HustleLeague

Privacy Policy

As of: 6 October 2026

Deutsche Fassung

This is an English courtesy translation of the German-language original. In the event of any discrepancy or ambiguity, the German version shall prevail.

Section 1 – Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

HustleLeague is operated as a partnership under German civil law (Gesellschaft bürgerlichen Rechts – GbR) by:

Denis Gritzmann
Thomas-Mann-Straße 11
48485 Neuenkirchen, Germany

Alexej Gorbatschew
Bogenstraße 23
48432 Rheine, Germany

Email: hustleleague.studio@gmail.com

Section 2 – General Information on Data Processing

We generally only process our users' personal data to the extent necessary to provide a functioning app as well as our content and services. The legal bases are, in particular, Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (performance of a contract), and Art. 6(1)(f) GDPR (legitimate interest).

We provide these legal texts via Firebase Hosting (Google Ireland Limited). When you access them, Google processes the technically necessary data (IP address, time, page requested, browser identifier) in order to deliver the pages and protect them against misuse. We do not set cookies. The legal basis is Art. 6(1)(f) GDPR.

Section 3 – Registration and User Account

You may try HustleLeague without registering first. Any tasks you create in the process are stored solely locally on your device and are transmitted to us only once you create a user account. A user account is required for continued use and to preserve your progress.

For registration and sign-in via email address and password we use Firebase Authentication (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We additionally process your username (visible to all signed-in users), an optional profile picture, and your selected language and registration date. The legal basis is Art. 6(1)(b) GDPR (performance of the user contract).

Your email address is stored exclusively in Firebase Authentication, not in our database (Firestore) – this is a deliberate data-minimization measure.

To ensure each username is only assigned once, we create a reservation record for your username (in lower case) containing your user ID. It cannot be viewed by any user. If you change your username, the old reservation is released; if you delete your account, it is deleted. The legal basis is Art. 6(1)(b) GDPR.

When registering, you confirm that you are at least 16 years old and accept the Terms and Conditions; existing users do so once after the terms change. As proof we store the version of the accepted terms, the age confirmation and the time. This record can only be accessed by you and serves to demonstrate that and when you accepted the terms and confirmed your age. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (proof of consent) and Art. 6(1)(f) GDPR (proof of the minimum age, see Section 18). The record is kept as long as your user account exists and is deleted together with it.

Section 4 – Content You Enter Yourself

As part of using the App, you enter the following content yourself, which we store in the Firebase Firestore database (Google Ireland Limited):

The legal basis is Art. 6(1)(b) GDPR.

Section 5 – Automatically Generated Data

When you use the App we also automatically generate the following data:

The legal basis is Art. 6(1)(b) GDPR.

Section 6 – Profile Pictures and Media

If you upload a profile picture, the App accesses your device's photo library/gallery with your permission; it does not access the camera. Images are stored via Firebase Cloud Storage (Google Ireland Limited). The same applies to group pictures uploaded by a group's admin. The legal basis is Art. 6(1)(b) GDPR. You grant access to your photo library via your device's permission prompt and can revoke it there at any time.

Section 7 – Community Features

HustleLeague offers community features such as groups, chat messages, private messages, friendships and a referral system. Chat messages and group posts are visible to the other members of the relevant group.

The following can be retrieved from your profile by all signed-in users: username, profile picture, rank and experience points, trophies, your friends list, the list of users you have blocked, your group membership, the time of your last activity (“last online”), and the times at which you last read your chats, including the identifier of each chat.

Within a group, the other members see your daily progress as numbers (done/total and your daily completion rate for the past 14 days) and your weekly progress in points.

You can challenge friends to a duel. For the duration of a duel, both participants see the other's username, their weekly points and daily completion rate in the duel week, and for comparison their average completion rate and number of perfect weeks. Names of tasks or goals are not shared.

Your daily tasks and weekly goals are shared within a group only to the extent you have authorised (see Sections 8 and 19).

A public leaderboard is planned but is not yet active at the time this Privacy Policy is published; it will follow after the App's launch. We will update this Policy once it is activated.

