Privacy

Hunch is a social betting app for friend groups. No real money, no public feed, no ad networks. We collect the minimum we need to make the app work — your email, display name, optional avatar, and the bets you make. We don't sell your data, ever.

Hunch is a personal project operated by Hans De Loore, based in Belgium. For anything privacy-related — questions, requests, complaints — email hans@deloore.biz. Under EU GDPR, Hans is the data controller.

• Account basics: email address, display name, and (if you upload one) profile picture. If you sign in with Google, we also pull your name and avatar from Google to pre-fill those fields.
• Bet activity: bets you create, sides you pick, ticket counts, who's in which group, outcomes, disputes, and the resulting points balances.
• Optional: a push-notification subscription if you opt in; a Splitwise OAuth token if you connect that integration; an outcome-proof picture you choose to attach.
• Technical: standard server logs (IP address, user-agent, request paths) for a short retention window to debug issues and prevent abuse.

To provide the app you signed up for: authenticate you, show your groups and bets, settle outcomes, and (if you opt in) ping you when something happens. The legal basis is contract (Article 6(1)(b) GDPR) for the core service, and your consent (Article 6(1)(a)) for push notifications and the Splitwise integration.

We use a handful of third-party services to run Hunch. Each receives only what they need for their slice of the job:

• Supabase — database, authentication, and file storage. Servers in Frankfurt (EU).
• Vercel — application hosting and serverless execution. US-based; data transfers covered by the EU Standard Contractual Clauses.
• Resend — sends magic-link emails and settlement summaries. Receives recipient email and message contents.
• Anthropic — parses free-text bet descriptions into structured fields when you use that feature. The bet text you type is sent; nothing else. US-based.
• Splitwise — only if you connect it. When a bet settles, expense data goes to Splitwise on your behalf using the token you authorized.
• Google— only if you use “Continue with Google”. Google receives that you signed in to Hunch; we receive your verified email, name, and avatar.
• Web push providers — Apple, Google, Mozilla, Microsoft. Only if you opt in to notifications; they receive the push payload to deliver to your device.

We don't sell your data, share it with advertisers, or use it to train AI models.

Account data lives until you delete your account or ask us to delete it. Bet history is kept indefinitely so leaderboards and group history remain coherent. If you delete your account, your bets are anonymized (your name is replaced with “Deleted user”) so the rest of the group's history isn't broken.

Technical logs are kept for at most 30 days unless we're investigating an incident.

Under GDPR you can ask us to:

• Confirm what data we hold about you (access).
• Correct anything that's wrong (rectification).
• Delete your account and the data tied to it (erasure).
• Export your data in a portable format (portability).
• Restrict or object to specific processing — for example, opt out of push notifications or disconnect Splitwise.

Email hans@deloore.biz with any of the above and we'll respond within 30 days. You also have the right to lodge a complaint with the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be).

We use one essential cookie: the Supabase session token that keeps you signed in. It's strictly necessary for the app to work and doesn't require a banner. We don't use analytics, ad-tracking, or third-party cookies.

Hunch isn't intended for anyone under 16. If you believe a child has signed up, email us and we'll delete the account.

If we change anything material, we'll update the “Last updated” date above and — if you have an account — flag it in-app or by email before the change takes effect.