Privacy Policy

1. Introduction

Welcome to Huddle, a safe, private messaging app for Australians. For younger users, it's a stepping stone to social media with built-in parental oversight. For everyone else, it's a simpler alternative without the algorithms, strangers, and complexity of mainstream platforms.

This Privacy Policy explains how Opentribe Pty Ltd (ACN 689 986 034) ("we", "us", "our", or "Opentribe") collects, uses, discloses, and protects your personal information when you use the Huddle mobile application ("App"). We are committed to protecting your privacy and handling your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1.1 Who We Are

Opentribe Pty Ltd (ACN 689 986 034, 17A Riverside Drive, Parkhurst QLD 4211, Australia) operates the Huddle app and all related activities. This Policy explains how we collect, use, disclose, and protect personal data for all Australian users.

1.2 What This Policy Covers

This Privacy Policy applies to:

• The Huddle mobile application (iOS and Android)
• All users of the App, including children, parents, and guardians
• All personal information collected through the App

This policy does not cover third-party websites or services that may be linked from the App.

1.3 Age of Users

Huddle is available to users of all ages in Australia.

For young Australians under 16:

Huddle serves as a transitional messaging app that helps young people develop healthy digital habits before they're ready for the features of traditional social media. For these users, a parent or guardian must create and manage the account on their behalf, with access to safety features like activity monitoring and time limits.

For users 16 and over:

Huddle is also available as a simple, private messaging app for anyone who wants a safer alternative to mainstream platforms without algorithms, friend recommendations, and complexity. Users 16+ can create their own account and use the App independently, without parental controls.

By using Huddle, you confirm that either:

• You are aged 16 or over; or
• Your account has been created by your parent or guardian with their consent.

1.4 Related Documents

Please also review our Terms of Service, which govern your use of the App.

2. Information We Collect

We collect different types of information depending on how you use Huddle and whether you are a child user, a user aged 16 or over, or a parent.

2.1 Account Information

When you create a Huddle account, we collect:

• Display name — The name shown to your friends in the app
• Date of birth — Used to determine your age and which account type applies to you
• Email address — Required for users 16 and over and for parent accounts. Not required for child accounts created by parents.
• Password — Stored securely using industry-standard encryption. We cannot see your password.

We also automatically generate:

• User code — A unique 8-character code that can be used to identify your account

We do not access or upload your phone contacts.

2.2 Profile Information

You may optionally provide:

• Avatar customisation — Colour preferences and accessories for your profile avatar
• Auto-save preference — Whether to automatically save received photos to your device

2.3 Messages and Media

When you use Huddle to communicate, we collect:

• Text messages — The content of messages you send to friends and groups
• Photos and videos — Media you capture or send through the app, including any text overlays you add
• Message status — When messages are sent, delivered, and viewed

We store this information to deliver your messages and to support safety features. See Section 4 (Data Retention) for how long we keep this information.

2.4 Friends and Social Connections

We collect information about your social connections, including:

• Friend requests — Who you send requests to and who sends requests to you
• Friend list — Your accepted friends
• Best friends — Which friends you mark as best friends (visible only to you)
• Group chats — Groups you create or participate in, including group names and members

We do not use algorithms to recommend friends or suggest people you may know. You can only add friends by meeting them in person and connecting via Bluetooth.

2.5 Bluetooth and Device Information

Huddle uses Bluetooth to let you add friends when you're physically near each other. When you use this feature:

• Bluetooth device identifiers — We temporarily detect nearby devices running Huddle
• User identification — Your user ID is shared with nearby devices to enable friend requests

This information is only processed while you are actively using the "Huddle" friend-finding feature and is not stored on our servers.

We do not collect GPS data, track your location, or store any information about where you have been.

2.6 Usage Information

We collect information about how you use the app:

• Activity data — How many minutes you are active in the app each day
• Streaks — When you and a friend have messaged each other on consecutive days

For child accounts with a linked parent, this usage information may be visible to the parent through their dashboard.

We do not use third-party analytics services or share your usage data with advertisers.

