Privacy Notice

Huddleby · Last updated 14 October 2026

This notice explains how Huddleby uses personal information when you use our mobile app, website and community features. It is written for people in the United Kingdom and should be read alongside the choices shown in the app.

1. Who is responsible for your information?

Huddleby is operated by Rocío Beldad, who is the data controller for the personal information described in this notice. Contact us at support@findmyvillage.co.uk. This is also the email address for privacy questions and data-protection complaints.

Huddleby is intended for adults aged 18 or over. Please do not create an account if you are under 18. The app is for parents and community members; do not post identifying information about a child unless it is necessary and you have authority to share it.

2. Personal information we use

• Account and profile: email address, account identifier, name, city, member role or Business account type, business name for Business accounts, profile photo, optional social profile links, your choice about whether other members can discover your profile, and a record of the Terms & Conditions version and time accepted. The app sends your password securely to Supabase Authentication to verify your sign-in; Huddleby profile tables do not store it in readable form. We use your account email to send payment receipts and subscription notices.
• Business profile, if you add one: business name, category, description, services, an optional discount or offer, website, optional phone number and whether the profile is public.
• Business subscription and payment receipt, if you register a business: the store provider, product identifier, plan (quarterly Business account or quarterly directory listing), subscription status, paid-through date, renewal state, payment amount and currency, purchase date, store transaction reference and RevenueCat event reference. Apple or Google processes the transaction and payment information through your store account; Huddleby does not receive or store your full card or wallet details.
• Business marketing statistics: when a signed-in member views a Business account’s job, course or event listing, we record the listing type and identifier, Business account, a pseudonymous member account identifier and UTC date, then report aggregate views. The underlying view record remains linked to the member account inside Huddleby; the Business account receives aggregate totals, not member-level view records. We also count job applications and event RSVPs for each business. A Business account may enter the number of purchases or offer redemptions it attributes to Huddleby and, optionally, an aggregate sales amount in pounds. These are reported by the business, are not checked against a payment or point-of-sale system, and are not linked to a customer's identity.
• Direct messages: the sender and recipient account IDs, message text, timestamps, read status, and participant display names for private member-to-Business conversations. Other members cannot read the conversation. Authorised Huddleby operators may access message records when reasonably necessary to operate, support or protect the service, respond to a report or comply with law. Businesses can reply to a conversation started by a member. Messages are not end-to-end encrypted.
• Content you submit: forum posts and comments; event, course and job listings; dates, descriptions, venue or city and map coordinates you include; and an optional job reference. If you select yourself as a reference, your name and profile photo appear with that listing.
• Community activity: connection requests and their status, event RSVPs, an in-app record that you selected “Apply” for a job, blocks, safety reports (reporter account, item reported, reason, details and time), and support requests.
• Push notifications: if your device's notification permission is already granted, the app may retrieve an Expo push token to check whether notifications are enabled for your account. Huddleby saves the token and enables delivery only after you switch notifications on in the app. We store the token, device platform and enabled status to route local listing, connection, forum-comment and new-message alerts. Turning notifications off marks the token as disabled in Huddleby; it is removed when your account is deleted or when a provider reports that it is invalid. Message alerts do not include message text. You can also turn notifications off in your device settings.
• Location: if you choose “Use my location” and grant permission, the app reads your current location to centre the map and show your position. The coordinates are held temporarily on your device and are not written to the Huddleby database or intentionally sent as GPS coordinates to the map tile service. Map tiles are requested using tile positions and zoom level; OpenStreetMap and its delivery network receive those requests and your IP address and may infer the area shown, with closer detail at higher zoom. You can deny or revoke permission and still browse listings.
• External job search, if enabled: the app can send your profile town or city and fixed job-search terms to our server to request external job results from Adzuna. The search request does not include your email, account ID or precise device location, and Huddleby does not currently save a separate job-search history in its app database. Adzuna and its service providers receive the request from our server and may process technical request information under Adzuna's privacy notice. If you open a job link, the destination website receives information under its own privacy notice.
• Technical and security information: service providers may process IP address, device or browser details, timestamps, requested pages, authentication events and error/security logs to deliver and protect their services. Your sign-in session is stored on your device or browser so you can remain signed in.

Job applications in the app are currently interest records linked to your account and the listing. They do not send your CV or contact details to the listing owner. If you follow an external application link, the external site receives any information you choose to submit there and its privacy notice applies. The support form opens an email draft on your device; we receive the form information only if you choose to send that email. Huddleby does not ask for medical records. Free-text profiles, posts, messages and listings could contain sensitive information that you choose to share; please avoid posting health details or identifying information about children.

3. How we use it and our lawful bases

We use account and contact details for service, security and support messages. Push notifications are optional and are sent only after you switch them on in Huddleby and allow them in your device settings. They relate to Huddleby community activity and are not marketing messages. Waiting-list members request launch updates when they register. We do not subscribe them to unrelated marketing newsletters or use personal information for targeted advertising. We do not make decisions about you with legal or similarly significant effects solely by automated means. We do record first-party product activity for the Business statistics feature described above; we do not use third-party advertising or analytics trackers.

