Effective date: 25 October 2026 (updated on 29 October 2026: analytics on the founder portal, investors.hugeone.io and deck.hugeone.io, sections 3 and 5)

This policy explains cookies and similar technologies for hugeone.io, the founder portal at founders.hugeone.io, the investor website at investors.hugeone.io, HugeOne’s investor presentation at deck.hugeone.io and free HugeOne app features made available to you. App specific information applies when you use the app. Read this policy together with our Privacy Policy.

1 Who operates the services

A.M.K. Ecoleaf Ltd, trading as HugeOne, operates these services. Our Cyprus registration number is HE272640 and our address is 11 Mnasiadou Street, 1065, Nicosia, Cyprus. Contact info@hugeone.io or +357 99918184 with questions about this policy or your privacy choices. For help with the app or the founder portal, email support@hugeone.io.

2 Cookies and similar technologies

Cookies are small records stored by your browser. Local storage holds information in your browser and can remain after you close it. Session storage lasts for a browser-tab session. Apps can also store sign-in information, cached content and diagnostic records on your device.

Strictly necessary storage supports a service you request, such as signing in or accepting an administrator invitation. Optional analytics, advertising and similar tracking require prior consent where applicable. A technology is not automatically necessary because it is useful or because it is called something other than a cookie.

3 Website and portal storage

Cookie choice. hugeone.io, the founder portal, investors.hugeone.io and deck.hugeone.io each ask for your answer in their own cookie notice and store it in first party local storage named hugeoneCookieConsent on their own address, so that they do not ask again and know whether analytics may load there. You can change your answer at any time with Cookie settings at the bottom of each site. Section 5 describes the analytics.

Authentication session storage. The founder portal and investors.hugeone.io use first party local storage on their own addresses to retain the Supabase authentication session. It contains authentication tokens and session related account information so you can remain signed in and renew your session. The storage name is generated for the authentication project. This storage is for sign in, not advertising.

Browser local storage has no built-in expiry and can remain between visits until removed by the service or cleared by you. Signing out removes the local authentication session through the sign-out process. Clearing the portal’s site data also removes the local copy. Authentication-token expiry is separate from how long a storage entry remains in your browser.

Administrator invitation cookie. The first-party cookie named hugeone_admin_setup temporarily connects an administrator invitation to the sign-in and acceptance process. Its maximum lifetime is 15 minutes. It is used for invited administrators, not ordinary visitor analytics, and can be removed earlier by the invitation process.

Organisation registration note. When you start registering an organisation, the founder portal stores a first party local storage entry named hugeone.intent on founders.hugeone.io. It contains only the word “organisation”, so that after you create your account and sign in, the portal takes you to the organisation registration you asked for. It is removed once your organisation account exists; otherwise it remains until you clear the portal’s site data. It is not used for analytics or advertising, and it is strictly necessary for the sign up you asked for.

Security cookie. The founder portal, investors.hugeone.io and deck.hugeone.io are delivered through Cloudflare’s network, which sets a first party cookie named __cf_bm to tell people apart from automated traffic and protect the services. It expires after 30 minutes, is not used for analytics or advertising, and is strictly necessary for security.

Investor presentation. HugeOne’s investor presentation at deck.hugeone.io, which we send to investors by personal link, stores only your cookie choice on your device and sets no cookies of its own unless you accept analytics (section 5). While the page is open, it tells HugeOne that the link is being viewed, how long and how far, as described in our Privacy Policy, and the presentation says so; this does not use cookies and does not depend on your cookie choice.

Waitlist form. The waitlist form on hugeone.io sends the email address you enter to our website host. It does not set cookies or store anything on your device.

4 App storage and diagnostics

App sign in session. The app uses Supabase technology to maintain your sign in session. It keeps the session, which contains authentication tokens and related account information, in the app’s own storage on your phone so you can remain signed in and renew your session. Signing out removes it. Media libraries can also store cached images and videos, and temporary copies of photos and videos you choose to upload, to deliver app features. Some local information can remain between sessions. Device settings may allow you to clear app data or remove the app; doing so does not by itself delete your account or data held on our servers. To delete an app account, use Profile, Personal details, Close account in the app. Founder accounts are closed on request at support@hugeone.io.

App passcode and Face ID. If you set an app passcode, the app stores it only on your phone as a salted one way hash, in the phone’s secure storage (the Keychain on iPhone and the Keystore on Android), together with your choice whether to unlock the app with Face ID or another biometric method your phone offers. This is strictly necessary security storage for a lock you choose to set up. It never leaves the phone, and we do not receive your passcode or biometric data. It remains after an ordinary sign out, so the same passcode works when you sign in again, and it is removed when you sign out from the passcode screen, after too many wrong attempts or when you close your account.

Notification token and prompt. If you allow notifications, Firebase Cloud Messaging stores a notification token on your phone so that notifications can be delivered to it; our copy of the token is described in our Privacy Policy. The app also records on your phone that it has already shown the “Stay in the loop” notification prompt, so that it does not ask again. You can turn notifications off in the app’s settings or in your phone’s settings.

The app uses Firebase Crashlytics to receive error reports and investigate crashes. These reports can include device and app information, diagnostic identifiers and error details. Reports may be held on the device pending transmission. Our Privacy Policy explains the purposes and retention criteria for diagnostic information. Where this technology requires consent to store or access information on your device, we ask before the relevant collection.

5 Optional technologies and your choices

Analytics on our websites. On hugeone.io, the founder portal, investors.hugeone.io and deck.hugeone.io, we use Google Analytics, loaded through Google Tag Manager on hugeone.io, to understand how visitors use these sites. It loads on a site only after you choose Accept in that site’s cookie notice. Google Analytics then sets cookies named _ga and _ga followed by an identifier, which last up to two years. Because these sites share the hugeone.io address, the same cookies can be used on all of them. On the founder portal, investors.hugeone.io and deck.hugeone.io it measures page views only: it receives no names, email addresses or account identifiers, codes in page addresses, such as those in personal presentation links, are removed before anything is sent, and the administrator area is never measured. If you choose Reject, or later change your answer to Reject under Cookie settings, analytics does not load on your later visits; on hugeone.io cookies already set remain until they expire or you clear them, while the founder portal, investors.hugeone.io and deck.hugeone.io delete them at once, also for hugeone.io. Google processes this information under its own terms, and our Privacy Policy explains international processing. Google Analytics keeps the information it collects for 2 months, and we do not use it for advertising. The app does not use analytics or advertising technologies.

Newsletter and emails. We plan to offer a newsletter sign up. If its form on hugeone.io loads a script or sets cookies from the newsletter provider, or if our newsletter or outreach emails measure whether they are opened or which links are clicked, for example with a small image in the email, we will describe this here before it starts, and we will not do it without your consent.

Other optional analytics or advertising technologies may be introduced only with information about their provider, purpose, storage and duration, and prior consent where required. This policy does not give blanket permission to activate them.

Where optional technologies are offered, the consent notice provides a choice to accept or reject them. Optional choices are not preselected. Continuing to browse, closing a notice or remaining silent does not constitute consent. Any consent-based technology must provide a way to withdraw consent as easily as it was given. You can also contact info@hugeone.io for help with your choices.

Your browser lets you review, block and remove cookies and site storage. Blocking necessary authentication storage may prevent sign-in or other requested functions. Clearing storage on one device does not necessarily change your choices on another device or with an external provider. Each site asks separately: an answer given on one of them does not cover the others or the app.

6 External services

Choosing sign in with Google opens Google’s authentication service, which has its own storage and privacy practices. In the app, it opens in a secure browser window on your phone, which may keep cookies from the sign in services under your phone’s browser settings. Sign in with Apple, offered in the app on iPhone, is subject to Apple’s own privacy information.

The founder portal, investors.hugeone.io, deck.hugeone.io and hugeone.io request fonts from fonts.googleapis.com and fonts.gstatic.com. Delivering these files involves sending network and browser information, including your IP address, to Google, even if no cookie is set. These requests are separate from advertising analytics.

The investor presentation at deck.hugeone.io also loads software libraries from cdn.jsdelivr.net and cdnjs.cloudflare.com, which receive your IP address to deliver the files.

If you choose to watch the video on hugeone.io, it loads from YouTube in its privacy enhanced mode. Nothing loads from YouTube until you choose to watch it; YouTube may then store information on your device under Google’s policies. The video player also offers a link to watch the same video on YouTube.

External websites you choose to visit operate under their own policies. Loading third-party content or tracking within HugeOne is different from following an external link and remains subject to applicable notice and consent requirements.

7 Changes and contact

We update this policy when the technologies or their purposes change and show the effective date above. Where a new optional purpose requires consent, we ask before activating it. For help or a privacy request, contact info@hugeone.io. Our Privacy Policy explains recipients, international processing and your data-protection rights.