Privacy Policy

Applies to the website habbly.de and the Habbly app.

1. Data Controller

The controller responsible for data processing is:
Ralf Freit, Tannenstr. 25, 26844 Jemgum, Germany, email: orakel@habbly.de (see also Legal Notice).

2. Overview

We only process personal data to the extent necessary to provide the app and the website. The legal bases are in particular the performance of the usage agreement (Art. 6(1)(b) GDPR), legitimate interests (lit. f), and, where applicable, your consent (lit. a). For profiles of children under 16, we rely on the consent of the parent or legal guardian (Art. 8 GDPR).

3. Hosting

The website and the app's API are hosted on a server in Germany (netcup GmbH, Emmy-Noether-Straße 10, D-76131 Karlsruhe). We have a data processing agreement with this provider (Art. 28 GDPR). Data is processed exclusively within the EU.

Server log files

When the website is accessed, information is automatically stored in server logs: IP address, date and time, resource accessed, amount of data transferred, referrer and user agent. This serves the secure and stable operation of the service (Art. 6(1)(f) GDPR). The logs are deleted or anonymized after a short period.

4. Fonts (no connection to Google)

We embed the fonts used locally from our own server. There is no connection to third-party servers (e.g. Google Fonts); your IP address is not transmitted to Google when you visit the page.

5. Cookies, consent management & statistics on the website

The website habbly.de only sets cookies and comparable technologies if you have consented to them — except for technically necessary functions.

Cookie consent tool (CCM19)

To obtain, manage and document your consent, we use the consent manager CCM19 provided by Papoo Software & Media GmbH, Auguststraße 4, 53229 Bonn, Germany. When you visit the website, a connection is established to the provider's server and your consent decision is stored in a cookie on your device so that you are not asked again on your next visit. The legal basis is our legitimate interest in verifiable, GDPR-compliant consent management (Art. 6(1)(f) GDPR).

Google Analytics

If you have given your consent, we use Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for statistical analysis of website usage (e.g. pages viewed, time spent, visitor origin). This sets cookies (including _ga, _ga_*, stored for up to 2 years) and transfers usage data to Google's servers, including in the US; the EU standard contractual clauses and/or the EU-US Data Privacy Framework serve as safeguards for an adequate level of data protection. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future via the cookie settings. More information: policies.google.com/privacy.

6. Registration & account

To use the app you create an account. In doing so, we process:

• a display name and (for parent/adult accounts) an email address,
• an encrypted, hashed password,
• game progress and household activity (tasks, XP, coins, level, titles, streaks),
• optionally an allowance balance managed by parents — this is a purely bookkeeping feature within the app; Habbly itself does not pay out any money, actual payment remains solely the parents' responsibility,
• optionally a proof photo, if you submit one for a task,
• optionally a gender (only used for correct forms of address/titles) and a chosen avatar.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

Managed child profiles

Parents can create managed profiles without their own email/password for younger children. This requires the consent of the parent or legal guardian (Art. 8 GDPR); we collect only a display name and game progress, kept to a minimum. Sensitive actions are protected by a parent PIN.

7. Invitations

When you invite family members, we send an email to the address you provide or generate a time-limited invitation code. The email address is used solely to deliver the invitation.

8. Email delivery

Transactional emails (invitation, password reset, email confirmation, household notices) are sent via an email service provider located in Germany. Content and recipient address are processed solely for delivery purposes.

9. Push notifications

If you enable push notifications (e.g. when review is needed), we store your device's push token and use the push service of Expo/Apple/Google for delivery. You can disable push at any time in your device settings or by logging out. Legal basis: your consent (Art. 6(1)(a) GDPR).

10. Real-time updates

So that changes (e.g. new tasks or approvals) appear for all household members without a manual reload, the app maintains a persistent connection (WebSocket) to our own, self-hosted server. No third-party service is involved, and no additional personal data is processed beyond what already arises from normal API use.

11. Advertising (free version only)

In the free version we display ad banners via Google AdMob (Google Ireland Ltd.). Advertising is deliberately configured to be child-appropriate and non-personalized: only content rated "for everyone" (G-rating), tagged for child-directed treatment and for users under the age of consent, without personalized tracking. Premium users see no advertising. Information on Google's privacy practices: policies.google.com/privacy.

12. Subscription (Premium)

Premium can be purchased through the Apple App Store or Google Play. Payment is processed exclusively by the respective platform; we do not receive complete payment data (e.g. no credit card or bank account details). To unlock the subscription, the app sends the purchase receipt issued by Apple or Google to our server, which verifies it directly with Apple or Google.

13. Family calendar (iCal/ICS)

On request, we provide your task due dates as a subscribable calendar feed. Access is via a secret, randomly generated address (token). Anyone who knows the link can access the feed — please do not share it publicly. Access can be reset at any time.

14. Retention & deletion

We store data for as long as your account or the household exists. When a household is deleted, its content is permanently removed; managed child profiles without their own account are deleted along with it. You may request deletion of your account at any time.

15. Your rights

Under the GDPR, you have the following rights:

• access (Art. 15), rectification (Art. 16), erasure (Art. 17),
• restriction of processing (Art. 18), data portability (Art. 20),
• objection to processing based on legitimate interests (Art. 21),
• withdrawal of any consent given, with effect for the future (Art. 7(3)).

To exercise these rights, an informal message to the address given in the Legal Notice is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority.

16. Data security

Data is transmitted in encrypted form via TLS/HTTPS. Passwords are stored exclusively as hashes. We take appropriate technical and organizational measures to protect your data.