Huddleby waiting list

When you join the website waiting list, we collect your name and email address to manage your registration and send the Huddleby launch updates you request. You may optionally tell us why you would like to join. The waiting list is separate from an app account: joining it does not create a profile or share your details with other members.

If you separately tick the optional message-permission checkbox, we may quote your message anonymously in Huddleby marketing materials. We record that permission, its time and the notice version. We will not publish your name or email with your message. This permission is optional and does not affect your waiting-list registration. Please avoid including sensitive or identifying information in the message; we review messages before using them.

We rely on your consent for requested launch communications and for optional use of your message in marketing materials. Vercel delivers the website and Supabase stores waiting-list information in a protected database. Waiting-list information is not publicly readable. We keep it while managing the launch and registration, and remove it when it is no longer needed or when you ask to leave the list, subject to necessary backup cycles. You can leave the list or withdraw message permission at any time by emailing support@findmyvillage.co.uk. Withdrawing consent does not affect lawful use before withdrawal.

4. What other members can see

Other signed-in members can see the profile and community content that the app makes available, such as your name, city, role, profile photo and discoverability choice, public business profile, forum posts and comments, and listings you publish. A public business profile can show its optional phone number and website. Business accounts can see aggregate views, job application and event RSVP counts for their own listings, but not the identity of members behind those totals. Businesses may also enter aggregate sales and offer-redemption figures; those entries are identified as reported by the business. Event, course and job details you submit may include a venue, city or map pin. Your account email is used for account and service purposes and is not intended as a public profile field. Huddleby staff with authorised administrative access may access personal information, including reports or messages, when needed to operate, support, secure or administer the service.

Use the profile discoverability and business visibility controls before adding optional information. Do not include private details in posts or listings that you would not want other members to see.

5. Location and map services

Location access is optional. The app requests foreground location only when you ask to use your location. It uses the device coordinates in memory to set the map centre and position marker; it does not upload those coordinates to Supabase or intentionally include the raw GPS coordinate in tile requests. The map uses Leaflet and OpenStreetMap tiles. When map tiles load, OpenStreetMap's tile service and its delivery network receive your IP address and the tile positions and zoom level requested. Those requests can reveal the map area being viewed, with more detail at higher zoom. OpenStreetMap Foundation operates this map service independently under its own privacy policy and tile usage policy.

6. Who receives personal information?

• Other Huddleby members: only information and content made visible through the app and your choices.
• Supabase: authentication, database, file storage and app services. This project's primary Supabase region is London, UK (eu-west-2). Supabase and its authorised subprocessors may process limited information elsewhere to operate the service and provide support.
• RevenueCat: subscription management and entitlement validation for quarterly Business accounts and quarterly directory listings. RevenueCat receives the app account identifier, store product and transaction references, subscription status, renewal state and paid-through date so it can verify access and send subscription lifecycle events to Huddleby. It processes information under its privacy notice and our applicable service terms and data-processing arrangements.
• Apple App Store and Google Play: process subscription purchases, renewals, cancellations and refunds using the payment method saved to your store account. They handle payment card or wallet details; Huddleby does not receive them. Their own terms and privacy notices also apply to your store account and purchases.
• Expo Push Service, Apple and Google: Expo receives push tokens and notification content to route alerts to Apple Push Notification service (APNs) or Google Firebase Cloud Messaging (FCM). Apple or Google then delivers the notification under its own services and privacy information. We store a token in Huddleby only after you enable notifications in the app; Expo may provide a token when the app checks a previously saved setting on a device whose system permission is already granted.
• Adzuna, if the external job feed is enabled: receives the job-search town or city and fixed search terms from our server. The request does not include your account ID, email or precise GPS coordinates. Adzuna's own Privacy Notice applies to its processing.
• Vercel: website hosting and delivery. Vercel may process site-request and service-generated technical information such as IP address and request logs, and may use subprocessors.
• Google Workspace: receives messages you send to our support email and any reply correspondence.
• OpenStreetMap Foundation and its tile-delivery network: receive requests for map tiles and related network information when you view the map.
• UNPKG/Cloudflare: the map loads Leaflet library files from this content-delivery service, which may receive network request information.
• Resend, if configured: the receipt and subscription-email functions send your account email and relevant subscription or transaction details (such as amount, currency, date, store and transaction reference) through Resend when its server API key and sender settings are configured. If safety-report email delivery is configured, the report function may also send report details and the reporter's account email to our support inbox through Resend. If those credentials or sender settings are absent, the functions do not send an email through Resend; a report remains stored in the app database and the email notice is not delivered.
• Authorities and advisers: regulators, law-enforcement bodies, courts or professional advisers where disclosure is required by law or necessary to protect rights and safety.

