1. Who we are
Huddled is a private, shared media service operated by Callo Apps LTD, a company registered in England & Wales (Company No. 17194575), registered office 66 Paul Street, London, EC2A 4NA ("Callo Apps", "we", "us", "our"). Callo Apps is the data controller for the personal data described in this policy. For any privacy question or request, contact us at support@huddled.cloud.
2. Scope
This policy explains what personal data we collect when you use the Huddled app, websites, and API (the "Service"), how we use and share it, and the rights you have. It applies to registered account holders, members of shared spaces, guests who join without an account, and developers who use our API.
3. Information we collect
- Account & identity. When you sign up we (through our authentication provider, WorkOS) collect your name, email address, whether your email is verified, and an optional avatar and bio. If you sign in with Google or Apple, we receive basic profile information from that provider.
- Your content. The photos, videos, files, captions, comments, and reactions that you and the members of your spaces upload or create, together with related metadata such as file name, type, and size.
- Payment data. Paid plans are processed by Stripe acting as merchant of record. We do not receive or store your card number or other full payment details — we store only your plan, subscription status, and the identifiers Stripe returns to us.
- Device & technical data. Information needed to run and secure the Service, such as IP address, browser/device type, and log data. For API keys we record the IP address last used with the key.
- Push subscriptions. If you enable browser notifications, we store the push endpoint and keys your browser provides so we can deliver notifications.
- Support communications. Messages you send us and their contents.
- Guest data. If you join a space as a guest without an account, we store a display name you choose and an anonymous session token; we do not collect an email for guests.
- Developer & integration data. If you use our API or connect a third-party storage account (e.g. Google Drive, Dropbox, OneDrive), we store scoped, encrypted access credentials and the account label you connect.
We do not intentionally collect special-category data, and we ask that you do not use free-text fields to share it.
4. How we use your data and our legal bases
Under the UK GDPR and EU GDPR we rely on the following legal bases:
- To provide the Service (performance of a contract): creating your account, storing and displaying your media to members of your spaces, enabling comments and reactions, sending service emails (verification codes, password resets, invites), and processing your subscription.
- To secure and improve the Service (legitimate interests): preventing abuse and fraud, enforcing our Terms, maintaining reliability and security, and understanding how the Service is used. We balance these interests against your rights.
- With your consent: sending browser push notifications, and connecting optional third-party integrations. You can withdraw consent at any time.
- To meet legal obligations: tax and accounting, and responding to lawful requests from authorities.
We do not sell your personal data, we do not use it for third-party advertising, and we do not run ads.
5. Cookies and similar technologies
Huddled uses only strictly necessary, first-party cookies and local storage — for example to keep you signed in, remember your theme preference, and protect sign-in against cross-site request forgery. We do not use advertising cookies or third-party analytics/tracking technologies, so no cookie-consent banner is required for non-essential tracking.
6. How we share your data
Your content is visible only to members of the spaces it belongs to, according to the roles you assign. Beyond that, we share personal data with the service providers (sub-processors) that help us run Huddled, each acting only on our instructions:
- WorkOS — authentication, single sign-on, and directory sync.
- Convex — application database and real-time backend.
- Cloudflare — hosting, media storage (R2), transactional email, and video processing.
- Stripe — payment processing as merchant of record.
- Browser push services (Google, Apple, Mozilla, Microsoft) — to deliver notifications you enable.
- Storage providers you connect (e.g. Google Drive, Dropbox, OneDrive) — only when you authorise an integration.
We may also disclose data where required by law, to protect our rights or users, or in connection with a merger, acquisition, or sale of assets. We do not sell your personal data.
7. International data transfers
We are based in the UK and some of our sub-processors are located in the United States and elsewhere. Where we transfer personal data outside the UK or EEA, we rely on an appropriate safeguard — such as an adequacy decision, the UK International Data Transfer Agreement (IDTA) or Addendum, or the EU Standard Contractual Clauses.
8. Data retention
We keep your content while your account and spaces are active. When you delete media it is soft-deleted and permanently purged from storage around 30 days later. When you delete your account we erase your personal data and login identity (see below); content you contributed to other people's shared spaces may remain there so that one member's deletion does not remove a shared album, but your access is removed. Residual copies may persist briefly in backups before being overwritten.
9. Your rights (UK & EU)
If you are in the UK or EEA you have the right to access, correct, erase, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent. You can delete your account and associated personal data from Settings → Account, or exercise any right by emailing support@huddled.cloud. We aim to respond within one month. You also have the right to complain to your local supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk).
10. US privacy rights (California and other states)
We collect the categories of personal information described in Section 3 (identifiers, account and commercial information, internet/network activity, and user content) for the business purposes described in Section 4. In the past 12 months we have not sold or "shared" personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA), and we do not knowingly do so. If you are a California resident — or a resident of another US state with similar laws — you may request to know, access, delete, or correct your personal information, and you will not be discriminated against for exercising these rights. Submit a request to support@huddled.cloud; you may use an authorised agent to act on your behalf.
11. Security
We protect data with encryption in transit (TLS), scoped access controls, hashing of API keys, encryption of stored integration tokens, and reputable infrastructure providers. No system is perfectly secure, but we work to protect your data and to notify you and regulators of a qualifying breach where the law requires.
12. Children
Huddled is not intended for children under 13, and under 16 in the United Kingdom, the EEA, and other regions where a higher age applies. We do not knowingly collect personal data from children below the applicable age. If you believe a child has provided us personal data, contact support@huddled.cloud and we will delete it.
13. Guests
Spaces may allow people to join as guests without an account. For guests we store only a chosen display name and an anonymous session token kept in the guest's browser; guest uploads are held for review by a space administrator before they become visible. A space owner may ask guests to accept a consent notice before joining.
14. Changes to this policy
We may update this policy from time to time. If we make material changes we will notify you in-app or by email and update the "last updated" date above.
15. Contact
Callo Apps LTD, 66 Paul Street, London, EC2A 4NA, United Kingdom. Email support@huddled.cloud.