Privacy policy
1. Controller
The controller is the provider of the app:
hppy GmbH
Pauluseck 10
66564 Ottweiler
2. What data we collect
We only collect the data needed to run the app:
- Phone number — For registration and authentication via SMS (Firebase Authentication).
- First and last name — As the display name in your profile, visible to friends.
- Profile picture — Optional. Stored in Firebase Storage.
- Events and messages — Content created by users (titles, descriptions, chat messages). Stored in Firebase Firestore.
- Friends list — Connections to other users, stored in Firestore.
- Linked accounts — Optional. Your usernames on Instagram, TikTok, Steam or Twitch, if you add them to your profile.
- Tickets and raffles — Only if you buy tickets or enter a raffle. Details in section 7.
- Device push token — For push notifications (Firebase Cloud Messaging).
- Calendar data — Only if calendar export is turned on. The data is written locally on the device and not transmitted to any server.
3. Data we do NOT collect
- No location tracking
- No advertising IDs
- No access to contacts/address book
- No third-party analytics tools in the app. On the website hppy.events only if you agree (see section 8)
- No sharing with advertising partners
4. Legal basis
Processing is based on Art. 6(1)(b) GDPR (performance of a contract — the app only works with the data listed above; this includes buying tickets and entering a raffle), Art. 6(1)(a) GDPR (consent — e.g. for push notifications, camera access, passing your profile on to the prize giver of a raffle and the statistics on the website, there together with § 25(1) TDDDG) and Art. 6(1)(c) GDPR (statutory retention of orders and receipts) and Art. 6(1)(f) GDPR (legitimate interest — for “Problem melden” on the website, see point 9).
5. Hosting and data processing
We use the following services from Google LLC:
- Firebase Authentication — SMS verification and user management
- Firebase Firestore — Data storage (server location: europe-west3, Frankfurt)
- Firebase Storage — Image storage (profile pictures) and prize files from raffles
- Firebase Cloud Messaging — Push notifications
- Firebase Hosting — Website and landing pages
- Google Analytics for Firebase — only on the website and only with your consent (see section 8)
Google processes data in accordance with the Firebase privacy information and the Google Cloud Data Processing Terms. The server location is Frankfurt (europe-west3).
E-mails about tickets and raffles (confirmations, cancellations, winning and not-winning e-mails) are sent from the mailbox tickets@hppy.events through the mail server of our host bw-media.
6. Data sharing
Your data is not sold to third parties or shared for advertising purposes. It is only shared:
- With other hppy users as part of the app's features (e.g. your profile name for friends, chat messages to event participants)
- With Google/Firebase as the technical infrastructure provider (see section 5)
- With Google for the website's statistics — only if you agree there (see section 8)
- With our e-mail host bw-media to send ticket and raffle e-mails (see section 5)
- With the payment provider Stripe when you pay for a ticket (see section 7)
- With the prize giver of a raffle — only with your explicit consent when you enter (see section 7)
7. Tickets and raffles
Buying tickets. When you buy tickets in the app or on the web, we process your name and e-mail address, your billing address and company if you add them, the tickets you bought, the amount and the date of the order. Friends you hand tickets to or transfer them to see them together with your name as the sender. On the web you can buy without a hppy account; we then send the tickets to the e-mail address you give us.
Payment. Paid tickets are processed by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). You enter your card or account details directly with Stripe; we only receive and store the type, brand, last four digits and expiry date, so you can recognise saved payment methods. Stripe processes payment data under the Stripe privacy policy.
Organizers. The organizer of an event you buy tickets for receives no personal data about you from us — only sales figures and, for cancellations, the receipt number of your order.