We do not sell personal information or share it with advertisers for targeted advertising. Providers process information to supply their services under their own terms and privacy information. See Supabase, RevenueCat, RevenueCat's Data Processing Addendum, Apple, Google, Vercel, Expo, UNPKG, Adzuna and, where used, Resend.

7. International transfers

The primary Supabase database is in London, UK (eu-west-2). This does not mean that every service operation, backup, support request or provider log stays in the UK. Hosting, email, map delivery, push-notification, subscription-management and (if enabled) external job-search providers may process information in the United States or other countries. Providers describe their international transfers and safeguards in their privacy notices and data-processing terms. Where a restricted transfer of personal information from the UK takes place, the applicable transfer mechanism and safeguards are used as required. For example, RevenueCat publishes a Data Processing Addendum, Supabase and Resend publish UK transfer terms, Vercel describes its participation in the UK Extension to the EU–US Data Privacy Framework, and Adzuna describes its international transfer safeguards in its Privacy Notice. Provider processing and locations can change. Email us if you need details or a copy of the safeguards relevant to a particular provider.

8. How long we keep information

We keep personal information only for as long as needed for the purposes above, including providing the service, handling reports and support, meeting legal requirements and dealing with claims. We do not keep active account data indefinitely.

• When you delete your account, the active account and associated profile, business profile, photos, posts, comments, private messages, listings, activity, connections, blocks and reports linked to the account are deleted from the active service. Refresh sessions are revoked across devices. Provider backups and security logs may persist for a limited period under the provider's normal deletion cycle.
• Business subscription status, receipt details, listing-view records, application and RSVP aggregates, business-reported purchase and offer-redemption totals, and billing-period data are kept while needed to provide Business features, send receipts or subscription notices and handle billing or legal claims, then deleted with your account from Huddleby's active database. View records use a pseudonymous member account identifier and date; the Business account sees aggregate results, not member-level records. Business-entered sales results are not linked to customer identities. A receipt already delivered to your inbox cannot be recalled by deleting your account. Resend may retain email delivery records under its own retention practices. Deleting your Huddleby account does not cancel an Apple App Store or Google Play subscription or remove transaction records held by those stores. Huddleby does not currently send a separate account-deletion request to RevenueCat; RevenueCat handles its own account and transaction records under its published retention practices. Cancel through your store account to stop future renewals and contact the relevant provider about its records.
• Deleting your account also removes listings and reports linked to it from the active Huddleby database and removes your name and photo from job-reference details on other members' listings. If a safety report was already emailed to the support inbox, that email copy may remain in the mailbox until it is deleted under our email retention practices; deleting your app account does not recall an email already delivered. Refresh sessions are revoked on other devices, although an existing access token may remain valid until it expires.
• Private messages are kept in the active service while needed to provide the conversation and are deleted from the active database when either participant deletes their account. Support correspondence and report records are kept while an issue is being handled and for a proportionate period afterwards where needed for safety, accountability or legal claims. Technical logs are retained according to the hosting provider's operational schedules.
• Push tokens are marked disabled in Huddleby when you turn off notifications for a device; the token record is removed when your account is deleted or Expo reports that it is invalid. Expo, Apple or Google may retain token or delivery information under their own service terms.

Your website waiting-list entry is separate from your app account and is not automatically deleted when you delete the app account. Email us if you also want us to remove a waiting-list entry. App account deletion removes Huddleby's active database records but does not automatically erase copies held by third-party providers, in provider-managed backups, or in a support mailbox after an email has been delivered.

We review retention as the service develops and delete or anonymise information when it is no longer needed, subject to legal obligations and necessary backup cycles.

9. Your UK data-protection rights

Depending on the circumstances, you can ask us to access, correct or erase your personal information, restrict its use, or receive information you provided in a portable format. You can also object to certain processing. Where we rely on consent, you can withdraw it at any time; this does not affect processing that already took place. You can withdraw location permission in your device or browser settings, and turn off push notifications in Profile > Settings & privacy or in your device settings. You can also delete your account in the app under Profile > Sign & Security > Delete account, or use the online account-deletion page.

Your right to object. You can object to processing that we carry out on the basis of our legitimate interests. Tell us what you object to and why. We will stop unless we have compelling legitimate grounds to continue or need the information to establish, exercise or defend legal claims.

Email support@findmyvillage.co.uk to exercise a right or make a data-protection complaint directly to us. We will respond without undue delay and normally within one month; in complex cases the law may allow an extension, and we will explain it. You may also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

10. Security

We use access controls and service-provider security features to protect information. No online service can guarantee absolute security. Please keep your sign-in details private and contact us promptly if you believe your account is at risk.

11. Changes to this notice

We will update this page when our data practices change. The date at the top shows when the current notice was last revised. If a change materially affects how information is used, we will provide an appropriate notice in the app or by email where required.