Huddle Privacy Policy

Effective 2026-10-09 · Last updated 2026-10-13 · Applies to Huddle for iOS (com.hyperfocused.family-apps), published by Hyperfocused Apps.

What Huddle saves on your phone

Huddle is a collection of small tools, and each tool keeps what you put into it: the names and nicknames you type for family members, chores, stars and rewards, allowance amounts, coupons and bedtime settings. All of this is stored in the app’s own storage on your phone. We cannot see it, and it does not leave the phone unless you turn on the backup described below.

You can clear a single tool from its own settings, or clear everything with Delete my data (Settings → Your data). Deleting the app from your phone also deletes everything it saved there, with two exceptions described next.

What stays in the iPhone keychain

Huddle keeps two small secrets in the iPhone’s keychain rather than in the app’s own storage, because the keychain is the safer place for them. iOS does not empty an app’s keychain when the app is deleted, so these two outlive deleting Huddle:

• A household’s recovery code, on the phone of a grown-up who created or recovered the household. It is what lets that phone take the household back after Huddle is deleted and installed again. To remove it from the phone: leave the household or delete it, use Delete my data, or go to Settings → Your household → Recovery code → Hold to forget the code on this phone. Do one of these before deleting the app if you don’t want the code left behind. Removing it from the phone does not cancel the code; the household’s organizer can replace it at any time.
• Kid Mode’s PIN, as a salted hash (never the PIN itself), with the count of wrong tries. A freshly installed Huddle discards it the first time it opens, and Delete my data and removing the PIN delete it.

Neither is sent anywhere, backed up by us, or readable by other apps. Erasing the iPhone removes both.

Usage stats on your phone

Huddle keeps simple usage stats for you to look at in Settings → Your stats: which tools you open, roughly how long each is on screen, when you last used it and on which days you used the app, and a few totals the Chore Chart already keeps for the whole chart (chores done this week, stars earned this week, and its best week of stars; never per kid). The launcher’s “recent” order and the open count on a tool’s detail sheet come from the same record; the app keeps no other. They are kept only in the app’s own storage on your phone, as one small total per tool per day. They are never sent to us or to anyone else, they are not part of the optional backup, and no analytics service is involved. You can turn them off with Keep usage stats (nothing is recorded while it is off), remove them with Clear stats, and Delete my data or deleting the app removes them too. Nothing is recorded on a phone set up as a kid’s (one that joined the household as a kid) or while Kid Mode is on, and Your stats is not shown there; while the app is starting and has not yet read which kind of phone it is, it keeps what happens in memory only, and discards it if the phone turns out to be a kid’s. One thing to know: the Chore Chart’s totals count every chore ticked on the chart, including ones a kid ticked in Kid Mode; they are totals for the whole chart, with no name and nothing about who ticked what or when.

Optional backup

Settings → Your data lets you sign in with Apple or Google. Until you do, nothing is backed up and no account exists. When you sign in:

• What is stored: the saved data of each tool (the items listed above), the sign-in’s email address (Apple lets you share a private relay address instead) and a user id that Firebase assigns. We use these only to keep your backup and to recognise you on a new phone. Firebase also keeps the IP address and device type of your sign-ins for security.
• Where: in a Firebase project owned by Hyperfocused Apps, on Google Cloud servers in the United States. Google acts as our processor and does not use your data for its own purposes. Firebase’s security rules allow only your signed-in account to read or write your backup.
• How it works: the phone keeps its copy and pushes changes to the backup a few seconds after you make them. Signing in on another phone with the same account merges the two, newer changes winning. The same account works across all Hyperfocused Apps apps.
• Signing out stops the backup. Your phone keeps its data, and the cloud copy stays until you delete it.
• Values over about 900 KB stay on the phone and are not backed up.

We use your backup for nothing else: not for advertising, profiling, analytics or contacting you.

Households (optional)

A grown-up can create a household in Settings → Your household and add up to six family phones with its 8-character code, so Chore Chart is shared between them. To do this, Huddle creates an anonymous Firebase ID for each phone (no name or email). The household holds each grown-up’s display name, each kid’s picture, everyone’s role (grown-up or kid) and the shared chores, claims, check-offs, stars and goals, each with the anonymous ID of the phone that sent it and the time. Its member list never holds a kid’s name; the names of shared chores and goals are whatever a grown-up typed, so the app suggests leaving real names out of them. Only its members can read it. Nothing else in Huddle (allowance, coupons, bedtime) leaves the phone because of a household.

