Effective date: September 9, 2026
Operator: Xenyyo Inc. ("OnlyHugs", "we", "us"), a Delaware corporation — hello@onlyhugs.help
This policy explains what we collect, why, who we share it with, and what you can do about it. It's short because we collect little.
1. What we collect
If you contribute (Helper)
- Your email address, which Stripe collects on the payment page and shares with us so we can send your receipt.
- Your payment details go to Stripe only. We never see or store card numbers.
- The contribution itself: story, amount, hug tiers, date.
- If you're logged in, the contribution is linked to your account.
If you have an account
- Email address; password (stored hashed by our authentication provider, Supabase — we never see it); or your Google account's email and basic profile if you sign in with Google.
- Your Hugger alias.
- Login activity (dates, and a hashed IP address used only for rate limiting).
If you post a Hug Story (Hugger)
- Everything in the story: the Huggee's name, situation, story text, urgency, and photo. This is public. Anyone with the link can see it, and it appears in link previews when shared.
- Stripe Connect onboarding details (identity, bank account) go to Stripe only. Stripe tells us whether your account is verified and enabled for payouts; we store that status and your Stripe account ID, nothing else.
- Your delivery counter (self-reported).
About Huggees
Huggers provide the Huggee's name, situation, and photo. We require Huggers to have the Huggee's consent. If you're featured in a story and want it removed, email us and we'll remove it promptly.
Automatically
- Standard server logs (IP address, browser, pages requested) kept by our hosting provider for a limited time for security and debugging.
- Error reports (with emails and photo URLs removed) sent to our error-monitoring provider.
- Cookies: only the ones needed to keep you logged in. No advertising or tracking cookies, no ads.
2. How we use it
- To run the Service: show stories, process contributions, pay Huggers, send transactional emails (receipt, story funded, payout notices, login and password emails).
- To keep the Service safe: photo screening at upload, rate limiting, abuse reports, fraud and dispute handling.
- To comply with law, including payment and tax rules.
- We don't sell personal information and we don't use it for advertising.
3. Who we share it with
Only providers that help us run the Service, each bound to use the data only for that purpose:
- Stripe — payments, payouts, identity verification for Huggers.
- Supabase — database and authentication.
- Vercel — hosting and photo storage.
- Resend — sending emails.
- Anthropic — automated screening of uploaded photos for prohibited content. The photo is sent for classification and is not stored by them.
- Google — if you sign in with Google.
- Sentry — error monitoring.
We may also disclose information when required by law, to enforce our Terms, or to protect anyone's safety.
4. Public content
Hug Stories, including photos, are public by design. Contributions are not public: a story shows how many hugs were funded, never who funded them or their email. Hugger aliases are public.
5. Retention
- Account and story data: for as long as your account exists, then deleted within 30 days of deletion, except what we must keep for payment, tax, or legal reasons.
- Contribution and payout records: as long as required by payment and tax rules (typically 7 years).
- Held funds owed to unverified Huggers: see the Terms; we retain the records needed to pay or report them.
- Logs and error reports: 90 days.
6. Your choices and rights
- Access, correction, deletion: email hello@onlyhugs.help. We'll verify it's you and respond within 30 days. Deleting your account removes your stories and photos from the Service.
- Featured without consent: email us; we remove the story.
- Emails: we only send transactional emails. There is no marketing list to unsubscribe from.
- California residents: you have the right to know what we collect, to delete it, and not to be discriminated against for exercising those rights. We don't sell or share personal information for cross-context advertising.
- Outside the US: the Service is operated from the United States and your data is processed here.
7. Children
The Service is for adults. We don't knowingly collect information from anyone under 18, and stories about or photos of anyone under 18 are not allowed. If you believe a minor appears on the Service, email us and we'll remove it.
8. Security
Data is encrypted in transit. Passwords are hashed. Payment data never touches our servers. No system is perfectly secure; if a breach affects you, we'll notify you as the law requires.
9. Changes
We'll post updates here with a new effective date and, for material changes, notify account holders by email.
10. Contact
Questions, requests, or privacy concerns:
Xenyyo Inc.
131 Continental Dr, Suite 305
Newark, DE 19713
United States
hello@onlyhugs.help