2.7 Safety Reports and Alerts

If you or your parent use our safety features, we collect:

• Parent alerts — When a child sends an alert to their parent, we store the alert category, any message from the child, and a snapshot of any attached message
• Platform reports — When you report content to us, we store the report type, your description, and a snapshot of the reported message

Snapshots preserve the content of messages at the time of reporting, even if the original message is later deleted. This ensures we can investigate safety concerns.

2.8 Parental Controls Information

For child accounts with a linked parent, we collect:

• Parent-child link — The connection between parent and child accounts, including who initiated the link and when
• Time restrictions — Any messaging time limits set by the parent
• Streak settings — Whether streaks are enabled or disabled for the child

2.9 Consent Records

We keep records of when you agree to our policies:

• Policy acceptance — When you agreed to the Privacy Policy and Terms of Service, and which version
• Parental consent — For child accounts, when the parent provided consent and confirmed their relationship

2.10 Payment Information

If you subscribe to premium features, payments are processed by Apple (App Store) or Google (Play Store). We do not collect or store your payment card details.

We receive only:

• Confirmation that a subscription is active
• Subscription expiry dates
• Transaction identifiers for support purposes

For details on how Apple or Google handle your payment information, please refer to their respective privacy policies.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Providing Our Services

We use your information to deliver the core features of Huddle:

• Account management — To create and maintain your account, authenticate your identity, and personalise your experience
• Messaging — To send, deliver, and display messages between you and your friends, including text, photos, and videos
• Friend connections — To process friend requests, maintain your friends list, and enable you to connect with people you meet in person via Bluetooth
• Group chats — To create and manage group conversations, add members, and deliver messages to all participants
• Streaks — To track and display messaging streaks between you and your friends
• Notifications — To alert you about new messages, friend requests, and other activity

We do not use algorithms to suggest friends, recommend content, or influence who you connect with.

3.2 Safety and Security

Protecting our users, especially children, is our highest priority. We use your information to:

• Detect illegal content — We use industry-standard hash-matching technology to detect and block known Child Sexual Abuse Material (CSAM) before it can be shared. This compares image fingerprints against databases of known illegal content without viewing or analysing your messages.
• Respond to reports — When you or another user submits a safety report or parent alert, we review the reported content to investigate potential violations and take appropriate action.
• Prevent abuse — We use rate limiting to prevent spam and misuse of our reporting systems.
• Protect accounts — We monitor for unusual login activity and alert you when your account is accessed from a new device.
• Prevent fake accounts — We limit the number of accounts that can be created from a single device to prevent misuse.

We do not use automated systems to scan or analyse the content of your private messages beyond the illegal content detection described above.

3.3 Parental Features

For child accounts with a linked parent, we use information to enable parental oversight:

• Activity visibility — Parents can view their child's daily app usage, friends list, and group chat memberships
• Safety alerts — When a child sends an alert to their parent, we deliver the alert along with any attached message
• Time restrictions — We enforce messaging time limits set by parents
• Friend management — Parents can view and manage friend requests on their child's behalf

Parents cannot read the content of their child's direct messages.

3.4 Legal Compliance

We use your information to comply with our legal obligations:

• Age verification — We use your date of birth to determine which account type and features apply to you
• Parental consent — We maintain records of parental consent for child accounts as required by Australian privacy law
• Responding to legal requests — We may access, preserve, or share your information if required by law or to respond to valid legal requests from authorities
• Safety investigations — We retain certain data for a limited period to support investigations into safety concerns or policy violations

3.5 Improving Our Services

We use aggregated, non-identifying information to understand how Huddle is used and to improve our services:

• Usage statistics — We analyse aggregate data such as daily active users and feature usage to understand how the app is performing
• Technical issues — We may use crash reports and error logs to identify and fix problems

This aggregate data cannot be used to identify any individual user. We do not use third-party analytics services or share usage data with advertisers.

3.6 Advertising and Data Sales

Huddle does not display advertisements. We do not sell your personal information to anyone. We do not share your information with third parties for their marketing purposes. We do not build behavioural profiles based on your messaging activity, interests, or connections.

