Privacy policy

Pilot version, under legal review. Effective from 10 November 2026.

Who we are

ParkHugs is run by the ParkHugs team during a free pilot. The full company details (legal name, registered address and tax number) will be published here before the official launch. We are the controller of your personal data. You can reach us at privacy@parkhugs.gr about anything in this policy. We have not appointed a data protection officer; write to the same address for any data protection matter.

What ParkHugs does

ParkHugs helps drivers in Greece find parking, plan trips by car, on foot and by public transport, and hand over street parking spots to each other. This policy says what data that takes, why, who sees it and how long we keep it.

Decisions we have made

  • The pilot is free. Nothing in the app charges you, and we take no payment details.
  • Crash reports are off until you agree to them when you first open the app. You can change this at any time in Profile.
  • When you delete your account we delete or blank your data. The only thing we may keep is described under "When you delete your account".
  • People decide disputes. An assistant may suggest an outcome to our staff, but it never decides or acts on its own.
  • We do not sell your data and we do not use it for advertising.

What we collect

  • Account: your email, your first name, your password (stored only as a hash) and your language. Signing up does not ask for your age or a phone number.
  • Vehicles: the make, model, colour and length of each vehicle, its licence plate, and the position where you marked it as parked.
  • Parking activity: the spots you share (position, address, type, departure time), the alerts you set, and your exchanges, including an event log of each exchange.
  • Location during an exchange: while an exchange is live, your phone sends your position to the other driver, and to our database at intervals, so that we can tell when you are near the spot. We store the position and its accuracy as part of the exchange log.
  • Messages: the chat with the other driver in an exchange, including quick replies. The chat closes 60 minutes after the exchange ends.
  • Community: ratings and thanks you give, optional notes with a rating, and map notes and confirmations you add.
  • Strikes and disputes: strikes on your account, your report or statement about a disputed exchange, any contest you file against a strike, and staff decisions with their reasons.
  • Trips: when you finish a followed trip we store only its type and the money and CO2 savings shown on your savings screen. We do not store the places or the route.
  • Planner requests: when you ask for a route, your start and destination are sent to our server and to our own route planner to compute it. We do not save them as a trip history. For statistics we count searches by map area and hour of the week (see "How long we keep it").
  • Device: a push token for notifications, your platform (Android or iOS), and, only if you agreed, crash reports with technical details about the app and your device. Crash reports carry no account id.
  • Location outside exchanges: with your permission the app uses your position to centre the map, find parking near you and follow a trip. It is not stored by us for these purposes.
  • Staff records: when our staff act on your account (for example a block, a strike removal or a plate lookup) we keep a log with the action, who did it and the reason.

How location works

  • The app asks for location only while you use it. While you follow a trip you started, the app keeps using your location when the screen is off: on Android with a visible notification, on iOS with the system location indicator. The app does not ask for "always" location.
  • During an exchange the other driver sees your live approach to the spot. Other drivers see a shared spot only at a blurred position. The driver who reserved it gets the exact position and address once the exchange is live.
  • You can refuse or withdraw location permission in your phone settings. Without it you can still browse the map, but you cannot confirm that you are at a spot.

Who sees your licence plate

  • The other driver sees the make, colour and model of your vehicle during a live exchange. Within a set distance of the spot they see your plate with its last three characters hidden. Once you are both at the spot they see the full plate.
  • Our administrators can look up a plate when they need to, for example to deal with a dispute. Each lookup is logged with a reason.
  • Nobody else sees your plate.

Why we use your data and on what basis

  • To run the service you asked for: your account, spots, exchanges, chat, directions and notifications (contract, Article 6(1)(b) GDPR).
  • To use your position to find spots and confirm that you are at the spot (contract, and your consent when your phone asks for location permission, Article 6(1)(a)).
  • To keep the community fair: strikes, blocks, ratings, reports and disputes, and to stop a blocked person registering again (legitimate interest, Article 6(1)(f): safe and reliable exchanges for everyone).
  • To keep the service secure, to prevent abuse and to fix faults (legitimate interest, Article 6(1)(f)).
  • To collect crash reports (your consent, Article 6(1)(a), which you can withdraw in Profile).
  • To produce anonymous parking demand figures (legitimate interest, Article 6(1)(f)). Searches are counted by map area and hour, with a weekly token that cannot be traced back to you and is deleted each week.
  • To meet legal obligations, including answering requests from authorities (Article 6(1)(c)).

