Privacy Notice

Version: privacy-notice-v1-rc-2

Effective date: 2026-08-08

This notice explains how data controller Umut Öztosun, operating Bubble: Drop Your Moments (“Bubble,” “we,” “us”), handles information when you use Bubble, our support/deletion pages, and related services.

Contact: kvkk@bubblehere.com
Postal address: Beşiktaş İstanbul
Privacy and deletion portal: https://bubblehere.com/delete-account

Information we handle

Account and profile

We receive an account identifier and limited profile information from Apple or Google, or an email address when you choose passwordless email sign-in. A passwordless email contains a short-lived sign-in link and code delivered through our approved email provider. We store your Bubble user ID, handle, profile name, avatar, account status, language/region preferences, privacy settings, and an age-eligibility result.

Profile details you enter

When you set up your profile, Bubble asks for a date of birth, a phone number, a gender, and a country and city. You may also add an avatar and links to your accounts on other services.

Bubble stores the date of birth you enter, not only an age band. An earlier version of this notice said we avoid keeping a full date of birth whenever an age band or an eligibility result would do; that is no longer accurate, and this notice has been corrected rather than left as it was. The date is used to confirm you meet the minimum age and to work out the age other people see. Other people are shown an age, never the date itself.

The phone number is stored in a normalised international form. It is not used to sign you in, not used for account recovery, not used to send you messages, not used to find you or suggest you to anyone, and it is never shown to other members. Nothing in Bubble sends it to another company.

The country and city come from a fixed reference list. You can pick them yourself, or ask Bubble to fill them in from where you are. If you ask, your device — not Bubble — turns your position into a place name, and Bubble receives only the country and city you then confirm: the same two entries from the same list you would have chosen by hand, and indistinguishable at our end from a manual choice. Your coordinates are never sent to us for this, no part of the position is stored, and no other company is asked. Declining location does not block this step or anything else — you pick from the lists instead. Neither the country nor the city is shown to other members.

This is a separate record from the declared region used for nearby-activity notifications described below. That region is never derived from your device; this one may be, on your device. The two are stored separately, controlled separately, and neither stands in for the other.

You decide separately whether other people see your gender, your age, and your linked accounts. Each of those has its own switch in privacy settings and each starts on; your date of birth, phone number, country and city are not shown to other members at all, whatever those switches say.

All of it is removed when you delete your account: the date of birth, phone number, gender, country and city are cleared and the linked accounts are deleted.

Location

When you allow foreground location, Bubble processes the device measurement, accuracy, time, and related risk signals to show your Bubble Zone, check Pop/Drop distance, protect location-based access, and prevent abuse. Background location is off.

A Bubble you create has an internal exact anchor used for server-side distance and safety checks. Other users receive only an approved privacy-adjusted marker, area label, aggregate cell, or distance state. Bubble does not provide another person’s continuously updating precise location.

Declared region for nearby-activity notifications

Nearby-activity notifications are off unless you turn them on, and turning them on is a separate, explicit choice from allowing location. If you turn them on, you pick one broad region yourself by searching for a place on the map. Bubble converts what you picked into a wide standard area and stores only that area — never the point you tapped, never a place name, never a search history. Every stored area is at least 75 kilometres across at its narrowest and at least 10,000 square kilometres in size; if a chosen point cannot be turned into an area that large, Bubble refuses it rather than storing something smaller.

The stored area is not derived from your device. It is not your current location, your last known location, a Bubble you created, your network address, or anywhere the app has seen you — Bubble does not read your device position for this at all, and background location remains off.

The area decides only whether aggregate activity there may occasionally trigger a notification. Bubble does not count people, does not tell you who is there, and does not tell you that a particular person is nearby. A notification is possible only when overall activity in that wide area moves into a higher band, is delayed by between 30 and 120 minutes and re-checked before it is sent, and is limited to at most one notification every 72 hours and two in any 14 days. The notification itself contains no area, no place, no band, no number, no person, no content, and no time — opening it simply opens the map, which then loads only what you are allowed to see.

You can view your area, replace it (at most once every seven days), or clear it at any time in Notification settings. Clearing is immediate, is never rate-limited, and withdraws your consent. Turning it on requires ticking an unchecked consent box that records which version of this notice you agreed to. No notification provider ever receives the area or any location information.

Content and communications

We handle the Bubbles, photos, videos, voice, captions, profile content, reactions, friend activity, message requests, messages, and support information you choose to submit. We also handle capture/upload metadata such as source type, timestamps, duration, dimensions, checksum, moderation status, and whether media was captured Live or imported as Memory.

Purchases and Coins

Apple, Google, and RevenueCat process store payments. Bubble receives normalized product, transaction, entitlement, renewal, cancellation, refund, and verification information needed to grant and reconcile purchases. We maintain an append-only Coin ledger, balances, grants, spends, burns, reversals, and anti-fraud provenance. Bubble does not receive your full payment-card number from the app stores.