4. Data Retention

We keep your information only for as long as necessary to provide our services, comply with legal obligations, and support safety investigations. This section explains how long we retain different types of data.

4.1 Account Data

We retain your account information (display name, date of birth, email address, user code, and avatar customisation) for as long as your account is active.

If you delete your account, we retain your data for an additional 30 days before permanent deletion. This allows you to recover your account if the deletion was accidental or if you change your mind. After 30 days, your account data is permanently deleted and cannot be recovered.

If your account is subject to an active safety investigation or legal hold at the time of deletion, we may retain relevant data until the matter is resolved.

4.2 Messages

Text messages are retained for as long as your friendship with the recipient is active. If a friendship ends (either user removes the other), messages are retained for 90 days to allow restoration if you reconnect. After 90 days, messages from ended friendships are permanently deleted.

Photos and videos are automatically deleted 7 days after sending, or 24 hours after all recipients have viewed them, whichever occurs first. This minimises the storage of children's images while still allowing time for recipients to view them.

We do not offer a "delete for everyone" feature. Once a message is sent, the recipient may have already viewed it.

4.3 Friends and Social Connections

Your friends list, friend requests, and best friends selections are retained for as long as your account is active.

If a friendship ends, the friendship record is retained for 90 days alongside any associated messages. This allows the friendship and conversation history to be restored if you reconnect within that period. After 90 days, the friendship record and conversation are permanently deleted.

Group chat membership is retained for as long as you remain in the group or your account is active.

4.4 Usage Information

Daily usage logs (how many minutes you spent active in the app) are retained on a 30-day rolling basis. Logs older than 30 days are automatically deleted.

Streak information is retained for as long as both users maintain an active friendship.

4.5 Safety Reports and Alerts

Parent alerts and platform reports, including any preserved message snapshots, are retained for 2 years from the date of the report. This retention period allows us to:

• Cooperate with investigations by the eSafety Commissioner or law enforcement
• Respond to legal requests
• Identify patterns of harmful behaviour

After 2 years, reports and their associated snapshots are permanently deleted unless they are subject to an ongoing legal matter.

4.6 Parental Controls and Consent

Parental consent records (including when consent was given, which parent provided it, and for which child) are retained until the child reaches 25 years of age. This extended retention period protects both you and us by maintaining a clear record of consent should any questions arise after the child becomes an adult.

Time restrictions and streak settings configured by parents are retained for as long as the parent-child link is active. If the link is removed, these settings are deleted within 30 days.

Parent-child link records are retained for as long as the link is active. If a child gains independence (at age 16 or over with parental approval), the link record is deleted, though we retain a note on the child's account that they were previously a child account.

4.7 Payment Information

We do not store your payment card details. Payments are processed by Apple (App Store) or Google (Play Store).

We retain subscription status, transaction identifiers, and expiry dates for 5 years to comply with Australian Taxation Office record-keeping requirements and to resolve any billing disputes.

4.8 Automatic Deletion

We use automated systems to enforce these retention periods. A daily process runs to identify and permanently delete data that has exceeded its retention period. Deletion is irreversible.

4.9 Your Right to Delete

You can delete your account at any time through the Settings screen in the app. You can also request deletion of specific data by contacting holly@opentribe.co

For more information about your privacy rights, see Section 8: Your Rights.

5. How We Share Your Information

We only share your personal information when necessary to provide our services, comply with the law, or protect safety. We do not sell your data or share it for advertising purposes.

5.1 Service Providers

We use trusted third-party service providers to operate Huddle. These providers only access your information as needed to perform services on our behalf and are contractually required to protect it.

We do not use third-party analytics services, advertising networks, or tracking tools.

5.2 Legal Requirements

We may disclose your information if required by law or in response to valid legal requests. This includes:

• Law enforcement requests — We will provide information in response to a valid warrant, court order, or other legal process issued by an Australian court or authority.
• eSafety Commissioner — We cooperate with the eSafety Commissioner in accordance with the Online Safety Act 2021, including responding to removal notices and providing information relevant to investigations into online harms.
• Mandatory reporting — If we detect Child Sexual Abuse Material (CSAM) through our hash-matching systems, we are required to report this to relevant authorities.
• Emergency situations — We may disclose information without a warrant if we believe in good faith that there is an imminent risk of death or serious physical injury to a person.