Recovery code. When a household is created, the grown-up’s phone shows a 12-character recovery code to save. If that phone is lost, reset or replaced, the code lets a grown-up take the household back from another phone. We store only a salted hash of it, which no phone can read; the code itself is kept in the keychain of the grown-up’s phone and wherever they saved it. A household started on a phone that is already signed in with Apple or Google belongs to that account, and follows it to any phone; one started without signing in lives on that phone and its recovery code.

When Huddle uses the network

Huddle ships everything it needs inside the app and downloads no content. A phone that has never backed up and is in no household sends nothing over the network. A grown-up’s phone in a household also asks Expo’s update server for fixes while the app is open; a kid’s phone and a phone in Kid Mode never ask (see “App updates”, which also covers the one case where such a phone finishes a download a grown-up’s phone began). Huddle talks to our Firebase backend only in these cases, each started by a grown-up behind the parental gate:

• The optional backup, once a grown-up signs in with Apple or Google.
• A household, once a grown-up creates, joins or recovers one on that phone. From then on the phone reads and sends the household’s shared chores whenever Huddle is open, with or without a sign-in.
• Asking our server what time it is, so that Kid Mode cannot be got around by changing the phone’s date. The phone writes one document that holds nothing but the server’s time, and reads it back (each time replaces the last). It does this, and only this, in three cases: when Kid Mode is turned on on a phone that is in a household (once, to note when); while a wrong-PIN cooldown or the forgotten-PIN wait is running on a phone that is in a household, each time the household is read; and when a grown-up starts the forgotten-PIN wait or taps Check the time online. A phone that is in no household gets an anonymous ID for that last case only. Delete my data removes the document and the ID.

Like any internet request, these show Google the phone’s IP address while they are served. Leaving the household (or Delete my data) and signing out stop them.

App updates

Huddle can receive small fixes between App Store releases. They are delivered by Expo (650 Industries, Inc., United States; its service is called EAS Update), acting as our processor. To find out whether a fix is available, the app sends a request to Expo’s update server (u.expo.dev).

Huddle is used by children, so it is stricter than our other apps: it never asks for updates when it starts. It asks only while the app is open on a phone that is a grown-up’s phone in a household and is not in Kid Mode, and then at most once every six hours, however often the app is opened (if a check cannot reach the server, it tries again after fifteen minutes, then less and less often). A kid’s phone, any phone in Kid Mode, and a phone that is in no household never ask the update server for updates. Those phones get fixes through App Store updates; a grown-up’s phone that was in Kid Mode gets them once a grown-up uses Huddle on it outside Kid Mode.

One case to know about: if a phone downloaded a fix while it was a grown-up’s phone and was put into Kid Mode (or made a kid’s phone) before that fix was first used, opening Huddle can still fetch files that belong to that already-downloaded fix from Expo, with the details listed below. A phone that was never a grown-up’s phone in a household has no such download, and sends Expo nothing.

That request carries:

• A random install ID. The app creates it on the phone the first time it asks for an update and keeps it in the app’s own settings on the phone, so it is the same in every request until Huddle is deleted. It is not your name, email, account, phone number or the advertising identifier, and we never combine it with anything else we hold. It lets Expo count how many installs received an update.
• Which build is asking: that it is the iOS app, the build’s runtime version (a code for the app’s native parts), the update channel the build listens to, the ID of the update it is running and of the one it shipped with, and the IDs of any updates that recently failed to start on that phone.
• What iOS adds to every request an app makes: a User-Agent line that names the app, its build number and the versions of the system’s networking parts (which reveal the iOS version), and the languages the phone is set to (Accept-Language).
• Like any internet request, it shows Expo the phone’s IP address while it is served.

It carries none of your saved data and nothing about how you use Huddle. The update system can also attach the text of an error that stopped the app from starting; Huddle is set up to send that field empty.

