Privacy, plainly.

Effective 2 August 2026 · Applies to the Huso iOS app and huso.app

Huso schedules Instagram posts. To do that we need a small amount of your data, listed below — nothing more. We don't sell data, we don't run ads, and we don't use your content to train anything.

Who we are

Huso is made by GDP Works Ltd, a company registered in Scotland (SC845336), City Point 3rd Floor, 65 Haymarket Terrace, Edinburgh, EH12 5HD, United Kingdom. GDP Works Ltd is the data controller. For anything in this policy: hello@huso.app.

What we collect, and why

Your account

Email address and name — to sign you in, and to route notifications and team invites. Lawful basis: contract.

Instagram connection

Your Instagram handle and an access token — to publish what you approve, and to show engagement counts on published posts. Tokens are stored server-side, encrypted, and deleted the moment you disconnect an account. Lawful basis: contract.

Your content

Photos, captions, drafts, and your posting schedule — the product itself. Photos you import stay private to your team until Instagram publishes them. Lawful basis: contract.

Team activity

Who added, edited, and approved each post — shown to your teammates so the queue is accountable. Lawful basis: legitimate interest (team transparency).

Notifications

Your device's push token and your notification preferences — to tell you when a post publishes, fails, or needs approval. Lawful basis: contract; preferences are yours to switch off per channel.

That's the whole list. No analytics profiles, no advertising identifiers, no location data, no contacts.

AI captions

When you ask Huso to write a caption, the photo and your house-style notes are sent to Anthropic's Claude API to generate it, then discarded from the request. Anthropic does not train models on this data. Caption generation only runs when you tap it — never automatically.

Where your data lives

Data is stored with Supabase in the European Union (database, authentication, and photo storage). Our API runs on Vercel. Emails are sent from huso.app via our email provider; push notifications go through Apple's notification service. Instagram publishing goes through Meta's API — what you post is then governed by Meta's privacy policy. Each provider processes data only on our instructions, under data processing agreements; transfers outside the UK/EU are covered by standard contractual clauses.

How long we keep it

Until you delete it. Deleting a photo or post removes it immediately. Disconnecting an Instagram account deletes its token immediately. Deleting your Huso account erases your data at once, with encrypted backups purged within 30 days. Team activity history is kept for 30 days, then dropped. Posts already published stay on Instagram — that part is yours to manage there.

Your rights

Wherever you are, we honour the UK and EU GDPR rights: access, correction, erasure, portability, restriction, and objection. Email hello@huso.app and we'll answer within 30 days. Account deletion doesn't need an email — it's in Settings. If you're unhappy with how we handle your data you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

Age

Huso requires you to be at least 13, matching Instagram's own minimum. Where local law sets a higher age for consenting to data processing (up to 16 in parts of the EU), that higher age applies.

Changes

If this policy changes in any way that matters, we'll tell you in the app before it takes effect — not after.