Privacy Policy

---

a) Account & Profile

• Email (for account and security)
• Username
• Password (securely hashed via Supabase)
• Avatar (optional)
• Language preference
   

b) Optional Personal Information

• Birth date (to calculate age bracket)
• Gender (optional)
• City of birth / residence
• Hobbies & interests
   

c) Location Data (with consent)

• GPS coordinates (when enabled) to show nearby experiences, unlock quests, and generate location-aware summaries
• Visited locations (check-ins)
• City-level location for recommendations when GPS is off
• Important: You can disable GPS entirely and still receive city-based recommendations. Only coordinates, not addresses, are stored.

d) Gamification & Behaviour

• XP points, levels, badges, quest progress
• Trip items added and scheduling preferences
• Feature usage (screens viewed, searches made)
   

e) Technical Data

• Device type, operating system, app version
• Crash logs and performance metrics
• IP address (for security and approximate geolocation)
  

Core App Functions

• Account management, authentication, experience discovery, trip planning, and progress tracking.

AI-Powered Personalisation

• We send only minimal context (rounded coordinates, age bracket, interests, language) to AI providers.
  We never share your name or email.
  Providers are configured so your data is not used for model training; logs may be retained briefly for abuse detection.

Communication & Support

• Essential service emails, optional tips and reminders (opt-in), and customer support

• We do not sell your data.
• We share limited information with trusted providers that enable core functionality
• You can disable analytics anytime in Settings → Privacy.

• Active accounts: kept while you use HicX 
• After deletion: all personal data removed within 30 days
• Crash logs: retained for up to 90 days 
• Analytics (anonymized): retained for up to 13 months
• Server logs (security): retained for up to 30 days
• Legal obligations may require longer retention in specific cases

Location Controls

• GPS tracking can be toggled off at any time.
• City-based recommendations still work without GPS.
• You can clear your check-in history from your profile.
   

Analytics Opt-Out

• Disable analytics in Settings → Privacy at any time.

GDPR / Swiss Data Rights

• You may request access, correction, deletion, portability, or withdraw consent (e.g. GPS or marketing).
• EU/EEA/UK users may contact their local data authority. Swiss users may contact the FDPIC.

We protect your data with end-to-end encryption, secure authentication (Supabase), role-based access, continuous monitoring, and data minimisation.
If a security incident occurs, we will notify you and the authorities where required.

Minimum age depends on your country (typically 13 – 16 years).
We do not knowingly collect data from children below the applicable minimum without parental consent.

Your data may be processed outside Switzerland or the EU.
All providers use Standard Contractual Clauses and equivalent protections to ensure compliance with GDPR and Swiss law.

We may update this policy to reflect new features or laws.
Major changes will be announced via in-app notification or email.
The latest version is always available in Settings → Privacy Policy.

For questions or to exercise your rights, contact:

• Email: legal@hic.studio
• Address: Via Carlo Maderno 23, 6900 Lugano, Switzerland

• Consent: location, marketing, optional features
• Contract: core app services you request
• Legitimate interests: app improvement, security, analytics 
• Legal obligation: compliance with Swiss and EU data protection laws

• Location (optional)
• Notifications (optional)
• Photos (for avatar, optional)