Privacy Policy

Last updated: September 30, 2026

hugshot is an app for taking photos together with the people you meet in person. This policy explains what personal data hugshot collects, why, who it is shared with and the rights you have over it.

1. Who is responsible

hugshot is published by Frédéric Dinand, who is the data controller for the personal data described here. For any question or request about your data, write to contact@hugshot.app.

2. What we collect

• Account data: the identifier and email address given by Sign in with Apple or Google Sign-In (Apple may give us a relay address instead of your real one).
• Profile data: your username, your name, your profile photo, your language and whether your account is private.
• Date of birth: used only to check that you are old enough to use hugshot. It is never shown to other users.
• hugshots: the photos you and your pal take together, the date they were taken and the place they were taken (city and place name).
• Location: when you shake your phone to take a hugshot, your precise location is sent to find the pal shaking next to you, and to tag the hugshot with its place. hugshot only reads your location while you use the app, never in the background.
• Motion: the motion sensor detects the shake. Motion data stays on your phone.
• Your content: comments, messages, Moments and notes you write, and who you are pals with.
• Referrals: who invited you to hugshot, and who you invited.
• Notifications: a push token for your device, if you allow notifications.
• Usage and diagnostics: the screens you visit, the actions you take, recordings of your sessions in the app (session replay), device model, operating system, app version, and crash and error reports.

hugshot uses your camera to take photos and may read your photo library when you pick a profile photo or save a hugshot to it. Only the photos you take or pick in hugshot are uploaded. We do not access your contacts.

3. Why we use it

• To run hugshot: create your account, pair you with the pal you shake with, store and show your hugshots, deliver messages and notifications. The legal basis is the performance of our contract with you (the Terms of Use).
• To check your age, which is a legal obligation and part of the contract.
• To understand how hugshot is used, fix bugs and improve the app. The legal basis is our legitimate interest in providing an app that works well.
• To keep hugshot safe, investigate abuse and enforce the Terms of Use, based on our legitimate interest and, where required, legal obligations.

We do not sell your personal data and we do not show advertising.

4. What other users see

Your username, name and profile photo are visible to other hugshot users, for instance in search. A hugshot belongs to both people in it: your pal sees it as you do, and each of you can save or share it. If your account is private, only your pals see your hugshots. Otherwise, other users may see them on your profile.

5. Service providers

We rely on these providers, who process data on our behalf:

• Supabase: database, authentication and photo storage.
• Amplitude: product analytics and session replay (servers in the United States).
• Sentry: crash and error reporting.
• Expo: app updates and delivery of push notifications, through Apple and Google.
• Mapbox: maps shown in the app.
• OpenStreetMap (Nominatim): finding the city of a hugshot from its coordinates.
• Apple and Google: sign-in.

Some of these providers are based in or transfer data to countries outside the European Economic Area, including the United States. These transfers are covered by the European Commission's adequacy decisions (such as the EU-US Data Privacy Framework) or by its Standard Contractual Clauses.

6. How long we keep it

We keep your data for as long as your account exists. Analytics and diagnostic data are kept for a limited period set by each provider, and at most 12 months after collection.

7. Deleting your account

You can delete your account at any time in the app, from Settings. This deletes your profile, your profile photos, your content and your photo in every hugshot. Your pals keep the hugshots you took together, with their own photo, a blurred placeholder in place of yours and “User not found” in place of your name. The messages you sent stay in their conversations under that same label. Copies kept in our providers' backups disappear as those backups expire. If you no longer have the app, see Delete your account.

8. Your rights

Under the GDPR and similar laws, you have the right to access your data, correct it, delete it, receive a copy of it in a portable format, object to or restrict its use when it is based on our legitimate interest, and to give instructions about what happens to it after your death. To exercise these rights, write to contact@hugshot.app. We answer within one month.

You can also file a complaint with your data protection authority. In France, that is the CNIL (cnil.fr).

9. Children

hugshot is not meant for children under 13, and we do not knowingly collect their data. If you believe a child under 13 is using hugshot, write to us and we will delete the account. In some countries, users under the local age of digital consent (15 in France) also need a parent's permission.

10. Security

Data is encrypted in transit, and access to it is restricted by account-level rules in our database. No system is perfectly secure, but we take reasonable measures to protect your data.

11. Changes

We may update this policy. When a change is significant, we will tell you in the app before it applies. The date at the top shows the latest version.