# Huffr privacy policy

Last updated October 10, 2026

Huffr is an 18+ social and dating app for adults with shared interests. Optional interests and relationship preferences may reveal sensitive information about sexual life or orientation. This policy explains how the Huffr beta handles information when you create a profile, discover people and community updates, connect, and communicate.

For privacy questions or requests, contact [support@huffr.app](mailto:support@huffr.app).

## Account and profile information

In app versions that require acknowledgement of the community rules, the app stores your Huffr account identifier, the rules version, and the acknowledgement time locally on that device. This record is not sent to the service and does not sync across devices. Signing out preserves it; successful account deletion clears it on the device performing deletion. A newer rules version requires another acknowledgement.

The current TestFlight beta supports Sign in with Apple and email/password accounts. Supabase Auth handles authentication. Account records include your Huffr user identifier, sign-in method, email address, linked Apple identity where applicable, any private relay address Apple supplies, and authentication activity. Huffr does not receive your Apple Account password.

Build 15 and later support email/password signup, sign-in, and password recovery. Account emails are sent from support@huffr.app through Mailgun, which processes the recipient address, message content (including verification codes), and delivery information. See [Mailgun’s privacy information](https://www.mailgun.com/legal/privacy-policy/). Profile interests and private conversations are not included in account emails. Support replies are handled through Google Workspace.

The updated app may create a pending authenticated account before asking for your birth date. You must complete adult onboarding before accessing profiles, discovery, community updates, or conversations; dates indicating an age under 18 are rejected. Your registered birth date is bound to your account and stored privately. Older accounts with unfinished profiles must also complete the age check before accessing these features. Earlier registration flows could store a short-lived eligibility record containing a hashed Apple identifier and your declared birth date; successful registration deleted that record, and expired unused records are cleared by later eligibility requests.

The updated app asks you to choose a unique public username after signing in. Available existing names are preserved. Availability checks disclose only whether a name can be chosen. You can normally change your username once every 90 days; the private owner and authorized staff are exempt. Your account identifier remains the same when your username changes. You also provide a public city or region during profile setup. Your birth date is used to calculate your age, restrict access to adults, and apply age preferences to discovery results. Your age is visible on your profile. You can optionally display your birth month. Age is self-reported; Huffr does not request identity documents or claim that this check verifies your identity. Contact support to correct a birth date.

Optional profile information includes your bio, interests, preferences, one primary profile photo, and up to three additional gallery photos. Existing banners from older versions may also remain on the service. Your profile and community updates are shown to other signed-in users according to discovery, connection, and blocking rules. Information about interests and relationships in a niche dating community may be sensitive. Choose what you share accordingly.

Where profile badges are enabled, authorized administrators can assign or remove them. Badges appear to people allowed to view your profile. A badge is not identity, age, or safety verification.

If you customize your profile, Huffr stores your selected theme, visual effect, and last-update time against your account in Supabase. People allowed to view your profile receive its theme and effect. These settings are not end-to-end encrypted and remain until changed or your account is deleted. You can choose None for either setting and save the change. The app's light/dark appearance and app-icon selection are separate device settings.

## Who you see

After profile setup, the updated app asks for your gender, an optional orientation, and which genders you want to see. You can choose Prefer not to say and change these settings later in Profile → Settings → Who you see. An orientation choice may suggest a selection, but the final Show me choices determine your discovery results. Huffr does not infer these settings from your profile or messages.

These settings are private account data stored in Supabase, not end-to-end encrypted. Orientation is not displayed on profiles or used to filter other people. Your chosen gender determines which discovery results can include you, so appearing in a gender-filtered list can reveal that classification. Profiles without a specified gender are included when Everyone is selected. Your Show me choices filter Nearby, photo-ready discovery, ordinary people search, and the authors shown on Board. They do not block existing conversations, friends, or direct profile access. Access to an individual Board post also depends on its audience and your existing interaction with it.

