Hugna Privacy Policy
Version: 1.0
Date: 3 November 2026
1. Who is responsible?
Hugna AS (company registration number 938 361 452), Trelastgata 21, Oslo, Norway, is the data controller for personal data processed through Hugna. Contact hei@hugna.no or visit hugna.no/kontakt.
Hugna is a social platform for people aged 18 and over who want to find others to enjoy activities with and meet in real life. Hugna is not a dating service.
2. What personal data do we process?
- Account and identity: name, email address, full date of birth, gender, account identifier, login and account status, recorded legal acknowledgements and chosen settings. Passwords are handled by the authentication provider and are not stored as readable text in Hugna user profiles.
- Profile: photograph, personal description, interests, languages, availability and location information you provide.
- Activities and meetings: activity type, place/city/area, optional date and time, description, expressions of interest, invitations, participation and individual meeting confirmations.
- Conversations: message content, sender and recipient, conversation membership, timestamps and deletion/visibility status.
- Safety and support: blocks, reports, the particular reported message or other relevant content, moderation notes and support requests.
- Technical use: session and security information, language and theme, service events and acquisition source, including QR-code referrals.
Please do not include unnecessary sensitive information about yourself or others. Information voluntarily shared in profiles, activities or messages may sometimes include special-category personal data. Accepting our Terms is not treated as blanket consent for additional processing of this information.
3. Purposes and legal grounds
| Purpose | Legal basis |
|---|---|
| Creating and operating accounts, profiles, activities, invitations and messages | GDPR Article 6(1)(b): necessary for the service contract |
| Preventing misuse, handling reports, restricting unwanted contact and protecting the platform | Article 6(1)(f): our legitimate interest in providing a safe and reliable service, subject to a balancing assessment |
| Responding to questions and support requests | Article 6(1)(b) for service-related requests; otherwise Article 6(1)(f) for necessary follow-up |
| First-party analytics to understand feature use and activity demand | Article 6(1)(f), where processing of identifiable data is necessary and a balancing assessment supports it |
| Complying with legal duties | Article 6(1)(c) |
| Optional features for which the law requires consent | Article 6(1)(a): separate, freely given consent |
We may use genuinely anonymous aggregate statistics about activity interest and mutually confirmed meetings that do not identify individuals. Publishing an activity never automatically counts as a completed meeting.
4. Who can see your information?
Profile details you share may be visible to other users. Activity information may also appear on public pages. Visibility depends on the applicable display and access rules. Your email address, password and full date of birth are not displayed in public profiles.
Within the service, messages are displayed to participants in the conversation. Hugna messaging is not end-to-end encrypted. Authorized server processes retain technical access necessary for operating the service. Hugna does not routinely read private chats. Security incidents, lawful requests and specifically reported content may nevertheless require limited processing.
Blocking a user restricts future contact and participation according to the blocking features. It does not automatically erase past messages.
5. Messaging, reporting and deletion
Ordinary chats are stored so participants can continue conversations and view their history. They have no general automatic expiry date. Removing a conversation from your own inbox hides it from your view but does not automatically remove the other participant's copy. When an individual message is deleted, it may appear as a deleted-message marker; its content is removed from the active message database when that deletion function has completed.
If you report a message, that particular reported content may be copied into a report. The entire chat is not automatically disclosed. Reports are handled by authorized personnel. Relevant evidence may remain after an account has been deleted when necessary and legally justified.
When an account is permanently deleted, the profile and identifying account references are deleted or anonymized. Remaining conversation participants may continue to view their history where there is a lawful basis for retaining it. The deleted profile must no longer be accessible. Personal information about the deleted user appearing within past message text is assessed separately when an erasure request is made. Conversations with no remaining participants may be removed.
You may also deactivate your account temporarily. Deactivation reduces visibility and new interactions while retaining information necessary to reactivate your account following a fresh login and confirmation. Permanent deletion is a separate choice.
6. Retention periods
Hugna applies the following retention rules, subject to exceptions where longer retention is necessary for legal obligations, an ongoing case or legal claims:
| Information | Retention |
|---|---|
| Account and profile | While the account exists, unless deletion or another lawful basis requires otherwise |
| Ordinary messages | No automatic time limit; retained for participants' conversation history, subject to erasure rights and deletion functions |
| Closed moderation reports and relevant evidence | Normally up to 12 months after the case is closed, with documented exceptions for ongoing cases or legal needs |
| Identifiable first-party analytics events | Normally no more than 90 days before deletion or anonymization, unless a separately documented need applies |
| Security logs controlled by Hugna | Normally no more than 90 days, with documented exceptions |
| Support correspondence | Normally up to 12 months after the request is resolved, subject to lawful exceptions |
| Truly anonymous aggregate statistics | May be retained for long-term analysis |
Retention in providers' logs and backups is also subject to their documented expiry and recovery processes. Deletion from live systems does not mean that a historical backup can be edited immediately. Erasures must be re-applied if a backup is restored. Contact us for further information on the applicable retention arrangements.
7. Service providers, data locations and transfers outside the EEA
We use the following services to operate Hugna:
- Supabase: authentication, database and storage. Hugna's primary Supabase project is hosted in Ireland (eu-west-1). Support, operations and some subprocessors may process data elsewhere.
- Contabo / EasyPanel: application hosting and deployment administration.
- Resend: delivery of registration, notification and form-related emails. Resend states that email content and delivery logs are processed and stored in the United States, even when the sending region is in Europe.
- Cloudflare Turnstile: protection of forms and login against automated abuse.
- Microsoft 365 / Outlook: receipt and management of enquiries sent to Hugna.
Appropriate data-processing agreements are required where providers process personal data on our behalf. Transfers outside the EEA must rely on a valid Chapter V GDPR transfer mechanism. Resend states that its data-processing agreement includes EU Standard Contractual Clauses for transfers to the United States. You may contact us for details of applicable safeguards and how to obtain them.
When you book or pay for an offer directly with a Hugna Fordel partner, that partner will normally be an independent controller of information submitted through its booking system.
8. Cookies and local storage
Hugna uses Supabase authentication cookies, cookies for selected language and theme (up to one year), temporary password-recovery information (approximately 15 minutes), and local storage recording dismissal of the PWA installation prompt (approximately seven days). QR referral source may be recorded in a user's profile after registration. The reviewed application does not include a third-party advertising or analytics pixel.
Strictly necessary storage is used to provide features you request. Where a technology does not qualify for a legal exemption, we obtain valid consent before using it. You may change or withdraw optional consent through the available consent mechanism.
9. Minimum age
Hugna is for people aged 18 or older. On registration you provide your full date of birth and confirm that you are at least 18. The pilot does not use BankID or another independent identity verification method.
10. Your rights
Subject to applicable law, you may request access, correction, erasure, restriction and data portability, and object to processing based on legitimate interests. Where consent is used, you may withdraw it without affecting earlier lawful processing.
Email hei@hugna.no. We respond within the deadlines set by data-protection law. You can complain to the Norwegian Data Protection Authority, Datatilsynet, at datatilsynet.no.
11. Changes
We will provide appropriate information about material changes. The current Privacy Policy is available at hugna.no/personvern.