We will notify you if we receive a legal request for your information unless we are legally prohibited from doing so.

5.3 Safety Investigations

When you submit a platform report or a child sends a parent alert, the relevant information (including message snapshots) may be shared with:

• Platform moderators — Our team reviews reports to enforce our Community Guidelines
• The linked parent — Parent alerts are delivered to the child's linked parent account
• Law enforcement or the eSafety Commissioner — If the report reveals potentially illegal content or serious harm

We preserve snapshots of reported messages to ensure evidence is available for investigations even if the original message is deleted.

5.4 With Your Consent

We may share your information in other circumstances if you give us explicit consent. For example:

• If you choose to share your user code with someone to add them as a friend
• If a parent chooses to share information from their dashboard with a school or counsellor

5.5 What We Do NOT Do

To be clear about our practices:

• We do not sell your personal information to data brokers, advertisers, or any third parties.
• We do not share your information with marketing partners or use it for targeted advertising.
• We do not integrate with social media platforms or allow sign-in via Facebook, Google, or other social accounts.
• We do not use third-party analytics that track your behaviour across apps or websites.
• We do not share your friends list, messages, or photos with anyone except as described in this policy.

5.6 Business Transfers

If Opentribe Pty Ltd is acquired, merges with another company, or sells assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice in the app before your information becomes subject to a different privacy policy.

5.7 International Data Transfers

Some of our service providers, including Resend (email), Apple, and Google, are based in the United States. This means limited personal information (email address, device tokens, subscription status) may be transferred to and processed in the United States.

Your core data — messages, photos, videos, and friend connections — is stored in Sydney, Australia and does not leave the country.

We select service providers with strong security practices and industry certifications (such as SOC 2), and rely on their standard contractual terms which include data protection commitments.

For more information about how our providers handle data:

• Supabase: https://supabase.com/privacy
• Resend: https://resend.com/legal/privacy-policy

6. Children's Privacy

Protecting children's privacy is central to Huddle's design. This section explains how we handle personal information for users under 16, and the rights of both children and their parents.

6.1 Age Requirements

Huddle is available to users of all ages in Australia.

• Users aged 16 and over may create their own account and use Huddle independently.
• Users under 16 must have their account created by a parent or guardian. These users cannot sign up directly.

We determine age based on the date of birth provided during account creation. We may implement additional verification measures in the future to confirm parental identity or age, as required by law or to enhance safety.

6.2 Parental Consent

For users under 16, a parent or guardian must:

1. Create a parent account — The parent first creates their own Huddle account, confirming they are 18 or over.
2. Verify their email address — The parent must verify their email address before they can create or manage child accounts.
3. Create the child's account — The parent creates the child's account from their parent dashboard, providing the child's display name, date of birth, and a password.
4. Provide consent — By creating the child's account, the parent consents to Huddle collecting and processing the child's personal information as described in this Privacy Policy.

The child can then log in using their user code and password. The child does not need to provide an email address.

We maintain records of parental consent until the child reaches 25 years of age (see Section 4.6).

6.3 What Parents Can See

Parents with a linked child account have access to the following information through their parent dashboard:

• Child's friend list
• Incoming and outgoing friend requests
• Group chat names and members
• Daily app usage (minutes active)
• Alerts sent by the child
• Time restriction settings
• Streak settings

6.4 What Parents Cannot See

To protect children's privacy and encourage open communication with friends, parents cannot access:

• Message content (text)
• Photos and videos
• Saved items

Parents are notified if their child sends them a safety alert, which may include a snapshot of a specific message the child chooses to share.