## Optional preferences and safer-sex information

Where the preference editor is available, you can record whether a listed interest is Into, Curious, or Not For Me, a role preference, what you are looking for, and an optional description. Experience and approach descriptions appear separately as About me in the updated app. Interests retain Into, Curious and Not For Me choices. New preference maps start private. Turning on Show on profile makes that map and description visible to people allowed to view your profile. Only visible Into selections are used as shared interests for discovery and eligible message requests. Curious and Not For Me are not positive matches. A preference or profile entry is not consent.

The optional safer-sex section records preferences about discussing health before meeting, barrier protection, and testing conversations, plus a self-reported last-test date. It starts private and is stored separately from public profiles. You can explicitly share it with approved friends; current access and blocking rules still apply. It is not included in discovery filters, community cards, event summaries, notifications, or account emails. A date is not a test result, a verified health status, or a safety assurance. Huffr does not collect medical documents or diagnose users through this feature.

Profile preferences and safer-sex entries are stored in Huffr's Supabase database and are not end-to-end encrypted like direct messages. Authorized service operators can access stored records for service operation and support. The app keeps loaded entries in memory and does not save them in local drafts or iCloud. You can clear these optional fields, turn off sharing, or delete your account. Changing visibility cannot recall information someone has already seen or saved. Older app versions cannot edit the new preference map or erase it while saving other profile fields.

## Location and discovery

Your public profile location, private discovery area, and each community update's target area are separate settings. Huffr stores the labels and regions you choose, your search radius, and approximate coordinates when needed for city-based discovery. Stored coordinates are rounded to one decimal place. Other people see area labels or approximate distance ranges, not your private coordinates.

If you choose to use your device location, the app asks for location permission and uses Apple's location and map services to identify a city. Raw device coordinates are used transiently; Huffr does not store precise GPS coordinates in its database or continuously track your movements. You can use city search or a manual region instead. Turning off location permission does not erase an area you already saved; change it in Profile → Settings → Search area or delete your account.

Apple receives information needed to provide its location and map services under [Apple's privacy policy](https://www.apple.com/legal/privacy/). Avoid placing home addresses or other precise private locations in profile text, community updates, messages, or photos.

## Community updates, connections, and messages

Huffr stores community updates, responses to updates, friend requests, friendships, message requests, accepted connection records, blocks, and in-app notifications. These records enable discovery and determine who can contact whom.

A Huff is a nudge, not permission to message. When you send one, Huffr stores a private record containing your account identifier, the recipient's account identifier, a send identifier, and the sending time. The service uses these records to enforce the monthly allowance and 24-hour repeat limit, prevent duplicate sends on retry, and control the related notification. The recipient can see who sent the Huff in Activity; push alerts follow the Connections & Huffs setting and current access rules. The send records are not end-to-end encrypted and have no automatic expiration schedule. A monthly allowance reset does not delete them. Deleting the sender's account removes their send records; deleting only the recipient's account clears that recipient identifier while retaining the sender's record.

New direct messages, introductions, and message images in the updated app are encrypted on participants' devices before upload. Huffr stores encrypted content, public messaging keys, participants, timestamps, sizes, and read state. Private keys and recovery codes are not sent to Huffr. Administrators can access delivery metadata but cannot use database credentials to decrypt new content. Older unencrypted messages, if present, are labeled as such and can remain readable to privileged administrators. Older app versions must update to send messages.

Messaging keys are trusted on first use. Compare safety codes through another trusted channel to verify a person; approve an unexpected key change only after checking it. This version does not provide forward secrecy: a stolen private key or recovery code can expose retained history. Recipients can save or share what you send. Huffr cannot recover a lost recovery code.

Free accounts have 1 GB of sent and received message storage and a 25 MB image limit. Huffr Max removes the plan's total storage cap, while per-file and abuse limits remain. Removing a message for yourself removes your access and frees your allowance; it does not remove another participant's copy. Files with no remaining copies and cancelled/expired uploads are queued for server cleanup.

