Privacy Policy

Last updated 8 October 2026

1. Who we are

Huddlings (huddlings.com) is made and run by Naavalan Ventures, in India (“we”, “us”). Under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”) we are the Data Fiduciary for the personal data described here. If you're in the EU or UK, we are the “controller” under the GDPR.

2. Huddlings, kids and grown-ups

Huddlings is made for families with kids aged 4 and up, to be used together. Because the law treats anyone under 18 as a child (under the DPDP Act, and under-13s under COPPA in the US), we work like this:

• Only a grown-up can make an account. You must be 18 or over and the parent or legal guardian of any child you add.
• Kids never sign up themselves. A parent or guardian adds them to the family and gives consent, on their behalf, for us to look after the little information Huddlings needs about them.
• You stay in charge. You can see, change or remove anything about your child at any time, or withdraw your consent, which removes their profile.
• No tracking of children. We don't track, monitor the behaviour of, profile, or show advertising to children, and we never sell or rent their data.
• If we learn that a child has made an account without a parent or guardian, we delete it.

3. What we collect

When you join the waitlist

• Your name and email address, and a short-lived code we email you to check it's yours.

When you make an account

• Your email address and a password. Passwords are stored only as a secure one-way hash; nobody, including us, can read them.
• If you choose “Continue with Google”: your name, email address and profile picture from Google. We never see your Google password.
• The name you'd like us to call you, and when you agreed to these terms.
• Your family's name (like “the Fernandes family”), which other families see when you invite them or join with their link.

When you invite a family

• Your invite code and the Huddling you put on your invite card. Anyone with your link sees your family's name and that Huddling.
• Which families joined with your link, and when, so both of you get your credits. You see only their family name.
• Your credits: how many you've earned or used, and why.

When your family uses Huddlings

• The family members you add, with the names or nicknames you give them. A nickname is perfectly fine.
• The characters each person makes, the feelings they share, the replies and the things they create.
• Your picks in games such as Cheer.

Automatically, to keep things running and safe

• Basic technical details such as browser and device type, and IP address in security logs.
• General platform analytics: how many times pages are visited and how fast they load, counted in total (Vercel Web Analytics and Speed Insights). They use no cookies, don't identify you, and don't follow what any person does.
• A check that you're a person and not a bot (Cloudflare Turnstile) when a form is sent.

We don't ask for your location, contacts, phone number or photos, and we don't collect more about anyone than Huddlings needs.

4. How we use it

• To run Huddlings: sign you in, show your family its huddle, and save what you make.
• To send emails you need: sign-in codes, password resets, waitlist news and important changes. No marketing emails without asking.
• To keep Huddlings safe: stop spam, abuse and break-ins.
• To fix and improve Huddlings, using general platform numbers only.

We never sell or rent personal data. There are no ads and no advertising partners, and we don't run analytics on anyone's behaviour: no profiles, no tracking across sites, nothing about what a particular person or child does. We never use your family's feelings, characters or creations to train AI models.

We rely on your consent (for your own data, and as parent or guardian for your child's), which you can withdraw at any time. Where the GDPR applies, we also rely on what's needed to provide the service you asked for, and on our legitimate interest in keeping it secure.

5. Keeping it safe

• Everything travels encrypted (HTTPS/TLS) and is stored encrypted on our providers' servers.
• What a family shares is visible only to the people in that family.
• Only a few people on our team can reach the systems, and only when needed to run or fix Huddlings.
• If a breach ever affected your data, we would tell you and the authorities as the law requires.

6. Who else handles it

We use a few trusted services to run Huddlings. They handle data only on our instructions and only to provide their service:

• Supabase: our database, file storage and sign-in.
• Vercel: hosting the website, and the general platform analytics.
• Redis: game scores and picks.
• Resend: sending our emails.
• Cloudflare: the bot check on our forms.
• Google: only if you choose to sign in with Google.

We may also share data if the law requires it, to protect someone's safety, or if Huddlings ever changes hands (the new owner would have to keep these promises). Links to other sites, such as our Instagram, follow those sites' own privacy policies.

7. Where it's kept

Our providers' servers may be in India or in other countries. Wherever it's kept, we require the same protection described here, and we follow the DPDP Act's rules on transfers outside India (and, where they apply, the GDPR's).

8. Keeping and deleting data

We keep personal data only as long as Huddlings needs it for you, and these are the longest we will ever keep it:

• Your account and family: while your account is open.
• When you delete your account, or ask us to: your account and everything in your family (people, characters, feelings, replies, creations and game picks) is deleted within 30 days, and cleared from our backups within 90 days. Until then backups stay locked away and are never used, except to recover from a disaster.
• When you remove a child, or withdraw consent for them: their profile and everything they shared is deleted on the same timeline.
• Accounts nobody uses: if no one signs in to a family for 3 years, we delete it. We'll email you at least 48 hours before, so you can keep it by signing in.
• The waitlist: until we've let you in, or you ask us to remove you, and never more than 3 years after you joined.
• Email codes: they stop working after 10 minutes, and are deleted as soon as they're used.
• Security and access logs: kept for 1 year, as Indian law requires, then deleted. (This applies even after an account is deleted.)
• General platform analytics: these are totals with no personal data in them, so they aren't tied to you.

The only time we keep something longer is when the law makes us (for example, a court order or an open legal claim), and then only that piece of data, only for as long as required.

9. Your rights

For yourself, and as parent or guardian for your child, you can:

• Ask what personal data we have and how we use it.
• Correct or update it, or ask us to delete it.
• Withdraw your consent at any time. (We'll then stop and delete what depends on it, which may mean closing the account.)
• Nominate someone to act for you if you're unable to.
• Complain to us, and if you're not happy with our answer, to the Data Protection Board of India (or your local data protection authority in the EU/UK).
• In the EU/UK you can also ask for a copy of your data to take elsewhere, and object to or restrict some uses.

Write to huddlings.app@gmail.com from your account's email. We'll answer within 30 days at the most, usually much sooner, and a deletion request is carried out on the timeline in section 8.

10. Cookies and storage

We use only what Huddlings needs to work, for three things:

• Signing in: cookies that keep you signed in, remember that this browser has signed in before, finish a password reset, and carry your agreement to these terms through a Google sign-in.
• Invite links: a cookie that remembers the invite link you opened, for up to 30 days, so you and the family who invited you get your credits when you join.
• The intro video: a note in your browser of when the intro video last played, so it doesn't replay on every visit.

There are no advertising, tracking or analytics cookies, and nothing from other companies that follows you around the web, so there's no cookie banner to click away.

11. Changes

If we change this policy in a way that matters, we'll tell you before it applies and ask you to agree again when you next sign in. The date at the top always shows the latest version.

12. Contact and grievances

For anything about your data, or to raise a grievance, write to our Grievance Officer at huddlings.app@gmail.com. We'll reply within 30 days and resolve a grievance within 90 days at the most. See also our Terms of Use.