If a fix is available, the app downloads it from Expo with the same details and uses it the next time it opens. What we can see in Expo’s dashboard is totals: how many installs run each update and how many failed to start it. We cannot see who they are. Expo keeps this under its own privacy policy. There is no switch for update checks in the app; they do not happen while the phone is offline, on a kid’s phone or in Kid Mode.

What we do not do

• No advertising and no ad networks.
• No analytics or crash-reporting SDKs. We do not measure how you use the app: the usage stats described above are kept by the app on your phone, for you, and never reach us.
• No tracking across apps or websites, and no advertising identifier.
• No selling, renting or sharing of your data. Two third parties handle some of it for us, and only as described on this page: Google’s Firebase, as the storage provider for the optional backup and for syncing a household; and Expo, which delivers app updates and receives a random install ID and the build’s details when the app asks for one (see “App updates”).
• No access to your contacts, photos, location, microphone or camera. Huddle asks for no such permission.

Purchases

Huddle currently has no in-app purchases. If paid features are ever added, they will be sold through Apple’s App Store. Apple handles the payment and we never receive your card or billing details; Apple shares with us only what is needed to unlock what you bought.

Children and families (COPPA)

Huddle is made for parents and other adults to run their home, and kids can use it too: on a grown-up’s phone, or on their own phone in a household or in Kid Mode. Huddle creates no accounts for children and never asks a child for a name, an email address, a phone number, a birthday or a photo.

• From a kid’s phone in a household we collect only what runs the household. That is all of the following, and nothing else:
  • an anonymous ID: a random identifier Firebase creates for the phone, not tied to a name, an email or the device’s advertising identifier;
  • an avatar: one picture (an emoji such as 🦊) that a grown-up picks when the phone joins, and the time it joined;
  • the events that phone sends to the household’s shared log: a note that it joined as a kid (or that it stepped back to being one), each chore it claims, checks off or un-checks with the day or week it is for, and nothing typed by the kid. Each event carries the phone’s anonymous ID and the time our server received it. That the phone left is noted in the log by a grown-up’s phone;
  • a rate-limit record, used only to stop code-guessing and flooding: how many household or recovery codes the phone tried in the last ten minutes, when, and the last code it tried; and how many events it sent in the last minute;
  • one timestamp: the time our server answered when the phone asked what time it is. That happens when Kid Mode is turned on, while a wrong-PIN cooldown or the forgotten-PIN wait is running, and when a grown-up starts that wait or checks the time online (see “When Huddle uses the network”). Each answer replaces the last.
  A kid’s phone never gets a backup and never asks the update server for updates (see “App updates”), and a phone in Kid Mode with no household sends nothing at all, apart from that timestamp (under an anonymous ID) if a grown-up starts the forgotten-PIN wait or checks the time online.
• The household’s member list never holds a kid’s name. In the household a kid appears as their picture and a number (“🦊 Kid 1”). If a grown-up gives a member a name under Settings → Your household, that name is kept only on the phone where it was typed, is never sent to us or to other phones, and is not part of any backup.
• Names a grown-up types into the tools are different. The names of shared chores and goals in Chore Chart are sent to the household, so every phone in it can show them; the app says so under those fields and suggests leaving real names out. And whatever a grown-up types into the tools on their own phone (kids’ names in Chore Chart’s single-phone chart, in Allowance Jar and in Screen-Time Coupons) is saved on that phone and, if that grown-up signs in to back up, in that grown-up’s own backup. It is never sent to the household.
• Who sees it: only the members of that household (at most six phones, joined with the household’s code). It is never public and never shared with anyone else.
• Third parties: Google Firebase (Google Cloud), as our processor, stores the household to keep the phones in sync and stores the optional grown-up backup. Google does not use it for its own purposes. Expo delivers app updates to grown-ups’ phones only (see “App updates”); a kid’s phone or a phone in Kid Mode never asks Expo for an update, and sends Expo nothing unless it is finishing a download begun while it was a grown-up’s phone.
• How long: a kid’s check-offs are part of the household’s shared history, so they stay with the household until it is deleted (see Retention below). Delete my data on the kid’s phone deletes its membership, its avatar, its list of households and its anonymous ID. The household organizer removing that phone deletes its membership and its avatar, and its entry in that phone’s list of households; the phone keeps its anonymous ID until Delete my data is used on it. In both cases two things remain: the events the phone sent (its claims and check-offs), which stay in the household’s history under its anonymous ID, with no name and no picture, until the household is deleted; and its rate-limit record, which is kept so that deleting cannot reset a limit and refers to an ID nothing else uses any more. A parent who wants the history gone as well can delete the household (the last grown-up’s Delete my data, or “Delete the household” in Settings) or email us, and we will delete the rate-limit record on request too.
• Grown-ups decide: creating or joining a household, sharing or changing its code, changing roles, signing in, backing up, deleting data, and every action that hands out money, screen time or rewards ask a parental gate first (a quick arithmetic question meant for an adult). Kid Mode hides all of those and every grown-up setting, and the app opens no external links or websites for a child. A household is never left without a grown-up: its last grown-up can’t leave it to the kids or be made a kid, only hand it to another grown-up or delete it, and signing in to an existing account from that phone stops and asks which.