Closing a community update removes it from open discovery; it does not delete the stored update. Blocking restricts contact and access within Huffr. It cannot retrieve content already seen, copied, or saved by someone else.

## Regional rooms

Build 14 introduces two shared, general-purpose text chats per continental region (such as NA-East or NA-West), with rotating cosmic names and eligible state/province sub-chats beneath each. Your public profile region suggests the initial continental region, with your search region used if no profile region is available. Choosing another chat region does not change your public profile location or private discovery settings. Huffr stores room membership; the room list does not display exact location or claim you are physically present there. Older beta builds may still show the earlier state/province room directory.

Joining a room gives access to its current conversation. When you post, other eligible room members can see your display name, public badges, message and sending time. Your photo and full profile remain subject to their existing access controls. Your display name and room messages can be visible even when your profile is hidden from discovery. Rooms do not filter participants by your private gender or orientation preferences.

A state/province sub-chat is created when at least five distinct eligible accounts with that current public profile state have sent a message in the parent chat or one of its sub-chats during the last 72 hours. Opening or joining a room alone does not count. At reset, state sub-chats with at least five qualifying senders keep their room identity and membership but clear message history; below-threshold sub-chats and their memberships are removed. Visiting another continental region does not change the state associated with your profile.

The People list shows eligible message senders from that specific room during the last 72 hours. It is available only to joined members and follows blocking, account eligibility, and profile-access rules. It does not show individual last-seen times, private contacts, or exact locations. The service keeps body-free activity records linking a message identifier, room, sender and sending time for this rolling window. These records can remain after a scheduled history reset, so resetting the room does not erase the recent-participant list or all participation metadata immediately. Records older than 72 hours are eligible for cleanup.

Near Me and Active Now each show up to five active chats. Near Me orders eligible state chats using approximate distances between public state/province reference points, with continental conversations as a fallback. These estimates are not device GPS or any participant's exact location. Continental fallback rooms have no claimed state-level distance. Active Now prioritizes the selected continental group, filling sparse results from the same continent. Activity reflects eligible message senders in the last 24 hours, not current online presence.

Each chat can display up to three interest tags ranked by the number of distinct eligible participants who posted there during the last 24 hours and currently show that interest publicly. A single participant can contribute tags when a room is quiet. Each participant counts once per tag regardless of message volume. Tags can change as activity ages out or public interests change. Private interests, Curious and Not For Me selections, health information, orientation, direct messages and message text are excluded. Shared-tag highlights compare these public room tags with your own public interests. Blocked, suspended, deletion-pending and ineligible accounts do not contribute to your directory results. Lists can therefore differ between viewers. A tag describes recent public interests, not identity verification, consent, or a requirement to join.


Group-room messages are stored as readable text on Huffr's servers and are **not end-to-end encrypted**. They are separate from encrypted direct messages. Authorized service operators can access stored room messages for operation and moderation. This version supports text messages only in rooms. Other participants can copy or share messages they receive.

All rooms reset together every 72 hours at midnight UTC; the app shows the next reset in your local time. Ordinary message history clears, general chats receive new cosmic names, and state sub-chats are retained or removed using the five-sender rule above. This is a shared cycle, not 72 hours of message retention from sending time. Stable retained rooms keep membership, but pending messages from the previous cycle are rejected. A scheduled cleanup and checks on room requests enforce expiry; an expired conversation cannot be read or added to while cleanup is delayed. Restricted report evidence is separate from this reset. Previous cosmic names may be kept to avoid immediately repeating them.

Leaving a room removes your membership, not messages you previously posted before the next reset. Deleting your message removes its text from the room and excludes that send from activity and participant lists; its body-free removal marker may remain until the 72-hour cleanup; content already copied cannot be recalled. Blocking filters messages between the affected accounts. The app refreshes active rooms periodically, so changes may take a few seconds to appear.