Friendships are formed through a friend request, which the other person can accept or decline. For an open request we store the user IDs of the sender and the recipient, the sender's username and the time; it is visible only to these two people. The request is deleted as soon as it is accepted, declined or withdrawn, or if either person blocks the other. If the recipient declines, the sender is not informed. So that the same person cannot immediately ask again, after a decline we store a record of both user IDs and the expiry time for 14 days (cooling-off period). Likewise, we record for 24 hours that a notification was sent for a request, in order to limit repeated notifications. These records cannot be viewed by any user and are deleted automatically once they expire. The legal basis is Art. 6(1)(b) GDPR; for the cooling-off period and the limit on notifications, Art. 6(1)(f) GDPR (legitimate interest in protection against harassment).

When you reach a new highest rank, your friends receive a message in their inbox with your username and the rank you reached (without a push notification). The message is not sent to people you have blocked or who have blocked you. Your friends can delete it at any time; if you delete your user account, these messages are also deleted from your friends' inboxes. The legal basis is Art. 6(1)(b) GDPR.

You can block other users; blocked users can no longer interact with you. The legal basis is Art. 6(1)(b) GDPR.

You can pre-register for a community that has not launched yet. We then store your user ID in the participant list of that community so that we can limit the number of places and include you at launch. The App only shows the number of pre-registrations. You can withdraw your pre-registration in the App at any time; your user ID is then removed from the list. If you delete your user account, your pre-registration is removed as well. The legal basis is Art. 6(1)(b) GDPR.

You can report chat messages, other users and groups (e.g. because of their name or picture). When you do, we store your user ID, what was reported (message, user or group) together with its identifier, the user ID of the person responsible (for messages the author, for users the reported person, for groups the person who manages the group), the reason you selected (e.g. harassment, hate speech, spam or name/picture), an optional free text from you (up to 300 characters) and the time; for messages also a copy of the reported text and the type of chat, for groups the group name at the time of the report. Reports can only be viewed via our internal admin panel and are used for moderation; the reported person is not told who reported them. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a safe community) and, where applicable, Art. 6(1)(c) GDPR in conjunction with Art. 16 of the Digital Services Act.

If you delete your user account, your own messages in group chats are deleted in full (see Section 15); they are no longer available to other users.

We handle reports of content or users in accordance with Articles 16 and 17 of Regulation (EU) 2022/2065 (Digital Services Act). For each report we store our decision, the reason, the time and which administrator decided. The reporting person receives a confirmation of receipt and our decision, and the affected person receives a statement of reasons – each as a message in their in-app inbox, and in the case of an account suspension additionally by email to the account address. For a suspension we also store a suspension record with the reason as well as the previous username and profile picture so that they can be restored when the suspension is lifted; the record is deleted together with the user account. The legal basis is Art. 6(1)(c) GDPR in conjunction with Articles 16 and 17 of Regulation (EU) 2022/2065.

Section 8 – Special Categories of Personal Data (Art. 9 GDPR)

The daily tasks and weekly goals you enter freely may allow conclusions to be drawn about your health, diet or addictive behaviour (e.g., “No sugar today”, “No alcohol”, “Take medication”) and may therefore constitute special categories of personal data within the meaning of Art. 9 GDPR. The App itself suggests such wordings (e.g., “30 min workout”, “No sugar today”) as example tasks on first launch.

This becomes relevant as soon as such content is made visible to other users, for example within a group. For disclosure to other users we obtain your explicit consent pursuant to Art. 9(2)(a) GDPR. This consent is not pre-selected: as long as you have not made a choice, no task or goal names are transmitted. You grant the authorisation individually per person and may withdraw it at any time.

Section 9 – Push Notifications

To send reminders and notifications we use Firebase Cloud Messaging and the Expo push notification service (650 Industries, Inc., 2261 Market Street #5210, San Francisco, CA 94114, USA). A device-specific push token is processed for this purpose. Expo and Google also process the content of each notification, i.e. for chat messages the sender's username and the message text. You can disable notifications at any time in your device or App settings. The legal basis is Art. 6(1)(a) GDPR.

Section 10 – Error Reports

If a technical error occurs within the App, we automatically store an error report containing the error message, technical stack trace, context information, your user ID, the app version, the platform (Android/iOS), the operating system version, and the time of occurrence. These reports are accessible exclusively through our internal admin panel and are limited to 50 reports per session. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in error analysis and app stability). We delete error reports no later than 90 days after they are created; this is carried out automatically by a daily deletion job.

