Privacy Policy

onBubbles (“we”, “us”), operating the service at onbubbles.com, is the controller of your personal data.

Operating entity, registered address and company registration number: [PLACEHOLDER — to be completed by operator].

For any privacy question or to exercise your rights, contact us at privacy@onbubbles.com (placeholder). You also have the right to lodge a complaint with your local supervisory authority — in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP).

We collect only what we need to run the service:

• Email address — how you sign in (we use one-time codes, not passwords).
• Phone number — used once to verify you are a real person. We store only a one-way cryptographic hash (HMAC) of your number for anti-bot deduplication; we do not store the number itself, and it is never shown to anyone.
• Name — your first name, last name and display name.
• Date of birth — used solely to check you meet the 16+ age requirement. It is stored in a way that is not exposed to other users or the app (the column is read-revoked); we derive only your age from it.
• Location — the city and country you enter for your profile.
• Handle (@username) and avatar.
• Interests — the topics you choose, used to build your Discover feed.
• Content you create — posts, replies, reactions, direct and group messages, stories, comments, polls, events, and any media (images, video, files) you upload.
• Notification data — your push-notification subscription (if you enable it) and your language preference.
• Usage events — an internal activity log we keep for product analytics and safety (see AI processing and analytics below). This is our own log; we do not use a third-party analytics vendor.
• Read-receipt timestamps — when you have read messages (you can turn read receipts off in Settings).
• A first-touch acquisition cookie — if you arrive via a tagged link (utm/ref), we record which channel referred you.

• Performance of a contract — to provide the onBubbles service you have signed up for.
• Consent — for push notifications, which you can enable and withdraw at any time.
• Legitimate interests — to keep the service secure and free of bots and abuse, to keep the community safe (moderation), and to understand and improve the product; balanced against your rights and freedoms.
• Legal obligation — for age assurance and for handling unlawful content where the law requires it.

• To run the service — deliver your posts and messages to the right bubbles and people.
• To keep it safe — content moderation and anti-bot verification.
• To send you the notifications you have enabled.
• To understand and improve onBubbles using our in-house activity log.

onBubbles uses an EU-hosted, open-model AI service (Scaleway Generative APIs, located in the European Union) for two purposes:

• Tagging — automatically labelling content by topic to power the Discover feed and interest recommendations.
• Moderation — automatically screening content for harmful or unlawful material.

Your content is sent to this EU provider only for these purposes, and the provider does not use it to train its models. This is automated processing that assists people — it is not a solely-automated decision that produces legal or similarly significant effects about you. Content the AI flags is reviewed by human moderators (a bubble’s own admins/moderators, and platform staff for escalations).

We do not sell your data. We share it only with the service providers that help us operate onBubbles, each acting on our instructions:

• Supabase — database, file storage and authentication, hosted in the EU (Paris / eu-west-3).
• Scaleway — AI tagging and moderation, in the EU.
• Twilio — sends the one-time SMS used to verify your phone.
• Brevo — sends transactional and sign-in emails.
• KLIPY — powers GIF search in chat.
• Vercel — hosts and serves the application (and its CDN).
• Apple, Google and Mozilla push services — deliver the notifications you enable to your device.

Some of these providers may process limited data outside the EU/EEA (for example in the United States). Where they do, transfers are protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses. [PLACEHOLDER — confirm each processor’s transfer mechanism and, where relevant, list sub-processors.]

Your primary data is stored in the European Union. See the section above for the limited cases where a processor may handle data outside the EU/EEA under appropriate safeguards.

• Your content and profile are kept until you delete them, or until you delete your account.
• When you delete your account, your account and content are permanently removed (see Your rights).
• The one-way phone hash is retained to prevent duplicate and abusive accounts.
• Operational and security logs are kept for a limited period. [PLACEHOLDER — retention periods].

Under the GDPR (Articles 15–22) you have the right to:

• Access — get a copy of your data. onBubbles gives you a one-tap “Download my data” export (as JSON) in Settings.
• Erasure — have your data deleted. “Delete my account” in Settings permanently removes your account and content.
• Rectification — correct inaccurate data (edit your profile in Settings).
• Restriction and objection — limit or object to certain processing.
• Portability — receive your data in a machine-readable format (the JSON export).
• Withdraw consent — e.g. turn off push notifications at any time.
• Complain — lodge a complaint with a supervisory authority (in Romania, ANSPDCP).

We protect your data with row-level security in the database (so people can only access what they are allowed to), encryption in transit (TLS), a pseudonymised (hashed) phone value rather than the raw number, and strict access controls.

If a personal-data breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours where the law requires (GDPR Article 33), and affected users where required.

onBubbles is for people aged 16 and over. This reflects the EU and Romanian rules on the age of digital consent. We check age at sign-up and refuse accounts for anyone under 16. If we learn that an under-16 has created an account, we will remove it.

We use a small number of cookies:

• Essential session/authentication cookies (Supabase) — needed to keep you signed in.
• A language-preference cookie — remembers whether you use onBubbles in Romanian or English.
• A first-touch acquisition cookie — records the channel (utm/ref) you arrived from.

We do not use third-party advertising or cross-site tracking cookies.

We may update this policy as onBubbles evolves. We will update the “Last updated” date and, for material changes, let you know in the app.

Questions about your privacy or this policy: privacy@onbubbles.com (placeholder). Operator details: [PLACEHOLDER — to be completed by operator].