6.5 What Parents Can Do

Parents can take the following actions on behalf of their linked child:

• Manage friends — View, accept, decline, or remove friend requests and friendships
• Set time restrictions — Limit the hours during which the child can send messages
• Control streaks — Enable or disable the streaks feature for their child
• Receive alerts — Get notified when their child flags a message or requests help
• View activity — See how many minutes the child has been active each day

6.6 Independence at 16

When a child reaches 16 years of age, they may request independence from parental oversight:

1. The child requests independence through their Settings screen.
2. The parent receives a notification and reviews the request.
3. If the child's account does not have an email address, the parent must provide one for account recovery purposes.
4. Once the parent approves, the parent-child link is removed.

After gaining independence:

• The parent can no longer view the child's information or manage their account
• The child's account becomes a standard user account
• Time restrictions and parental streak settings are removed
• The child retains their existing friends, conversations, and message history

6.7 Child's Data Rights

Children have the same privacy rights as all users, including the right to:

• Access their data — Request a copy of the personal information we hold about them
• Correct their data — Update inaccurate information through the app or by contacting us
• Delete their data — Request deletion of their account and associated data

For children under 16, these rights may be exercised by the child's parent or guardian. We will verify the identity of anyone making a request on behalf of a child.

To make a data request, contact holly@opentribe.co

6.8 Data Minimisation for Children

We collect only the information necessary to provide our services. For child accounts specifically:

• No email required — Children log in with a user code and password, not an email address
• No phone number — We do not collect phone numbers from any users
• No contacts access — We do not access or upload the child's phone contacts
• No location tracking — We do not collect GPS or location data
• Short media retention — Photos and videos are automatically deleted within 7 days or 24 hours after viewing
• No behavioural profiling — We do not build profiles based on messaging patterns or interests

6.9 Safety Features for Children

Huddle includes safety features designed to protect children:

• No friend recommendations — Children can only add friends they meet in person via Bluetooth, eliminating contact from strangers
• Parent alerts — Children can flag messages and alert their parent if they feel uncomfortable or unsafe
• Platform reporting — Children can report concerning content directly to our moderation team
• Time restrictions — Parents can limit messaging hours to encourage healthy usage
• No public profiles — Children's profiles are only visible to their accepted friends

7. Security

We take the security of your personal information seriously, particularly given that Huddle is designed for use by children. This section describes the measures we use to protect your data.

7.1 Encryption

In transit: All data transmitted between your device and our servers is encrypted using Transport Layer Security (TLS). This prevents third parties from intercepting your information as it travels over the internet.

At rest: Your data is stored in encrypted databases. Our infrastructure provider, Supabase, encrypts all data at rest using AES-256 encryption.

Why we don't use end-to-end encryption: Unlike some messaging apps, Huddle does not use end-to-end encryption. This is a deliberate safety decision. End-to-end encryption would prevent us from:

• Detecting Child Sexual Abuse Material (CSAM) using hash-matching technology
• Responding to safety reports and parent alerts
• Cooperating with law enforcement when legally required

We believe that for an app designed for children, the ability to detect and respond to harmful content is more important than preventing platform access to messages.

7.2 Access Controls

Database security: We use Row Level Security (RLS) policies to ensure users can only access their own data. These policies are enforced at the database level, meaning even application bugs cannot bypass them.

Password protection: All passwords are hashed using industry-standard algorithms before storage. We cannot see your password, and neither can our staff.

Parent-child separation: Parents can only view information about their linked children as described in Section 6. They cannot access other users' data.

Staff access: Access to user data by Opentribe staff is limited to what is necessary for:

• Responding to safety reports
• Providing customer support
• Complying with legal requests
• Maintaining and improving the service

7.3 Illegal Content Detection

We use PhotoDNA, an industry-standard hash-matching technology developed by Microsoft, to detect known Child Sexual Abuse Material (CSAM).

This system:

• Compares image fingerprints against databases of known illegal content
• Does not view, analyse, or store the content of your messages
• Blocks illegal content before it can be shared
• Reports detected material to relevant authorities as required by law

This technology is used by major platforms worldwide and is an important part of keeping children safe online.

7.4 Infrastructure Security

Our infrastructure is hosted by Supabase, which maintains:

• SOC 2 Type II certification
• Data encryption at rest and in transit
• Regular security assessments
• Access controls and monitoring

For more information about Supabase's security practices, see https://supabase.com/security.

