Your rights
Under Colombia's Law 1581 of 2012 (habeas data) you have the right to:
- know, update and correct your data;
- ask for proof of the authorization you gave us;
- be told how we have used your data;
- revoke your authorization and ask us to delete your data, unless we have a legal duty to keep it;
- access your data free of charge;
- file complaints with the Superintendence of Industry and Commerce (SIC), after first raising them with us.
If you live in the European Union, the United Kingdom, California or another place with similar laws (such as the GDPR or the CCPA), you can also ask for a portable copy of your data, object to or restrict certain uses, and complain to your data protection authority. We don't sell or "share" personal data for advertising, and we won't treat you differently for exercising your rights.
How to exercise them: write to privacidad@hugdeck.com from your account's email address. We answer queries within 10 business days and claims within 15 business days, as Colombian law sets. You can also delete your account directly in Settings.
9. Children
HugDeck is only for people aged 18 or older. We don't knowingly collect data from minors; if you believe a minor created an account, write to us and we'll delete it.
10. This website
hugdeck.com is a static site: no cookies, analytics or third-party scripts. If you email us, we use your message only to reply.
11. Changes to this policy
If we change it in a significant way, we'll let you know in the app or on this site before the change applies. The date above shows the latest version.
12. Contact
Camilo Buitrago (HugDeck) · C.C. 1.024.526.498 · Bosques de Santa Helena II, Pereira, Risaralda, Colombia · +57 322 560 5639 · privacidad@hugdeck.com