Referrals and store reviews

If you use a friend invitation, Bubble handles the invitation code, the inviter/invitee relationship, qualification and reward status, snapshotted campaign terms and related Coin or cosmetic evidence. To limit repeat-account farming, the app creates a random installation token and the server keeps only its cryptographic digest for up to 90 days; Bubble does not use your contacts, advertising identifier or exact location for referral attribution. The reusable code and installation signal are removed when the account is deleted. The internal referral relation remains only against the anonymized profile identifier where needed for reward-ledger, cap and anti-farming integrity and is not made public.

Bubble may remember how many eligible review prompts it has shown and your actions on Bubble's own pre-prompt, such as copy, dismiss or opening the native review request. Apple or Google controls the native review sheet. Bubble does not receive or infer whether you submitted a review, its star rating, text or sentiment, and reviewing is never connected to a Coin or referral reward.

Device, security, diagnostics, and analytics

We may handle installation/app version, platform, notification subscription, coarse performance measurements, safe request IDs, domain error codes, security/rate-limit signals, IP-derived security information, crash diagnostics, and allowlisted product analytics. General analytics and crash reports must not contain exact coordinates, media, captions, message/report text, tokens, signed URLs, receipts, email, full date of birth, or push tokens.

Safety and moderation

We handle reports, block state, automated safety signals, evidence snapshots, moderator decisions, sanctions, appeals, and audit records to review possible harm, enforce rules, protect users, respond to disputes, and prevent repeat abuse. Reporter identity and confidential evidence are restricted.

Why we use information

We use information to:

• create and secure accounts and restore sessions;
• operate Map, Bubble Zone, Pop Radius, discovery, Drop, Pop, friendships, chat, notifications, Wallet, purchases, and Bubble+;
• distinguish Live from Memory and prevent tampering;
• authorize content and private media without exposing locked assets;
• process and reconcile purchases, Coins, entitlements, refunds, and fraud controls;
• personalize language, accessibility, notification preferences, and safe product configuration;
• moderate content, process reports/appeals, enforce blocks, investigate abuse, and protect sensitive locations;
• maintain, debug, measure, secure, and improve the service using minimized data;
• send account, safety, purchase, social, and opted-in product notifications;
• fulfill export, deletion, support, and valid authority requests.

We do not use precise location for targeted advertising. We do not sell Coins as cash value, provide Coin cash-out, or allow direct Coin transfers.

What other people can see

Depending on your settings and Bubble access mode, others may see your handle, profile image, allowed profile fields, privacy-adjusted Bubble marker/area, source/access/status labels, safe preview metadata, and authorized content. They do not receive your email, full date of birth, phone number, declared country or city, exact live location, internal risk/moderation data, block list, purchase receipt, raw Coin ledger, or locked media path.

Private, Friends, and Secret settings limit product access but are not a promise that a recipient cannot copy what they are authorized to view. Removed, blocked, expired, or moderated content may stop being available even after a prior Coin unlock.

Service providers and disclosures

We use service providers to host and secure data, authenticate accounts, deliver passwordless sign-in email, process maps and location requests, deliver private media, process purchases/subscriptions, deliver notifications, analyze product reliability, diagnose crashes, moderate content, and support users. Current categories include Supabase, Apple, Google, Resend, RevenueCat, OneSignal, map infrastructure, PostHog, Sentry, Expo/EAS, app stores, advertising when enabled, and moderation/media services.

We share only the data needed for the provider’s role. We may also disclose information when required to respond to valid legal process, protect a person from serious harm, investigate fraud/security incidents, enforce agreements, or complete a corporate transaction with appropriate protections. We do not publish reporter identity or private evidence to the reported person.

Retention schedule

Your controls

You can change language, notifications, privacy defaults, blocked users, and supported accessibility settings in the app. You can view, replace, or clear your declared nearby-activity region in Notification settings; clearing it is immediate. You can turn off whether other people see your gender, your age, or your linked accounts, each separately, in privacy settings. You can deny or revoke location, camera, microphone, photo-library, and notification permissions through device settings. Denying an optional permission does not block unrelated core features; for example, location denial still allows global map browsing and place search.

You can request an export, correct profile data, remove content where the product permits, appeal an eligible moderation decision, or start account deletion from Settings → Account & Data. The public deletion page is https://bubblehere.com/delete-account.

Account deletion

Deletion immediately restricts normal account use, revokes sessions and media grants, and stops new notifications. A 30-day grace period allows cancellation before irreversible deletion starts. After that period, profile/account data, user media, and account-linked messages are deleted or irreversibly anonymized within the applicable approved period shown in the retention table, except restricted records listed there. Subscription cancellation is separate and is managed through the app store.

Security

We use access controls, environment separation, private storage, encryption in transit, provider-supported encryption at rest, short-lived media delivery, audit logging, rate limits, server-side authorization, and monitoring. No service can promise zero risk; report suspected account or data misuse to support@bubblehere.com.

Age

Bubble is available only to people aged 18 or older. If we discover that an ineligible person created an account, we may restrict the account and remove information through the safety/deletion process.

International operation

Bubble and its providers may process information in countries other than where you live. Provider region, transfer, access, deletion, and security details are recorded in Bubble’s processor inventory and reflected in the in-app privacy details for the active service configuration.

Changes

We will assign a new version and effective date when this notice materially changes. If a change affects how previously collected information is used, the app will provide a clear notice and request acknowledgement or choice where required by the product flow.