Reporting a room message sends a copy of that selected message, its room, the involved account references, and your report details to the private moderation queue. Restricted report evidence is separate from ordinary chat history and survives a room reset or message removal. There is no automatic expiration schedule for this evidence, as described under Reports and abuse prevention. Account deletion clears related evidence text and removes references to the deleted account. The staff queue does not expose the reporter's identity to moderators. Rooms do not attach or disclose private direct messages to these reports. Provider-managed copies remain subject to the provider retention practices described below.

## Mentions and notifications

When mentions are available, typing @username can notify an eligible member of the same room or the other person in a direct conversation. Room messages store a snapshot of the mentioned username and account identifier so a later name change does not redirect an old mention. For encrypted direct messages, the mentioned recipient's identifier is delivery metadata outside the encrypted content; the message text and mention label remain encrypted. Mention suggestions and alerts follow chat access and blocking rules.

In-app Activity stores the alert, sender, destination, time and read state. Where push notifications are enabled, you can opt in on each device and separately control messages, mentions, requests and connections, and direct community activity in Settings. Huffr stores these preferences and the device's Apple push token linked to your account and sign-in session. Apple's notification service receives a generic alert for the relevant category and an opaque notification identifier, not the message text, username, interests or room location. Opening the alert retrieves its destination through your authenticated account. Signing out removes that device registration; account deletion removes related registrations and alerts. An alert already delivered to a device cannot be recalled.

Push delivery jobs expire within 24 hours, or earlier when the room expires, and stop after five attempts. Completed delivery records are removed after seven days. In-app room alerts are removed with their messages at reset; direct-message alerts follow message access and account deletion. Turning push alerts off does not remove in-app Activity.

## Photos

Huffr uploads images you select for your primary profile photo, gallery, or encrypted conversations. Older profile banners are still supported by the service. Message images are encrypted separately from profile media. The app resizes and re-encodes ordinary photos, removing their original image metadata. GIF attachments retain their animation; comments, non-animation application metadata, and trailing data are removed before encryption. Images are stored in a private Supabase Storage bucket, and access is checked against profile and blocking permissions.

Current builds fetch profile photos and galleries through authenticated requests, checking both the current sign-in session and photo permissions and avoiding a shared persistent image cache. New signed image links are disabled. Earlier builds requested temporary profile-image links valid for 60 seconds. Previously issued links can remain usable until their own expiry after a block or sign-out, and cached or downloaded images cannot be recalled. The app retrieves encrypted message images through authenticated requests.

Removing a saved gallery photo stops peer access to that photo immediately. Removed or canceled gallery uploads are retired and queued for file deletion; failed cleanup is retried. Unreferenced gallery uploads older than 24 hours are also eligible for cleanup. A private record of the retired image path is retained to prevent reuse of a removed file. Replaced primary photos and older banners may remain in private storage until account deletion.

Discover photo results require a primary photo and at least one additional gallery photo. Nearby can include profiles without photos when the usual discovery and privacy rules permit. Uploading photos is not identity verification or proof that an account is genuine.

## Community and events

Community preferences and discovery location select which updates you see. Event applications store the organizer-provided name, dates, venue or online location, description, public evidence link, safety information, status and review notes. Only the submitter and authorized reviewers can access application details before publication. Your event-interest selections are not shown to other users or organizers. Huffr stores them against your account to show your saved events; authorized service operators can access these records. Saving interest does not reserve admission, notify an organizer, or enable push reminders. Past or withdrawn listings stop appearing in saved-event results, but an interest record can remain until you remove it, the event is deleted, or your account is deleted.

Local Radar collects public organizer/venue information for a private review queue. Current collection is a pilot covering two Detroit venues. The collector runs in the cloud and does not publish events automatically. Some summaries were prepared with AI from public listing information and checked against that source; others use a source excerpt. AI-assisted summaries are labeled and reviewed before publication. Private profiles, health details, interests and messages are not used to generate them. A listing is informational and does not guarantee safety or endorsement. Opening an organizer link sends you to that website under its own privacy practices.

