HugmilesPrivacy Policy
Last updated: 2026-10-26
This explains what personal data Hugmiles handles, why, who helps us handle it, and the choices you have. Abhishek Wadhawan is the data controller. Contact: [email protected].
We update this policy before a new feature starts collecting new kinds of data (for example location, photos or voice). The tables below describe what the app and this website do today and mark what is planned.
1. What we collect and why
| Data | Why | When |
|---|---|---|
| Email address, password (stored only as a salted hash by our authentication provider) | Create and secure your account, send confirmation and password-reset emails | Today |
| Display name, app language, time zone | Show your name to your partner, show your partner's local time, use your language | Today |
| Couple data: who is linked, invite codes and attempts, anniversary date, link and unlink times | Run the shared space, prevent invite-code guessing, honour the 30-day unlink period | Today |
| Sign-in with Google or Apple: your name and email from that provider | Let you sign in without a password | Planned |
| Messages, photos, voice notes, drawings, memories, letters | Provide chat and keepsakes to you and your partner | Planned |
| Location, only when the app is open and you have switched sharing on | Show distance and your journey on the Love Map | Planned |
| Push notification token, mood and presence | Deliver notifications and show how your partner is | Planned |
| Purchase status (from the store, through our billing provider) | Unlock Couple Pro for both of you | Planned |
| Basic technical logs (IP address, device type, errors) | Security, abuse prevention, fixing problems | Today |
We do not sell your data, we show no ads, and we do not build advertising profiles. We do not use your messages or photos to train AI models. AI features, when they arrive, only receive what is needed for that action and are explained in the app first.
2. Who sees it
- Your partner sees what you share in your couple space.
- Service providers who process data for us under agreements: Supabase (database, authentication and storage, hosted in Singapore), Resend (sending account emails), Cloudflare (this website, DNS and security). More providers (for example Firebase for notifications and RevenueCat for subscriptions) will be added here before the features that need them ship.
- Authorities where the law requires it.
Your data is processed in Singapore and other countries where our providers operate. Where the law of your country (including Thailand's PDPA and India's DPDP Act) requires safeguards for international transfers, we rely on our providers' contractual protections and on your consent when you create an account.
3. How long we keep it
- Account data: until you delete your account.
- Shared couple data: until either of you unlinks, plus 30 days (read-only, so you can export), then deleted.
- Unused invite codes expire after 7 days. Invite attempt logs are deleted after a day.
- Security logs: a short period, then deleted or anonymised.
4. Your rights and choices
- See, correct or export your data, and delete your account: in the app where available, or by email until every option is in the app. See Delete your account.
- Withdraw consent, object to processing, or complain to your data protection authority.
- Choose what you share: you decide about location, photos and notifications, and you can unlink at any time.
To use any of these rights email [email protected]. We answer within 30 days.
5. Age
Hugmiles is for people 18 or older. We do not knowingly collect data from anyone younger. If you think someone under 18 has an account, tell us and we will delete it.
6. Security
Connections use TLS. Passwords are never stored in readable form. Each couple's data is separated by database access rules so only its two members can read it, and sign-in links use a one-time code that only your own phone can complete. No system is perfectly secure; we limit what we collect so there is less to lose.
7. This website
This website does not use cookies or analytics. Cloudflare may log technical request data (such as IP address) to deliver and protect the site. Invite links contain a code in the address; the invite page reads it on your device and does not send it anywhere.
8. Changes
If we change this policy in a way that matters, we will tell you in the app before it applies.