Flott Privacy Policy

Last updated: 5 August 2026

This policy covers the Flott app only. The shop privacy policy covers huks.studio.

1. Who is responsible

The data controller is:

Ernesto Piovesan (trading as Huks)
Kaiserstrasse 105/01/21
1070 Wien, Austria
Email: hello@huks.studio

No Data Protection Officer is required or appointed. For privacy questions or to exercise your rights, contact hello@huks.studio.

2. What Flott is

Flott is a surfskate teaching app. Riders book classes with independent teachers and keep a record of their progress through six levels. Teachers create classes and confirm when a rider moves up.

Anyone can create a rider account. Teaching is different: choosing Teacher submits an application, and the account stays pending until it is approved. Anyone can browse the public class schedule without an account; booking requires one.

Flott does not process payments. You pay your teacher directly, in person.

3. What I collect and why

3.1 Your account

  • Data: email address, password (hashed, never visible to me), username

  • Purpose: let you sign in and identify you to other members

  • Legal basis: performance of contract (Art. 6(1)(b) GDPR)

  • Shared with: Supabase (hosting and authentication, Ireland)

3.2 Your profile

  • Data: name, city, bio, the board you ride, the year you started, chosen character, goals, profile photo. All optional except your name

  • Purpose: show you to teachers and other members

  • Legal basis: performance of contract

  • Shared with: Supabase

3.3 Your riding record

  • Data: classes you booked, attendance, skills you tick off and when, milestones you log, the level your teacher confirmed

  • Purpose: this is the app. It is the record you came for

  • Legal basis: performance of contract

  • Shared with: Supabase. Visible to teachers whose classes you booked

3.4 Your friendship book

  • Data: pages people wrote in your book and pages you wrote in theirs. A page holds where that person is from, where you met, and what they wrote about the moment

  • Purpose: the social record the app is built around

  • Legal basis: consent (Art. 6(1)(a)). Nothing is stored until the person asked agrees to write it. Either of you can delete a page at any time

  • Shared with: Supabase. A page is visible only to the book's owner and its author

3.5 Teaching records, if you are a teacher

  • Data: classes you create, who booked them, private notes you write about a class, riders you have taught

  • Purpose: run your classes and keep your own teaching record

  • Legal basis: performance of contract

  • Shared with: Supabase

3.6 Community and safety

  • Data: teachers and communities you follow, reports you file, people you block, and an invite code your account is given. If you joined while Flott was invite only, also who invited you and any request you sent to join

  • Purpose: run the community and act on reports

  • Legal basis: legitimate interest (Art. 6(1)(f)) in keeping members safe

  • Shared with: Supabase

3.7 Notifications

  • Data: device token, your notification settings

  • Purpose: tell you about bookings, class changes and your progress

  • Legal basis: consent. iOS asks before any notification is sent, and you can switch each type off in Settings

  • Shared with: Apple Push Notification service

3.8 Crash reports and usage

  • Data: crash reports, and which screens are opened

  • Purpose: find bugs and understand which parts of the app are used

  • Legal basis: legitimate interest in a working app

  • Shared with: Sentry (Germany), PostHog (EU)

These carry your account number only. Not your email, not your name, not your diary, and no screenshot of the app. Neither service records your screen.

4. What I do not collect

No payment details, because payment happens in person. No location tracking. No contacts. No advertising identifiers. No cookies in the app. Nothing is sold to anyone, ever, and no data is used for advertising.

5. Who can see what

  • Anyone not signed in: teacher names and the public class schedule. No profiles

  • Other members: your name, username, city, bio, board, riding-since, character and level

  • Your teacher: the above, plus your ticks, milestones and level

  • Only you: your email address and your personal invite code

  • You and the author only: each page in your friendship book

6. Where your data is stored

All of it in the European Union.

  • Accounts, profiles, classes and progress: Supabase, in Ireland

  • Crash reports: Sentry, in Germany

  • Usage events: PostHog, in the European Union

Push notifications pass through Apple, which may involve transfer to the United States. That transfer relies on the EU-US Data Privacy Framework and Standard Contractual Clauses (Art. 46 GDPR). You can request a copy of the safeguards by emailing hello@huks.studio.

7. How long I keep it

  • Account, profile, progress and friendship book: while your account exists. Deleting your account deletes them, immediately and permanently

  • Reports you filed about others: kept without your name attached, because they may concern someone else's safety

  • Crash reports and usage events: as retained by Sentry and PostHog

Flott holds no invoices and no order data, so the 7-year tax retention that applies to the shop does not apply here.

8. Automated decision-making

None. Reports are reviewed by a person. Your level is set by a teacher, never by an algorithm.

9. Your rights under GDPR

  • Access and portability: Settings, Download My Data, gives you everything I hold about you as a file

  • Correction: edit your profile at any time

  • Deletion: Settings, Delete Account. Immediate and cannot be undone

  • Restriction, objection, withdrawal of consent: email hello@huks.studio

You do not have to email anyone to see or delete your data. Both are buttons in the app. For anything else I respond within 30 days.

10. Right to complain

Datenschutzbehörde (DSB)
Barichgasse 40-42, 1030 Wien
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at

If you live in another EU country you can also complain to your local supervisory authority.

11. Age

Flott is for people aged 16 and over. I do not knowingly collect data from anyone younger. If you believe a child has an account, email hello@huks.studio and I will remove it.

12. Changes

If this policy changes in a way that affects you, I will say so in the app before it takes effect. The date at the top shows the current version.

13. Related pages