## Reports and abuse prevention

Reports store the selected reason, details you submit, relevant account/community-update references, status, and timestamps. Authorized moderators can review reports and restrict accounts. Private conversation contents are not automatically attached to a report; include only information needed to explain the concern.

The service also stores moderation actions, account suspension/deletion state, and per-account action counts in time windows to enforce limits on abusive activity. Older rate-limit windows are removed when that account performs the same action again. The beta does not assign these records a fixed expiration deadline for inactive accounts. Account deletion removes that account's rate-limit records.

Restricted staff tools can search account identifiers and display names across eligible profiles, including suspended accounts and profiles outside a staff member's discovery and connection settings. Search results include the account identifier, display name, public badges, moderation status, staff permissions, and revision numbers used to prevent conflicting edits. Search does not expose contact details, photos, location, private preferences, health information, or messages. Authorized staff can also review submitted report details. Reporter identities are not included in that review queue.

Only the private owner account can appoint or remove moderators and assign public badges. An Owner crown is a public label; receiving it does not grant staff access. Moderators can review reports and restrict ordinary accounts, but cannot appoint staff or change the private owner's access. Badge, staff-access, report-review, and suspension changes are recorded with the acting and affected account references, the change, its time, and a reason where required. These audit records have no automatic expiration schedule; account deletion removes references to the deleted account.

## Information kept on your device

Huffr keeps the active account's access and refresh tokens in the iOS Keychain. Community drafts, saved searches, and reusable templates are stored in account-specific files on your device. Unsent private message drafts and opened message images remain in memory. Messaging identity and historical private keys are held in device-only Keychain entries. Each recovery code restores one messaging identity. After a key reset, older messages still require their original key or recovery code on another device. These files use iOS file protection and are marked to be excluded from backups. Saved searches and templates are not synced to Huffr's backend. Applying a search or sharing a community update sends the resulting settings or update to the service.

Signing out clears the active session and in-memory account content, but keeps that account's saved drafts, library, and messaging keys for a later sign-in on the same device. After the server completes sign-out, the signed-out session cannot make new Huffr data, private-media, or account-management requests or renew its sign-in. Sign out on all devices applies this to every current session. It cannot erase content already received on another device; previously issued image links retain their own expiry, as described above. Membership expiration does not delete saved library items. You can delete saved searches and templates without an active membership. Light/dark appearance and app-icon preferences are device settings; saved profile themes and effects are stored on the server as described above.

## Offline beta simulator

Eligible beta builds include an optional offline interface simulator protected by installation verification and device-owner authentication. It uses authored fictional profiles, messages and events stored only in memory. The live app connection is retired before the simulator opens. Simulated actions are not sent to the database, to another user, or to payment services. Exiting clears the simulation and restores the saved online account through a fresh connection. It does not merge simulated content into that account. App termination also discards the simulation.

## Apple purchases

When available, optional membership uses Apple's in-app purchase system. Apple processes payment; Huffr does not receive payment card or bank details. StoreKit provides verified purchase and subscription status to the app. Huffr passes your account identifier to Apple as a purchase account token so the purchase can be associated with that account.

Huffr checks membership with StoreKit and verifies signed Apple transactions on the server to authorize membership benefits, including message storage and the Huffs allowance. The backend stores account-bound transaction and product identifiers, purchase/signature times, environment, expiry and revocation state, and verification-update information. These records are not end-to-end encrypted and have no automatic expiration schedule; deleting your Huffr account removes its membership records from the active database. Apple server notifications update this state when configured and received. Apple maintains its own purchase records. Deleting your Huffr account does not cancel a subscription or delete Apple's records. Manage subscriptions through the app's Huffr Max screen or Apple's subscription settings.