Raffles. Raffles are run by the provider of the app; details are in the conditions of entry, which the app shows before every entry. When you enter, we store your entry, your name, your e-mail address and when you gave your consent. So that the prize giver (the event organizer who provides the prizes) can pick the winners and check the conditions of entry, we pass on to them — only with your explicit consent when you enter — your hppy profile (name, profile photo, username, linked Instagram, TikTok, Steam and Twitch accounts) and the e-mail address you entered with. Your phone number is not passed on. The prize giver may use this data only for the raffle and for handing over the prize. You can withdraw your consent at any time with effect for the future by e-mail to hello@hppy.events; before the winners are picked, this also takes your entry out of the raffle. If you win, your prize (text, image or PDF) appears in your account and in an e-mail to you.
If you enter on the web without a hppy account, we store your name and e-mail address; your entry only goes to the prize giver once you link it to your hppy account.
8. Website statistics (Google Analytics)
The app uses no analytics tools. On the website hppy.events we use Google Analytics 4 (via Firebase), but only if you choose “Zustimmen” (Agree) in the banner. Without your consent nothing is loaded from Google and no analytics cookies are set.
Purpose. We want to understand which pages are used and how, and where visitors come from, so we can improve the website.
Provider. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
What data. Pages viewed, the page you came from, time and length of the visit, device type, browser, operating system, screen size and an approximate location (country, region, city) that Google derives from your IP address. Google Analytics 4 does not store the IP address itself. So that returning visits can be recognised, Google sets the cookies _ga and _ga_<ID> with a random identifier. They expire after up to two years.
No advertising tracking. Google Signals, advertising features and personalised ads are switched off. We do not link the statistics to your hppy account.
Transfer to the USA. Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, so this transfer is covered by an adequacy decision of the EU Commission (Art. 45 GDPR). More in Google's privacy policy.
Retention. Google deletes the event data after 2 months.
Legal basis and withdrawal. Your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time with effect for the future: at the bottom of every page of the website under “Cookie-Einstellungen” (cookie settings) → “Ablehnen” (Decline). We then delete the analytics cookies in your browser. We store your choice in your browser's local storage. This is technically necessary so we don't ask again on every page (§ 25(2) no. 2 TDDDG).
9. “Problem melden” (report a problem) on the website
On the event and location pages of the website you can report a mistake without an account, e.g. a wrong start time or a location that has closed.
What data. Your text, the page the report is about, the time and your browser's identifier (user agent). The report is not linked to any account. Please do not put personal data into the text.
Protection against abuse. So that the form cannot be flooded with spam, we limit how often reports can be sent. For this we compute a value from your IP address and the date with a secret key (HMAC) that changes every day. We do not store the IP address itself, and the values of different days cannot be linked to each other. Against these values we count reports per hour and per day. Before sending, your browser also solves a short computing task; nothing about you is stored in the process.
Retention. We delete the counters after two days. We keep the report itself for as long as we need it to maintain the event data.
Legal basis. Art. 6(1)(f) GDPR. Our legitimate interest is correct event data and a report form that cannot be shut down by abuse. You can object to this processing (see point 11).
10. Retention period
Your data is stored for as long as your account is active. When you delete your account, your profile data is deleted immediately, backups after 30 days at the latest. What you shared with others — events, chat messages and photos — stays for them, but appears under “Gelöschter Nutzer” (Deleted user). Details are under Delete your account.
Your payment profile (billing name, address, company and saved payment methods) is deleted with your account. We keep orders, receipts and tickets, as well as raffle entries and the consents given with them, for as long as statutory retention obligations (in particular under commercial and tax law) require — up to ten years, even if you delete your account.
11. Your rights (GDPR)
You have the right to:
- Access — Find out what data we have stored about you
- Rectification — Have incorrect data corrected
- Erasure — Have your account and all data deleted
- Data portability — Receive your data in a machine-readable format
- Objection — Object to the processing
- Withdrawal — Withdraw a consent (e.g. to passing your profile on to a raffle's prize giver or to the website statistics) with effect for the future
- Complaint — Lodge a complaint with the competent data protection authority
Contact for privacy requests: privacy@hppy.events