Disputes are decided by people

If an exchange goes wrong, either driver can report it and staff decide, normally within 48 hours. A decision can add a strike or remove one. An assistant (called Von) can read the details of a disputed exchange (the order and timing of events, distances from the spot, the report and chat text, but not names, emails or plates) and suggest who was at fault. Our staff see the suggestion but decide themselves. Nothing happens to you because of the suggestion alone.

Who receives your data

We do not sell your data. These providers process it for us or receive it from your phone:

  • Supabase hosts our database, sign-in, chat and server functions. Our data is hosted within the European Union.
  • Google Firebase delivers push notifications. If you agreed, it also receives crash reports.
  • Map tile servers (OpenFreeMap and OpenStreetMap) receive the map areas your phone loads, with your IP address.
  • The Photon address search (komoot) receives the text you type into address search, with your IP address.
  • Our own route planner, run by us, receives the start and destination of a route you ask for. It uses public timetable data from transit operators. Operators receive no data about you.
  • If you open a route in Google Maps, Apple Maps or Waze, that app receives the destination and applies its own policy.
  • The other driver in an exchange sees what the exchange needs: your first name, the vehicle details above, your reliability counts (on time, late, cancelled and completed) and your approach to the spot.
  • Our staff, who use a backoffice that requires two-factor sign-in.
  • Authorities, where the law requires it.

Transfers outside the EU

Google (Firebase) and the map and address providers may process data outside the European Economic Area, including in the United States. Where they do, they rely on safeguards such as the EU-US Data Privacy Framework or standard contractual clauses.

How long we keep it

  • Chat messages, exchange positions, answered assistant suggestions and sent notifications are deleted or cleared 30 days after they were created. A disputed exchange is kept as evidence until the dispute no longer needs it.
  • After 12 months we remove emails and free text (notes, chat text and reasons) from staff logs and from exchange history, and clear positions. We keep identifiers and counts for statistics.
  • With the current settings a strike lasts 60 days and a block lasts 7 days.
  • Map notes are deleted 30 days after they expire. Your link to a note, its text and its confirmations are removed after 90 days.
  • Parking demand figures are deleted after 400 days. Weekly tokens are deleted each week.
  • A push token is removed when you sign out on that device or delete your account.
  • Records of staff actions are kept as long as they are needed for accountability, within the 12 month rule above.

When you delete your account

  • In Profile you can delete your account at any time, except during an active exchange. Your account, profile, vehicles and plates, strikes, trips, alerts and push tokens are deleted. Text you wrote in chats and rating notes is blanked, and the positions you sent in exchanges are cleared. Spots that no exchange refers to are deleted, and the address is removed from the others. The other driver's history keeps the exchange, but it no longer points to you.
  • One exception. If at that moment you had an active block or strikes in force, we keep a keyed hash of your email (not the email itself) together with the block or strike details. We keep it only as long as they are in force, at most the strike period of 60 days or the block period of 7 days, and then delete it automatically. If the same address registers again in that time, the block or strikes return. This protects other drivers. Our basis is legitimate interest (Article 6(1)(f)).

Your rights

  • You can ask for access to your data, correction, deletion, restriction and a copy you can move (portability).
  • In Profile you can export your data, and delete your account. For anything else, or if you cannot use the app, write to privacy@parkhugs.gr. We answer within one month.
  • You can object to processing based on legitimate interest. You can withdraw consent (crash reports, location) at any time without affecting what happened before.
  • If you think we mishandled your data, you can complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), www.dpa.gr.

Storage on your phone

The app does not use cookies. It stores on your device your sign-in session, your language and theme, your crash report choice and similar settings. These are needed for the app to work or to remember your choices. We do not use advertising or tracking identifiers.

Age

You must be at least 18 years old to use ParkHugs. Taking part in exchanges needs a driving licence. The app does not ask your age when you sign up.

Security

Data is sent over encrypted connections. Passwords are hashed. Access to the database follows strict per-user rules. Staff sign-in needs two factors and staff actions are logged.

Changes

If this policy changes in a way that matters, we will tell you in the app before the change applies.