## Service providers and support

Supabase provides Huffr's account authentication, database, image storage, and account-management functions. Huffr's primary Supabase database region is Ohio, United States (`us-east-2`). Apple provides Apple sign-in, location/map features, StoreKit, and TestFlight distribution. For Apple-linked accounts, the backend retains an encrypted Apple authorization grant so account deletion can revoke Huffr's Apple authorization. Provider terms and privacy information are available from [Supabase](https://supabase.com/privacy) and [Apple](https://www.apple.com/legal/privacy/).

Providers process operational information such as request times, service errors, and authentication events to run and protect the service. Supabase's service logs can associate authentication and API activity with an account identifier. The database region does not mean every provider service or support operation processes information only in that location. [Supabase service logging](https://supabase.com/docs/guides/observability/logs).

If you email support, your email address and message are processed through the Google Workspace mailbox identified above under [Google's privacy policy](https://policies.google.com/privacy). Send only the information needed for your request. Do not send passwords, verification codes, full payment details, or unnecessary private conversation content.

The current app has no advertising integration or cross-app advertising tracking. Data described here is used to operate accounts and features, select discovery results, manage access, and address safety or support issues. No third-party analytics SDK is included in the app.

## Retention and account deletion

Account content and relationship records remain while your account exists unless a supported edit or removal changes them. The beta does not automatically delete inactive accounts. Report records and moderation records can remain after account deletion with report text cleared and references to the deleted account removed; remaining records can still refer to other involved accounts.

To delete your account, open **Profile → Settings → Delete account**, type **DELETE**, and confirm **Permanently delete account**. If profile setup is unfinished, use its **Delete account** option. Deletion revokes stored Apple authorization where applicable, removes account-owned profile images and encrypted attachments associated with your conversations, deletes the authentication account, and removes the associated profile, private discovery settings, optional preferences and safer-sex entries, saved profile theme/effect, membership records, sent-Huff records, community updates, relationships, conversations, messages, and notifications. Your recipient identifier is cleared from other people's retained Huff send records. The app then removes that account's local drafts, saved library, and messaging keys on the device performing deletion.

If deletion is interrupted after it starts, the account is restricted while you retry. The app displays an error instead of claiming completion. Contact support if you cannot finish deletion or access your account. If the app reports that local files could not be removed, delete the app from that device. Local drafts on other devices and copies saved by other people are not remotely erased by this process.

Deleting your account removes the account data described above from the active service. It does not erase another person's copies or Apple's purchase records. The beta currently uses Supabase's Free plan, which lists one-day retention for API and database logs. That period does not establish a maximum retention time for every provider security record or backup. [Supabase plan details](https://supabase.com/pricing).

Huffr has not enabled paid point-in-time recovery or a separate Huffr-managed database backup schedule. Supabase documents daily customer-accessible backups for its paid plans and recommends separate exports for free projects. The beta does not promise a recoverable backup of your account or message history. Provider-managed copies and security records, where retained, are subject to the provider's retention practices; deleting an app account does not establish immediate erasure of every such copy. [Supabase backup information](https://supabase.com/docs/guides/platform/backups).

The support mailbox has no automatic deletion schedule configured. Support correspondence can remain until it is manually removed. Huffr's moderation records likewise have no automatic expiration schedule. You can contact support to request deletion of information associated with you; deleting an app account does not automatically delete prior support emails.

## Choices and requests

You can edit your profile, change discovery and message-request settings, block users, change location permissions, delete saved library items, and delete your account. Your birth date cannot currently be edited in the app; email support to request a correction. Contact [support@huffr.app](mailto:support@huffr.app) for access, correction, deletion, or other privacy requests. Account ownership may need to be verified before a request can be completed; support does not need your Apple password or verification code.

Huffr is only for adults 18 and older. Report a suspected underage account using **Underage concern** in the app or the support address. Do not upload identity documents to a report.

Changes to this policy will be reflected in its published revision date.