7.5 Security Reviews

We conduct regular security reviews of our application and infrastructure to identify and address potential vulnerabilities. This includes:

• Monitoring for known vulnerabilities in software dependencies
• Reviewing access controls and permissions
• Testing for common security issues
• Updating systems promptly when security patches are available

7.6 Data Breach Response

In the event of a data breach that is likely to result in serious harm, we will:

1. Assess the breach — Determine the scope, type of data affected, and potential harm
2. Contain the breach — Take immediate steps to prevent further unauthorised access
3. Notify affected users — Inform you about the breach, what information was involved, and what steps you should take
4. Notify the regulator — Report the breach to the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme under the Privacy Act 1988

We aim to notify affected users as soon as practicable, and in any event within the timeframes required by law.

7.7 What You Can Do

You can help keep your account secure by:

• Choosing a strong, unique password
• Not sharing your password or user code with anyone you don't trust
• Logging out of shared devices
• Telling a parent or guardian if you notice anything suspicious

If you believe your account has been compromised, contact us immediately at holly@opentribe.co

8. Your Rights

Under the Australian Privacy Act 1988, you have rights regarding your personal information. This section explains those rights and how to exercise them.

8.1 Right to Access

You have the right to request access to the personal information we hold about you. This includes:

• Your account information (display name, date of birth, email, user code)
• Your friends list and friend requests
• Messages you have sent (subject to our retention periods)
• Your usage logs
• Consent records
• Any reports or alerts you have submitted

How to request access: Email holly@opentribe.co with the subject "Data Access Request". We will verify your identity and respond within 30 days.

For child accounts, a parent or guardian may submit a request on the child's behalf. We will verify the parent-child relationship before releasing any data.

8.2 Right to Correction

You have the right to request correction of inaccurate personal information.

What you can update yourself:

• Display name — Edit directly in Settings

What requires a support request:

• Email address — Contact us to initiate an email change with verification
• Date of birth — Changes require identity verification to prevent age restriction bypass

What cannot be changed:

• User code — This is a permanent unique identifier

To request a correction, email holly@opentribe.co with details of what needs to be corrected.

8.3 Right to Deletion

You have the right to delete your account and have your personal information removed from our systems.

How to delete your account:

1. Go to Settings in the app
2. Scroll to "Delete Account"
3. Confirm your decision

What happens when you delete:

• Your account enters a 30-day recovery period
• During this time, you can log back in to cancel the deletion
• After 30 days, your account and all associated data are permanently deleted
• This includes: messages, photos, videos, friends, usage logs, and settings

For parent accounts: If you delete your parent account, all linked child accounts will also be deleted. You will be warned of this before confirming deletion. If you want to preserve your children's accounts, you must unlink them first.

Exceptions to deletion: We may retain certain information after account deletion if:

• Required for legal compliance (e.g., records related to safety reports)
• Subject to an active investigation
• Necessary to enforce our Terms of Service

In these cases, we will retain only the minimum information necessary and delete it when no longer required.

8.4 Right to Withdraw Consent

Where we process your information based on consent, you have the right to withdraw that consent at any time.

How consent withdrawal affects you:

• Withdrawing consent to the Privacy Policy requires deleting your account, as we cannot provide the service without processing your data
• Parents can withdraw consent for their child's account by deleting the child's account from the parent dashboard

Withdrawing consent does not affect the lawfulness of processing that occurred before the withdrawal.

8.5 Right to Complain

If you believe we have not handled your personal information in accordance with the Australian Privacy Principles, you have the right to complain.

Step 1: Contact us first

Email holly@opentribe.co with details of your complaint. We take all complaints seriously and will:

• Acknowledge your complaint within 7 days
• Investigate the matter
• Respond with our findings within 30 days

Step 2: Contact the OAIC

If you are not satisfied with our response, or if we do not respond within 30 days, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Online: https://www.oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

The OAIC can investigate your complaint and may require us to take specific actions to resolve it.

