Privacy Policy

Information We Collect

Information You Provide

• Account Information: When you create an account, we collect your name, email address, and password. You may also sign in using a third-party identity provider (Google or GitHub), in which case we receive your name and email address from that provider.
• Payment Information: If you subscribe to a paid plan, our payment processor (Stripe) collects billing details. We do not store complete credit card numbers on our servers. We store a Stripe customer identifier and your subscription plan status.
• User Preferences: We store your dashboard preferences, such as hidden workspaces and hidden platforms, on our servers so they persist across sessions.
• Support Communications: When you contact us for support, including through our live chat widget, we collect the information you provide in your messages.

Information from Connected Platforms

When you connect third-party project management platforms (such as Asana, Linear, ClickUp, Monday.com, Basecamp, or Jira), we access and store the following in secure temporary cache. Your task data is never stored permanently:

• Workspace, project, and board names
• Task titles, descriptions, due dates, and status
• Task identifiers and URLs
• Your user profile information on the connected platform (such as email address and account ID) for the purpose of identifying your assigned tasks
• Any other task-related data necessary to display your unified dashboard

We only access information you authorize through each platform's OAuth authentication process. We request the minimum permissions necessary to provide the Service, typically limited to read-only access to tasks, projects, and workspaces.

Information Collected Automatically

• Usage Data: Pages visited, features used, and actions taken within the Service, collected via Vercel Analytics
• Performance Data: Page load times and web performance metrics, collected via Vercel Speed Insights
• Device Information: Browser type, operating system, device identifiers
• Log Data: IP address, access times, referring URLs
• Cookies: We use cookies and similar technologies to maintain sessions and remember preferences. See "Cookies and Tracking Technologies" below for details.

Cookies and Tracking Technologies

We use the following cookies and similar technologies:

• Session Cookies: Authentication tokens managed by Supabase to keep you signed in. These expire when you sign out or your session ends.
• Returning User Cookie: A persistent cookie (huddle-has-account) that remembers if you have an account so we can direct you to the login page on return visits. This cookie has a maximum lifespan of 5 years.
• Consent Cookies: Cookies set by our consent management platform (Ketch) to remember your privacy preferences.
• Local Storage: We use browser local storage to remember your last-used dashboard filter settings. This data stays on your device and is not transmitted to our servers.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Sync and display your tasks from connected platforms
• Process transactions and send related information
• Send technical notices, updates, and support messages
• Send you a welcome email when you create an account
• Notify our team internally when new users register, so we can provide proactive support
• Respond to your comments and questions
• Monitor and analyze usage trends
• Detect, investigate, and prevent fraudulent or unauthorized activity
• Personalize your experience

How We Share Your Information

We do not sell your personal information. We may share information in the following circumstances:

• Service Providers: With vendors who perform services on our behalf, bound by confidentiality obligations. See "Third-Party Service Providers" below for a complete list.
• Legal Requirements: When required by law, subpoena, or legal process
• Safety and Protection: To protect the rights, property, or safety of Huddle, our users, or others
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice provided to you
• With Your Consent: When you direct us to share information with third parties

Third-Party Service Providers

We use the following third-party services to operate and improve Huddle. Each provider processes data only as necessary to perform its function:

• Supabase — Authentication, database hosting, and serverless edge functions. Stores your account data, OAuth tokens (encrypted), and user preferences.
• Upstash (Redis) — Temporary caching of task data fetched from connected platforms. Cache entries expire automatically after 10 minutes.
• Stripe — Payment processing for paid subscriptions. Receives your email address and Supabase user identifier to create and manage your billing account.
• Vercel — Application hosting, analytics (page views and feature usage), and performance monitoring (page load times and web vitals).
• Resend — Transactional email delivery. Receives your name and email address to send welcome emails and account-related notifications.
• Chatwoot — Live chat support widget. Collects the messages you send through the chat interface and associated browser session information.
• Ketch — Consent management platform. Manages your cookie and privacy preferences and stores your consent choices.

Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. Task data synced from connected platforms is cached temporarily to improve performance and is refreshed regularly. When you disconnect a platform or delete your account, we remove the associated data within 30 days, except where retention is required by law.

Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure token storage for platform connections
• Regular security assessments
• Access controls limiting employee access to user data

No method of transmission or storage is completely secure. If you become aware of a security issue, please contact us immediately.

Your Rights and Choices

Depending on your location, you may have rights to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Portability: Request your data in a portable format
• Withdraw Consent: Disconnect platforms or close your account at any time
• Opt-Out: Unsubscribe from marketing communications

To exercise these rights, contact us at privacy@huddle.app.

Connected Platform Permissions

When you connect a project management platform, you authorize Huddle to access your data on that platform. You can revoke this access at any time by:

1. Disconnecting the platform within Huddle settings
2. Revoking access in the connected platform's settings

Revoking access will stop future data syncing but does not automatically delete previously synced data. To delete that data, please contact us or use the delete option in your account settings.

Children's Privacy

Huddle is not intended for users under 16 years of age. We do not knowingly collect personal information from children. If we learn we have collected information from a child, we will delete it promptly.

International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place when transferring data internationally.

California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, request deletion, and opt out of any sale of personal information (which we do not do).

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy with a new "Last Updated" date and, where appropriate, by email.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at: