Por ahora esta página solo está en inglés. Se traducirá cuando la haya revisado un abogado. Si tienes alguna pregunta, escribe a privacy@bubbles.software.
Draft. This page is waiting for legal review and may change before bubbles is released publicly.
Privacy policy
Last updated 9 November 2026
bubbles is built to collect as little as possible: messages are end-to-end encrypted and pop within 24 hours, and stats never leave your phone. This policy explains what we do process.
Who we are: bubbles is provided by [to be filled] (company name and address). Contact: privacy@bubbles.software. EU representative: [to be filled]. In Quebec, the person in charge of protecting personal information can be reached at the same address.
What we process
| Data | Why | How long |
|---|---|---|
| Email address and password (stored scrambled) | To create your account and sign you in. Never shown to anyone. | Until you delete your account |
| Nickname, display name, random name, emoji, bubble colour | To show you to the people you chat with | Until you delete your account |
| Messages | To deliver them. They are end-to-end encrypted: we store only locked text we can't read. | Until the bubble's timer runs out – 24 hours at most |
| Short notes the server writes (e.g. “… left the bubble”) | To tell members what happened. Not encrypted; never contain message text. | Same as messages |
| Blown bubbles (Nearby) | To show your short public message to people nearby. Not encrypted and public to people nearby, without your name. | Shown for 1 minute. A private copy, which only our safety team can see, is kept for 1 hour so the bubble can still be reported, then deleted. |
| Approximate location (only if you switch Nearby on) | To work out which blown bubbles reach you. Rounded, never shown to anyone. | Until you switch Nearby off or sign out |
| Bubbles, memberships, friends, join requests, votes | To run group bubbles, friends and voting | Until you leave, the bubble pops, or you delete your account |
| Your public encryption key | So others can lock messages for you. Your private key never leaves your phone. | Until you delete your account |
| App lock PIN and account pop PIN (only if you set them) | To lock the app on your phone, and to delete your account in an emergency. Stored only on your phone, as scrambled copies in its secure storage. Never sent to us. | Until you turn them off, sign in with your password after forgetting the PIN, or delete your account |
| People you block | To keep blocked people away from you. They aren't told. | Until you unblock them or delete your account |
| Reports and safety records | To keep people safe and meet legal duties. A report holds the reason, anything you wrote, who reported and who was reported, and – only if you choose – the text of the reported message. For a blown bubble, its text. | As long as needed for that purpose, then deleted [to be filled] |
| Technical logs (e.g. IP address, time of requests) | Security and keeping the service running | A short time, set by our hosting provider [to be filled] |
Stays on your phone only: your private encryption key, your settings and your stats. Stats are off until you switch each one on and never include what you typed.
We don't sell data, show ads, track you across apps or websites, or use analytics tools.
Legal bases (EU, UK-style laws)
- Contract – to provide the app you signed up for (account, chats, groups, friends).
- Consent – for location (Nearby is off until you switch it on; switching it off withdraws consent and deletes your location).
- Legitimate interests – security, preventing abuse, handling reports.
- Legal obligation – responding to lawful requests and reporting illegal content where the law requires it.
Who helps us
We use service providers that process data only on our instructions: our database and sign-in provider (Supabase, data stored in [to be filled] region), our email sender [to be filled], and our crash reporting [to be filled]. App stores (Apple, Google) process data under their own policies. When data is transferred outside your country, we rely on safeguards such as the EU Standard Contractual Clauses.
How long we keep data
See the table above. When you delete your account, your data is deleted straight away, except limited safety records described above.
Your rights
Depending on where you live (EU, Canada/Quebec, Israel, US states), you can ask to access, correct, delete or receive a copy of your data, object to or restrict some processing, and withdraw consent. Write to privacy@bubbles.software. You can also complain to your data-protection authority – for example in the EU your national authority, in Quebec the Commission d'accès à l'information, in Canada the Privacy Commissioner, in Israel the Privacy Protection Authority.
Age
bubbles is for people aged 18 and over. We don't knowingly collect data from children; if you think a child is using bubbles, tell us and we will delete the account.
Security
Messages are end-to-end encrypted, connections use HTTPS, and access to data is limited by strict database rules. If a breach affects you, we will tell you and the authorities as the law requires.
Changes
We'll update this page and tell you in the app about important changes.