8.6 Requests on Behalf of Children

For users under 16, parents or guardians may exercise these rights on the child's behalf.

To make a request for a child:

1. Email holly@opentribe.co from the email address registered to your parent account
2. Identify the child account (by display name or user code)
3. Describe your request

We will verify the parent-child link before processing any request.

Children aged 16 and over, or those who have gained independence from parental oversight, must make requests themselves.

8.7 No Fee for Requests

We do not charge a fee for access requests or other privacy-related requests in most cases. If a request is clearly unfounded, repetitive, or excessive, we may charge a reasonable fee to cover administrative costs, or refuse the request. We will explain our reasons if this occurs.

8.8 Response Times

We aim to respond to all privacy requests within 30 days. If we need more time (for example, for complex requests), we will let you know within 30 days and explain why.

9. International Data Transfers

Your personal information is primarily stored and processed in Australia. This section explains when and how your data may be transferred to other countries.

9.1 Where Your Data Is Stored

Your core data — including all messages, photos, videos, and friend connections — is stored in Australia and does not leave the country under normal operation.

9.2 Transfers to the United States

Some of our service providers are based in the United States. When your data is transferred to the US, it is limited to:

• Email communications — Your email address and display name are shared with Resend to send verification emails, password resets, and parent notifications
• App distribution — Basic device and subscription information is processed by Apple and Google to deliver the app and process payments
• Push notifications — Device tokens are processed by Apple (APNs) and Google (FCM) to deliver notifications

We do not transfer the content of your messages, photos, or videos to the United States.

9.3 Safeguards for International Transfers

When your data is transferred overseas, we ensure appropriate safeguards are in place:

• Service provider selection — We choose providers with strong security practices and industry certifications (such as SOC 2)
• Contractual protections — Our service providers are bound by their standard terms which include data protection commitments
• Data minimisation — We only transfer the minimum data necessary for each service to function

Our US-based providers maintain security standards comparable to Australian requirements, including encryption in transit and at rest.

9.4 Your Consent to Transfer

By using Huddle, you consent to the transfer of limited personal information (email address, device tokens) to the United States for the purposes described above.

If you do not consent to these transfers, you may choose not to use the app. However, please note that core messaging data remains in Australia and is not transferred overseas.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. This section explains how we will notify you of changes and what happens when the policy is updated.

10.1 How We Will Notify You

When we make changes to this Privacy Policy:

For all changes:

• We will update the "Last Updated" date at the top of this policy
• The updated policy will be posted at https://huddle.opentribe.co/policies/privacy

For material changes:

• We will notify you via an in-app notification when you next open Huddle
• We will send an email to all users with a registered email address (parents and users aged 16+)
• We will provide at least 14 days' notice before the changes take effect

Material changes include changes to:

• What personal information we collect
• How we use your information
• Who we share your information with
• Your rights regarding your data
• How we handle children's data

10.2 Your Acceptance of Changes

For material changes, you will be asked to review and accept the updated policy before continuing to use Huddle. If you do not accept the updated policy, you will not be able to use the app until you do.

For minor changes (such as clarifications, formatting, or corrections that do not affect your rights), your continued use of Huddle after the changes take effect constitutes acceptance.

10.3 Parental Re-Consent

When we make material changes that affect how we collect, use, or share children's personal information, we will require parents to provide fresh consent before their child can continue using Huddle.

How parental re-consent works:

1. We will notify parents via email and in-app notification
2. Parents will see a prompt in their parent dashboard to review the updated policy
3. Parents must accept the new policy for each linked child account
4. Until the parent provides consent, the child's account will have limited functionality

This ensures parents remain informed and in control of how their child's data is handled.

10.4 Version History

We maintain a version history of this Privacy Policy. You can request previous versions by contacting us at holly@opentribe.co.

10.5 Questions About Changes

If you have questions about any changes to this Privacy Policy, please contact us at holly@opentribe.co before the changes take effect. We are happy to explain what has changed and why.

Contact Us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us:

• Email: holly@opentribe.co
• Address: Opentribe Pty Ltd, 17A Riverside Drive, Parkhurst QLD 4211, Australia