A parent can review or delete what a child’s phone shared at any time: in the app (Settings → Your household, where the household organizer can remove any member, or Settings → Your data → Delete my data on the child’s phone), or by emailing Hyperfocusedengineer@gmail.com. We do not knowingly collect any other personal information from children under 13; if you believe we have, email us and we will delete it.

Deleting your data and your rights

Delete my data (Settings → Your data, hold to confirm) deletes, in this order: the cloud backup, your sign-in account with us, and every tool’s saved data and reminders on the phone. Because one account backs up all Hyperfocused Apps apps, deleting from Huddle also deletes the backups of every other Hyperfocused Apps app kept under that account, along with the account itself; those apps keep the data on their phones and simply stop backing up. You will be asked to confirm with Apple or Google first; for an Apple sign-in we also ask Apple to revoke the sign-in. This cannot be undone. If a step fails, the app says so and you can try again to finish. Signed out, it clears the phone only; sign in first to remove a cloud backup too.

Wherever you live, you can also ask us to show you, correct, export or delete any data we hold about you by emailing Hyperfocusedengineer@gmail.com. We answer from the same address, usually within a few days, and we will ask you to confirm the request from the email address of your backup account. There is no charge.

• If you are in the European Economic Area, the United Kingdom or Switzerland (GDPR): we process backup data because you asked us to (your consent, which you withdraw by signing out or deleting). You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your data protection authority. The data is stored in the United States under Google Cloud’s standard contractual clauses.
• If you are in California (CCPA/CPRA): we do not sell or share your personal information, we have no financial incentive programmes, and we do not use sensitive personal information for anything beyond keeping your backup. You may request what we hold, ask for it to be deleted, and you will not be treated differently for doing so.

Retention

Data on your phone stays until you delete it or the app. A backup stays under your account until you delete it. A household’s shared chores and check-off history stay with the household until it is deleted: when its last member leaves, when its last grown-up uses Delete my data, or after it has gone 12 months with no activity (then every phone in it shows “This household expired”, and it is deleted when its last member leaves; email us and we will delete an abandoned one sooner). A phone’s membership, avatar and anonymous ID are deleted by Delete my data on that phone; the organizer removing a phone deletes its membership and avatar. The events a phone sent stay in the household’s history under its anonymous ID until the household is deleted (see Children and families above). Apple and Google keep their own records of your sign-in under their own privacy policies.

Security

Every connection to Firebase uses HTTPS. The backup is protected by Firebase security rules that only let your own signed-in account read or change it; a household can be read only by its members, joining needs its 8-character code (each phone gets 10 tries per 10 minutes), the rules cap it at six phones, and its recovery code is stored only as a salted hash that no app can read back (10 tries per 10 minutes); we have no admin tooling that browses user backups or households. No system is perfectly secure, and the app is designed so the phone is always the primary copy of your data.

Changes to this policy

If Huddle ever starts collecting something new, we will update this page, change the dates at the top and, for anything material, tell you in the app before it takes effect.

Contact

Hyperfocused Apps is the trade name of Harsha Hassan Somashekara, an individual developer established in India, who is the data controller for Huddle. Questions, data requests and anything else about privacy:

Hyperfocusedengineer@gmail.com

Huddle support page