Section 10a – Contact Form

You can send us a message using the contact form on our website (hustleleague.app/contact). In doing so, we process your email address, the selected topic, your message and – if you provide it – your name, as well as the time of receipt. We use this data solely to handle and answer your request; we are notified of new requests by push notification on our own devices.

The legal basis is Art. 6(1)(b) GDPR insofar as your request relates to the use of the App or to a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering requests and in handling notices of illegal content).

To prevent abuse (spam), we do not store your IP address in plain text, only as a non-reversible check value created with a secret key. This check value is deleted automatically within 48 hours of your last message. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security and availability of the form).

Messages are stored in our Firestore database (EU) and can only be viewed via our internal admin panel. We delete them automatically 12 months after receipt unless a statutory retention obligation applies. Providing an email address is required so that we can reply; the form cannot be sent without it.

Section 11 – Payment Processing

The purchase of Coins and the Hustle+ subscription is handled via Google Play Billing or Apple In-App Purchase and the payment service provider RevenueCat. These purchase features are not yet active at the time this Privacy Policy is published and will follow after the App's launch; we will update this Policy once they are activated. We only receive information about the purchase itself (e.g., product, time, status), not full payment or credit card details. The processing of data by Google, Apple or RevenueCat as part of the payment process is governed by their own privacy policies.

Section 12 – Recipients and Processors

We use the following service providers, with whom data processing agreements pursuant to Art. 28 GDPR are in place where required:

Section 13 – Transfers to Third Countries

Our Firestore database is hosted in the EU region “eur3” (European multi-region). For the data stored there, no transfer to a third country generally takes place.

For individual processing steps, processing outside the EU/EEA may nevertheless occur, in particular when push tokens are transmitted to our service provider Expo (650 Industries, Inc., USA) and within the globally provided infrastructure and support functions of our other service providers. In these cases we rely on the EU Standard Contractual Clauses or, where applicable, an adequacy decision of the EU Commission (e.g., the EU-US Data Privacy Framework).

Section 14 – Retention Periods

We store daily statistics for a period of 30 days. We delete error reports no later than 90 days after creation (see Section 10). We delete messages from the contact form 12 months after receipt, and the check value of the IP address within 48 hours of the last message (see Section 10a). We delete cooling-off records after declined friend requests after 14 days, and records used to limit notifications after 24 hours (see Section 7); the same applies to the records we use to limit notifications about group invitations and join requests to one per sender, recipient and day. For all other data referred to in this Policy (e.g., daily tasks, weekly goals, chat messages, Coins, rank, streak), there is no automatic deletion period; it is stored until you delete your user account or a statutory retention obligation requires otherwise. We keep reports and feedback for as long as they are needed for moderation and for developing the App; when an account is deleted, they lose any link to the person (see Section 15).

Section 15 – Account Deletion

You can delete your user account at any time yourself via the App settings. A server function deletes the following completely and without any manual intervention on our part:

Reports you have made or that concern you, as well as your feedback, are kept to document moderation but lose any link to you: your user ID and username are removed, and for reports against you the copied text is deleted.

Section 16 – Your Rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection to processing (Art. 21 GDPR). You may withdraw consent you have given at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority (see Section 17).

Section 17 – Competent Supervisory Authority

You have the right to complain to a data protection supervisory authority about our processing of your personal data. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
www.ldi.nrw.de

Section 18 – Minimum Age

HustleLeague is intended for persons aged 16 and over. Persons under 16 may not use the App without the consent of their legal guardians. We are aware that we may not knowingly process personal data of children under 16 without such consent.

Section 19 – Data Security

We implement technical and organisational measures to protect your data against loss, misuse and unauthorised access. Data is transmitted in encrypted form (TLS/SSL).

Access to your content is limited to what is necessary: your daily tasks, weekly goals and statistics history are retrievable by you alone; other users only see the figures listed in Section 7. Within a group, the other members see only your numerical progress by default. The names of your tasks and goals are transmitted only to those members you have explicitly and individually authorised beforehand; if you withdraw an authorisation, the data concerned is deleted rather than merely hidden.

Section 20 – Changes to this Privacy Policy

We will adapt this Privacy Policy as soon as changes to the App or the legal situation make this necessary. The version currently published in the App or on our website shall apply.