Privacy Policy

1. Who is responsible

The controller (data controller) is Szabó Gergő Péter E.V., Barackos utca 1, 2365 Inárcs, Hungary, szabogergo.ev@gmail.com (sole proprietor, Hungary). Write to us at szabogergo.ev@gmail.com for anything about your data.

2. The short version

• The game itself (your pet, coins, progress, settings) is stored on your phone. We do not receive it unless you choose to create an account.
• An account is optional. Without one the app sends us nothing about you, except feedback you choose to send (see section 3).
• Ads are shown by Google AdMob. In the EU/UK and on iPhone you decide about personalised ads and tracking in the consent screens, and you can change it later in Settings.
• Anonymous usage statistics are off until you switch them on in Settings.
• You can delete your account and all cloud data inside the app (Settings).

3. What we process, why, and on what legal basis

Where we write "consent" the basis is Art. 6(1)(a) GDPR; "contract" is Art. 6(1)(b) (providing the service you asked for); "legitimate interest" is Art. 6(1)(f); "legal obligation" is Art. 6(1)(c).

• Game data on your phone (pets, coins, items, settings): stored only on your device. We have no access to it and it is not "processed" by us. Deleting the app deletes it.
• Waitlist (website): your email address, the page language, where the form was, and the time of sign-up. Purpose: one message when Huko is released. Basis: consent. We keep it no longer than the launch email needs, at most 24 months, and delete it earlier on request.
• Account (optional): email address and a user id from our sign-in provider Clerk. If you use Sign in with Apple or Google we receive the email (and name, if you share it) that the provider gives us. Purpose: signing you in and protecting your cloud save. Basis: contract. Kept until you delete the account.
• Cloud save (optional, needs an account): a copy of your game (pets, names, coins, items, progress) so you can restore it on another phone. Basis: contract. Deleted when you delete the account.
• Sharing a pet by code (optional, needs an account): the pet's species, colour, name, level and clothes are visible to anyone who has the code. Basis: contract. Stops when you stop sharing or delete the account.
• Looking after a pet together (optional, needs an account): the name you choose for yourself (shown to the other people, in the pushes about the pet and in its activity log), the language of your phone, the pet's whole state (name, species, colour, level, needs, clothes) and a short log of what each person did, with that name. Basis: contract. When you delete your account you leave the pet; it stays with the other people and is deleted when the last person leaves. The name in the log rows you leave behind is erased.
• Feedback and bug reports (optional): the text you write, the type, your account id or, without an account, a random device id (it names the phone, not you), and, unless you switch it off in the form, the app version, platform and OS version, language, update id, your level and the last crash report. Purpose: answering you and fixing bugs. Basis: legitimate interest (support) and your consent for the technical details. Kept while the report is open and then at most 24 months. Feedback sent while signed in is deleted with your account; anonymous feedback is not tied to an account, so it is deleted only on request: write to szabogergo.ev@gmail.com.
• Push notifications (optional, needs an account): an Expo push token for your phone, so that our answer to your feedback, the notifications about a pet you look after together, and the occasional announcement from us to all players can reach you. Basis: consent (the system permission). Deleted when you sign out on that phone or delete the account. Reminders to feed your pet are scheduled locally on your phone and never leave it.
• Admin log (operation): when we act on an account, a report or a waitlist entry in our admin page (for example deleting cloud data on request, or answering feedback), we write down who did it, what was done and the internal id it concerned, never an email address, a message text or a pet name. Rows are deleted automatically after 90 days. Basis: legitimate interest (security and accountability).
• Ads (Google AdMob): a short video after some mini games and optional rewarded videos. AdMob processes your IP address, device and ad identifiers (on iOS the advertising identifier only if you allow tracking), app and usage data to choose and measure ads and prevent fraud. We set the ad content rating to "G". Basis: consent, which you give or refuse in the consent form (Google UMP, EU/UK) and, on iPhone, the Apple tracking prompt. Google is an independent controller for its own purposes (see policies.google.com/privacy). Without consent no ads are requested.
• Purchases: payment is handled by Apple or Google; we never see your card details. RevenueCat receives an anonymous app user id (or your account id if you are signed in), the products you bought and the receipt, to unlock what you bought and to restore it. Basis: contract and, for accounting records kept by the stores and us, legal obligation.
• Anonymous usage statistics and error reports (PostHog, EU region): screens opened, app open/close, what you do in the game (feeding, bathing, rooms you visit, mini games played and their scores, shop and wardrobe use, settings you change), whether an ad or a bonus video was shown, watched or skipped and what it earned, the outcome of a purchase attempt (never payment details), technical errors and crashes with where they happened, app version, language, device model and OS version, and a random id. Never pet names, never text you write, never your e-mail. Off by default; switch on in Settings > Anonymous usage stats and off again at any time. Basis: consent.
• App updates: when the app checks for an update, the update server (Expo) receives your IP address, app version and platform. Basis: legitimate interest (delivering fixes).
• This website: our host Vercel keeps short-lived server logs (IP address, time, page) for security and operation. The site counts visits with Vercel Web Analytics: it sets no cookies and stores no IP address, only anonymous, aggregated data (page, referrer, country, device type and browser), so no single visitor can be recognised. The site sets no tracking cookies. If you click a language button we save your choice in one small cookie (`huko-lang`, one year), which is needed to remember the language you picked. Basis: legitimate interest / your request.

