Privacy policy

Who is responsible

Obskur BV runs hitchhopp and is responsible for your data (the data controller).

Questions about your data? Email bram@obskur.studio.

What we store about you

When you use hitchhopp, we store:

• Your name, email address and password. Your password is stored in a form that cannot be read back.
• Your language, and whether you are a parent, grandparent or other adult in your household.
• Your household's cars: a name if you give one, the number of places, and who usually drives which car.
• Your groups and their activities: name, place, day and time, and any note added to a date.
• Which runs you drive, and turns you hand over or take on.
• Your email notification choices, and school holidays you add.
• The email address of anyone you invite to your household.
• Messages you send us with the feedback form.

We do not ask for your phone number or your home address.

What we store about children

Children do not have an account. An adult in the child's household adds their details, as the person looking after them.

• Their first name, and their birth year if you choose to give it.
• Which activities and dates they take part in.
• Which car they ride in, and who drives it.
• When they are not coming, and a reason if you type one.

We do not ask for a child's surname, home address, photo or health information. Please do not type medical details into any note.

Who can see what

• Other adults in your household, including a grandparent, see your household's children, cars, groups and runs.
• Other families in the same group see your name, the first names of your children who take part, the group's dates and runs, who drives which car and how many places it has, which children ride in it, and when a child is not coming.
• If a group accepts your household's school holidays, the group's members see them.
• Only the child's own household can see the reason for an absence and the child's birth year.
• Other families do not see your email address.
• Obskur BV can access the data to run hitchhopp and to help you when you ask for support.

Nobody can add you to their household. You join a household yourself, with its code or an invite sent to you.

When you join another household, children only move when a parent decides. A parent who leaves while another parent stays chooses which children come along; the others stay. The last parent to leave takes all the children. Grandparents and other adults never take children with them, unless they are the last adult in the household, so that no child is ever left without an adult.

Why we use it

We use this data only to run the carpool: to show the schedule, arrange who drives, and email you about runs.

The legal basis is the agreement you make with us when you create an account (GDPR Article 6(1)(b)). Children's details are needed to arrange their lifts for you.

You need a name, an email address and a password to use hitchhopp. Without them we cannot provide the service.

What we never do

• We show no advertising.
• We do not sell your data or share it for marketing.
• We do not build profiles of you or your children, and we make no automated decisions about you with legal or similar effects.
• We use no analytics or tracking tools.

Companies that process data for us

These companies handle data on our behalf, under a data processing agreement:

• Supabase: our database and login. The database is in Frankfurt, Germany.
• Vercel: hosts the website.
• Resend: sends our emails, including sign-in and password emails. Resend stores the content of emails in the United States.

Our emails about runs contain children's first names, activity names, pickup and drop-off times, and who drives.

Supabase, Vercel and Resend are companies based in the United States. When data is handled outside the EU, it is protected by the European Commission's standard contractual clauses or, for Resend, the EU-US Data Privacy Framework.

Our hosting and database providers keep technical logs, such as IP addresses, to keep the service working and secure. This is our legitimate interest (GDPR Article 6(1)(f)).

How long we keep it

• Dates, runs, absences, sent notifications and feedback are deleted automatically 12 months after they happen.
• Your account details are kept until you delete your account.
• A child's details are kept until an adult in the household removes the child, or the household is deleted.

Deleting your account

You can delete your account at any time: in the app under Me, or on the delete account page. It happens immediately.

• Upcoming runs you were driving go back to the group, and within a few minutes members who get driver alerts are told by email. The adults of any child who loses their seat in your car are told too, whatever their email settings, whether the run still has another car or now has none.
• Runs you drove in the past are deleted.
• A group you own passes to another member. A group with no other members is deleted.
• Household invitations sent to your email address are deleted, including ones you accepted. Invitations you sent that are still pending are cancelled.
• If you are the last adult in your household, the household and its children are deleted too.
• If you are the last parent, the other adults in your household, such as a grandparent, lose their account too. The children and the household are deleted. We tell those adults by email.
• Otherwise the children and the household stay with the other adults.

Cannot sign in? Email bram@obskur.studio and we will help.

Your rights

You have the right to:

• see the data we hold about you (access)
• have it corrected (rectification)
• have it deleted (erasure)
• limit how we use it (restriction)
• object to how we use it (objection)
• receive it in a format you can take elsewhere (portability)

To use any of these rights, email bram@obskur.studio.

You can also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données) at dataprotectionauthority.be.

Cookies

hitchhopp only uses cookies it needs to work: cookies that keep you signed in, and one that remembers your language.

We use no advertising or tracking cookies.

Changes and translations

If we change this policy, we update the date at the top of this page.

This policy is available in several languages. If a translation differs from the English version, the English version applies.