Privacy Policy

Applies to the website habbly.de and the Habbly app.

1. Data Controller

The controller responsible for data processing is:
Ralf Freit, Tannenstr. 25, 26844 Jemgum, Germany, email: orakel@habbly.de (see also Legal Notice).

2. Overview

We only process personal data to the extent necessary to provide the app and the website. The legal bases are in particular the performance of the usage agreement (Art. 6(1)(b) GDPR), legitimate interests (lit. f), and, where applicable, your consent (lit. a). For profiles of children under 16, we rely on the consent of the parent or legal guardian (Art. 8 GDPR).

3. Hosting

The website and the app's API are hosted on a server in Germany (netcup GmbH, Emmy-Noether-Straße 10, D-76131 Karlsruhe). We have a data processing agreement with this provider (Art. 28 GDPR). Data is processed exclusively within the EU.

Server log files

When the website is accessed, information is automatically stored in server logs: IP address, date and time, resource accessed, amount of data transferred, referrer and user agent. This serves the secure and stable operation of the service (Art. 6(1)(f) GDPR). The logs are deleted or anonymized after a short period.

4. Fonts (no connection to Google)

We embed the fonts used locally from our own server. There is no connection to third-party servers (e.g. Google Fonts); your IP address is not transmitted to Google when you visit the page.

5. Cookies & tracking on the website

The website habbly.de does not set tracking cookies and does not embed any third-party analytics or marketing services.

6. Registration & account

To use the app you create an account. In doing so, we process:

• a display name and (for parent/adult accounts) an email address,
• an encrypted, hashed password,
• game progress and household activity (tasks, XP, coins, level, titles, streaks),
• optionally an allowance balance managed by parents — this is a purely bookkeeping feature within the app; Habbly itself does not pay out any money, actual payment remains solely the parents' responsibility,
• optionally a proof photo, if you submit one for a task,
• optionally a gender (only used for correct forms of address/titles) and a chosen avatar.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

Managed child profiles

Parents can create managed profiles without their own email/password for younger children. This requires the consent of the parent or legal guardian (Art. 8 GDPR); we collect only a display name and game progress, kept to a minimum. Sensitive actions are protected by a parent PIN.

7. Invitations

When you invite family members, we send an email to the address you provide or generate a time-limited invitation code. The email address is used solely to deliver the invitation.

8. Email delivery

Transactional emails (invitation, password reset, email confirmation, household notices) are sent via an email service provider located in Germany. Content and recipient address are processed solely for delivery purposes.

9. Push notifications

If you enable push notifications (e.g. when review is needed), we store your device's push token and use the push service of Expo/Apple/Google for delivery. You can disable push at any time in your device settings or by logging out. Legal basis: your consent (Art. 6(1)(a) GDPR).

10. Real-time updates

So that changes (e.g. new tasks or approvals) appear for all household members without a manual reload, the app maintains a persistent connection (WebSocket) to our own, self-hosted server. No third-party service is involved, and no additional personal data is processed beyond what already arises from normal API use.

11. Advertising (free version only)

In the free version we display ad banners via Google AdMob (Google Ireland Ltd.). Advertising is deliberately configured to be child-appropriate and non-personalized: only content rated "for everyone" (G-rating), tagged for child-directed treatment and for users under the age of consent, without personalized tracking. Premium users see no advertising. Information on Google's privacy practices: policies.google.com/privacy.

12. Subscription (Premium)

Premium can be purchased through the Apple App Store or Google Play. Payment is processed exclusively by the respective platform; we do not receive complete payment data (e.g. no credit card or bank account details). To unlock the subscription, the app sends the purchase receipt issued by Apple or Google to our server, which verifies it directly with Apple or Google.

13. Family calendar (iCal/ICS)

On request, we provide your task due dates as a subscribable calendar feed. Access is via a secret, randomly generated address (token). Anyone who knows the link can access the feed — please do not share it publicly. Access can be reset at any time.

14. Retention & deletion

We store data for as long as your account or the household exists. When a household is deleted, its content is permanently removed; managed child profiles without their own account are deleted along with it. You may request deletion of your account at any time.

15. Your rights

Under the GDPR, you have the following rights:

• access (Art. 15), rectification (Art. 16), erasure (Art. 17),
• restriction of processing (Art. 18), data portability (Art. 20),
• objection to processing based on legitimate interests (Art. 21),
• withdrawal of any consent given, with effect for the future (Art. 7(3)).

To exercise these rights, an informal message to the address given in the Legal Notice is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority.

16. Data security

Data is transmitted in encrypted form via TLS/HTTPS. Passwords are stored exclusively as hashes. We take appropriate technical and organizational measures to protect your data.