4. Who receives data (processors and other recipients)

We use these providers. Where they act on our instructions they are our processors under Art. 28 GDPR:

• Convex (USA) - database and backend for the waitlist, accounts, cloud saves, shared pets and feedback.
• Clerk (USA) - sign-in and account management.
• Vercel (USA) - hosting of huko.app.
• RevenueCat (USA) - purchase and subscription handling.
• Expo / EAS (USA) - app updates and push notification delivery.
• PostHog (EU data region) - anonymous usage statistics, only if you switch them on.
• Google AdMob (Ireland / USA) - ads, with its own role as controller as described above.
• Apple and Google - app stores, payments and the sign-in options you choose.
• An email service provider - to send the single launch email to the waitlist.

5. Transfers outside the EU/EEA

Several of these providers are in the USA. Where they are certified under the EU-US Data Privacy Framework we rely on that; otherwise we rely on the EU Standard Contractual Clauses (Art. 46 GDPR). You can ask us for a copy of the safeguards.

6. How long we keep data

As written in section 3: account and cloud data until you delete your account; waitlist and feedback at most the times given there (these are upper limits, not automatic timers: we review the data from time to time and delete on request); ad and purchase data by Google, Apple and RevenueCat according to their own policies and legal duties. Accounting records, if any, as long as the law requires.

7. Your rights

Under the GDPR you have the right to:

• access your data and get a copy (Art. 15),
• have wrong data corrected (Art. 16),
• have your data erased (Art. 17),
• restrict processing (Art. 18),
• receive your data in a portable format (Art. 20),
• object to processing based on legitimate interest (Art. 21),
• withdraw a consent at any time, without affecting what happened before (Art. 7).

8. How to use your rights

• Delete your account and all cloud data: in the app, Settings > Delete account. This removes your cloud save, share codes, feedback sent while signed in and push tokens, and you leave every pet you look after together (it stays with the other people, who no longer see the name you chose in its log; it is deleted when the last person leaves), then the sign-in itself.
• Switch usage statistics off: Settings > Anonymous usage stats.
• Change your ad choices: Settings > Privacy choices (EU/UK), and the iOS Settings > Privacy & Security > Tracking.
• Reset the advertising id: in your phone's system settings.
• Anything else, including a copy of your data, correction or removal from the waitlist: write to szabogergo.ev@gmail.com. We answer within one month and may ask you to confirm who you are.

9. Complaints

You can complain to the data protection authority of your country. In Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), Falk Miksa utca 9-11, 1055 Budapest, ugyfelszolgalat@naih.hu, naih.hu. You may also go to court. We would be glad if you contacted us first.

10. Children

Huko is a family-friendly game, but it is not directed at children under 13 and we do not knowingly collect their personal data. To create an account you must be at least 16 or have a parent or guardian's permission (the age may be lower where local law allows). If you think a child gave us data, write to us and we will delete it. Ads are limited to the "G" content rating.

11. Security

Data is sent over encrypted connections (HTTPS) and the cloud services above use access controls. No system is perfectly safe; a game save is not meant for secrets, so do not type personal data into pet names or feedback that you would not want us to read.

12. No automated decisions

We do not use your data for automated decision-making or profiling that has legal effects on you. Ad personalisation by Google depends on your consent choices.

13. Changes

If we change this policy in a meaningful way we will update the date above and, where needed, tell you in the app or ask for your consent again.