← Back to Hiccup

Privacy Policy

This Privacy Policy explains what information the Hiccup Android app ("the App"), published by Trishunya Infotech ("we", "us"), handles, how it is used, and the choices you have. Hiccup lets two people who miss each other send tiny, warm gestures: a character, a feeling, an emoji or a few words.

1. Account and identity

You sign in with your Google account or with an email sign-in link (Firebase Authentication), so that your person can find you with an invite code. We receive the email address of the account and the display name you choose. We do not ask for a phone number, and throwaway email services are not accepted. The sign-in link is sent by Firebase on our behalf, from an address on Firebase's own domain, under the name Hiccup.

2. Information the App handles

• Your display name, your sign-in account identifier and the invite code that lets another person ask to pair with you. A pairing exists only between the two people who accepted it, and each of the two can see the other's display name.
• Technical marks of a pairing on our server: the time of your last hiccup and a count for the day (to keep to one hiccup every 5 seconds and the daily limit), and which hiccups your phone has received and read (so the sender can see ticks, only if you keep "Read ticks" on).
• Hiccups you send and receive: the chosen character look (a feeling), an optional emoji, optional short words (up to 60 characters), whether it is marked secret, the look items worn by the sender, and the time. A hiccup passes through our server (Google Firebase, Cloud Firestore, in Mumbai, India) so that it can reach the other person's phone. Only the two people in the pairing can read it. When a hiccup arrives, our server sends the other person's phone a small push message (Firebase Cloud Messaging) that carries only a technical pairing id, never the hiccup itself. The phone then fetches the hiccup and shows a quiet notification. The notification is made on your phone: it can show the sender's name and a small picture of the hiccup, and it can appear on the lock screen. In Settings you choose whether the lock screen shows the words, only a neutral line, or nothing, and you can switch on Private notifications to hide names and pictures everywhere.
• Your phone's push token (Firebase Cloud Messaging), saved with your account so that your phone can be woken for new hiccups (up to five phones per person). It is removed when you sign out or delete your account.
• Your progress: your XP and level, your sending and opening days and the milestones you reached, and the XP and milestones of each pairing. They are worked out on our server (Google Firebase) from your activity, so they stay with your account when you change phones. A pairing's XP and records are deleted when the pairing ends, and your own are deleted when you delete your account.
• The e-mail addresses of a pairing: for each pairing we keep, on our server only, the sign-in e-mail addresses of the two people. They are never shown to the other person and are deleted when the pairing ends.
• Membership links: if you open a Gold membership link, or install the App from one, the App reads the code in that link (when you install from Google Play, it is carried in Google Play's install referrer, which holds only that code) and uses it once to add your membership. Nothing else is read from the referrer and it is not stored on our server.
• Usage events, described in section 4.

3. Information stored only on your device

Your hiccup history, the names you give your people, your character choices, streaks, tree and garden progress, widgets and settings are kept on your phone. Typed words are checked on your phone against unsafe content before they are sent; they are not read by us. Hidden surprises such as the shake, the held heartbeat and the covered-phone hug use your phone's motion and proximity sensors, read on your phone only while Hiccup is open on its main screen, to notice the gesture; the readings are never stored or sent anywhere (only the resulting hiccup is sent, like any other). Uninstalling the App, or clearing its storage in Android Settings, deletes this data from your device.

4. Analytics

We use Google Analytics for Firebase to see, in aggregate, which parts of the App are used and how often, and whether a person is an invite-code member, so that we can fix problems and decide what to improve. Events contain only fixed names and small numbers, never the words of a hiccup, names or contact details. In the EU/EEA, the United Kingdom and Switzerland (and wherever the region cannot be told) the App asks for your choice before anything is collected, and you can change it at any time in Settings under "Anonymous usage statistics". A "no" is always respected.

4.1 Install measurement (Meta SDK)

The App includes the Meta (Facebook) SDK for Android. It reports that the App was installed and opened, the app version, device and OS information, and your device's Android Advertising ID (if you have not reset or opted out of it) to Meta. We use this only to measure which of our advertising campaigns lead to installs of Hiccup. The App does not use Facebook login, and the Meta SDK never receives your messages, names or the people you are paired with. We also use the Google Play Install Referrer API, read by the Meta SDK, to learn which ad or link an install came from. Where the law requires your consent (see section 4), the SDK starts only after you allow it. Data received by Meta is processed under Meta's Privacy Policy.

5. Advertising

The App shows ads through Google AdMob to keep the App free, including a rewarded ad that unlocks more hiccups. AdMob may collect device and advertising identifiers (such as your Android Advertising ID), approximate location derived from your IP address, and ad engagement data, to serve and measure ads. This is governed by Google's Privacy Policy. You can limit ad personalisation in Android Settings → Google → Ads, and reset or delete your advertising ID there.

Where the law requires your consent before this data is collected (for example in the EU/EEA, the United Kingdom or Switzerland), the App asks for it first, and you can change your choice later in the App.

6. Permissions the App requests, and why

Permission	Purpose
Internet	Signing in, delivering hiccups to your person, ads and anonymous analytics.
Notifications	Telling you that a hiccup arrived (with the sender's name and a small picture, on the lock screen too if you allow it), the optional streak reminder, and an occasional gentle reminder after a day without opening the App (created on your phone; you can switch it off in Settings).
Vibrate	Gentle haptic feedback when you touch a character, and the vibration patterns of special hiccups (you can switch them off in Settings, Special vibrations).
Wake lock and push messages (Google Play services)	Waking your phone for a moment when a push message says a hiccup arrived, so that the widget and notification update even when the App is closed.
Receive boot completed	Restoring the optional streak reminder after the phone restarts.
Network state	Checking that a connection exists before ads and delivery are tried.
Advertising ID	Serving and measuring ads (section 5) and measuring installs from our own ad campaigns (section 4.1).

The App does not request access to your contacts, location, photos, microphone, camera, SMS or call log.

7. Third-party service providers

We share limited technical data with the following providers only to operate the App:

• Google Firebase - sign-in, delivering hiccups, and analytics.
• Google AdMob - advertising.
• Meta (Facebook) - app install and app open events, device and app information, and the Android Advertising ID, used for install attribution of our advertising.

These providers may process data outside your country of residence, under their own privacy policies. We do not sell your personal information.

8. Data retention and deletion

A hiccup stays on our server for up to 30 days, or until either of you removes the pairing, and is then deleted. Your history on your phone is yours to delete at any time from within the App. To delete your account, open Settings → Delete my account and data in the App: your profile, invite code, pairings, push token, XP and progress, and the private pairing e-mail addresses are removed from our server and your sign-in account is deleted. Hiccups already received on another person's phone stay on that phone. If you cannot open the App, see how to request deletion. Analytics and advertising data held by Google follows Google's own retention policies.

9. Children's privacy

The App is not directed at children under 13 and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will address it.

10. Security

Data sent between the App and our service providers is encrypted in transit. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

11. Changes to this policy

We may update this Privacy Policy from time to time, including at release and whenever features or third-party services are added. Material changes will be reflected by updating the "Last updated" date above.

12. Contact us

Questions about this policy or your data can be sent to infotech.trishunya+hiccup@gmail.com.