Privacy Policy

Effective Date: January 1, 2025
Last Updated: December 2, 2025

Introduction

This Privacy Policy describes how Bubbles ("we", "our", or "us") collects, uses, and shares your personal information when you use our mobile application (the "App"). We are committed to protecting your privacy and being transparent about our data practices.

Information We Collect

1. Information You Provide

Account Information

• Email address (required for authentication)
• Full name (user-provided during registration)
• Profile picture (optional, uploaded by you)
• Username (auto-generated or customizable)

Identity Verification Information

IMPORTANT: All users must complete identity verification to use the App.

We use Didit, a third-party identity verification service, to verify your identity and age. During this mandatory verification process, you will:

• Upload a government-issued ID (driver's license, passport, or state ID)
• Complete a video selfie for liveness detection (requires camera and microphone access)
• Have your identity verified against your ID document

Data Collected During Verification:

• First name and last name (extracted from your ID)
• Legal name (from your ID, used for binding rental agreements)
• Age verification (to confirm you are 18 years or older)
• Verification status (Approved, Declined, or In Review)
• Verification timestamp

Data NOT Stored by Bubbles:

• Your ID document images
• Your date of birth
• Government ID numbers
• Selfie photos

Didit retains verification data according to their privacy policy and data retention requirements. We recommend reviewing Didit's privacy policy at https://didit.me/privacy.

Verification Limits:

• Maximum 10 verification attempts
• 1-hour cooldown period after reaching the limit

User-Generated Content

• Posts you create in communities (text and images)
• Comments on posts
• Messages you send through the App
• Listing descriptions for spaces and resources you share
• Booking messages and communications with other users

Photos and Media

• Profile pictures
• Space and resource listing photos
• Handoff verification photos (photos taken at pickup and return of items for verification purposes)
• Dispute evidence photos (if you file or are involved in a dispute)

All uploaded images are automatically compressed to 50% quality with a maximum width of 800 pixels to optimize storage and performance.

Transaction and Booking Data

• Booking requests (dates, locations, messages)
• Check-in and check-out records
• QR code scans for pickup and return verification
• Time windows for item handoffs
• Condition ratings you provide or receive
• Dispute filings and resolutions
• Private booking notes (only visible to you)

2. Information Collected Automatically

Location Data

We collect and use location data differently depending on the feature:

• For Resources (items): We collect your approximate location and apply "location fuzzing" — we intentionally add random variation of approximately ±300 meters to protect your privacy. This fuzzed location is what other users see on maps when discovering items. Your exact location is only shared with the borrower after you approve their booking request.
• For Spaces (properties): We collect and store your exact street address, which is necessary for guests to find the location for their stay. This address is visible to users after you approve their booking request.
• For Discovery: With your permission, we may access your current location to show you nearby resources on the map.

Location Permission: We only request "While Using App" location permission. We never track your location in the background.

Device Information

• Device type and model
• Operating system version
• Unique device identifiers (for push notifications)
• App version

Usage Data

• Features you use within the App
• Time spent in the App
• Interactions with listings, posts, and other users
• Navigation patterns within the App

Push Notification Tokens

• Expo push notification tokens (to send you notifications about bookings, messages, and updates)

How We Use Your Information

We use the information we collect to:

Core Functionality

• Create and manage your account
• Verify your identity and age (18+)
• Facilitate bookings and rentals between users
• Enable communication between users
• Process check-ins, check-outs, and item handoffs
• Display your listings to other users
• Show you nearby resources and spaces on maps

Safety and Trust

• Calculate and display reputation scores (see Automated Decision-Making section)
• Prevent fraud and abuse
• Resolve disputes between users
• Enforce our Terms of Service
• Moderate user-generated content
• Respond to user reports

Communication

Send you push notifications about:

• New booking requests
• Booking approvals or denials
• New messages
• Check-in and return reminders
• Overdue confirmations
• Pending request reminders

Send you one-time password (OTP) codes via email for authentication

Improvement and Compliance

• Improve the App's functionality and user experience
• Debug technical issues
• Comply with legal obligations

Sharing of Information

With Other Users

Visible to Other Users in Your Communities:

• Your name and profile picture
• Your username
• Your reputation scores and statistics:
  • Total completed stays and borrows
  • Acceptance rate (as a host/owner)
  • Completion rate (as a guest/borrower)
  • Reliability rate (on-time returns)
  • Number of active listings
• Your posts, comments, and reactions
• Your listings (spaces and resources)
• Booking request messages (visible to the other party)

NOT Visible to Other Users:

• Your email address
• Your legal name (from ID verification)
• Your phone number
• Your private booking notes
• Your favorites/starred items
• Your exact location (for resources, until approved)

With Service Providers

We share your information with the following third-party service providers who help us operate the App:

Convex (Backend Database and Infrastructure)

• Service: https://convex.dev
• Data Shared: All user data, messages, posts, bookings, and uploaded files
• Purpose: Complete backend infrastructure including database, file storage, and real-time updates
• Location: United States (check Convex's privacy policy for data center details)

Didit (Identity Verification)

• Service: https://didit.me
• Data Shared: Email address, full name, government ID (uploaded by you), video selfie
• Data Received: First name, last name, legal name, verification status
• Purpose: Age and identity verification (18+ requirement)
• Privacy Policy: https://didit.me/privacy

Expo (App Infrastructure and Push Notifications)

• Service: https://expo.dev
• Data Shared:
  • Push notification tokens
  • Notification content (booking details, message previews, user names, item names)
  • Device information (implicit in push token)
• Purpose: Push notifications, over-the-air app updates, and development infrastructure
• Privacy Policy: https://expo.dev/privacy

Mapbox (Address Autocomplete and Geocoding)

• Service: https://api.mapbox.com
• Data Shared: Address search queries, session tokens, selected addresses
• Data Received: Full addresses, latitude/longitude coordinates
• Purpose: Address autocomplete when adding spaces or searching locations
• Privacy Policy: https://www.mapbox.com/legal/privacy

Google Maps (Map Display)

• Service: Google Maps Platform
• Data Shared: Map requests, location data for displaying markers
• Purpose: Displaying maps and resource locations
• Privacy Policy: https://policies.google.com/privacy

Resend (Email Delivery)

• Service: https://resend.com
• Data Shared: Email addresses, one-time password codes
• Purpose: Sending authentication codes for email-based login
• Privacy Policy: https://resend.com/privacy

With Legal Authorities

We may disclose your information:

• When required by law, regulation, or legal process
• To protect the rights, property, or safety of Bubbles, our users, or the public
• In connection with a merger, acquisition, or sale of assets (with notice to you)

What We Do NOT Do

We do NOT:

• Sell your personal information to third parties
• Share your data with advertising networks
• Use behavioral analytics or tracking services (no Google Analytics, Facebook Pixel, etc.)
• Use crash reporting services that collect user data
• Share your data with social media platforms (we do not use Google/Facebook/Apple login)
• Process payments or collect credit card information (no payment integration exists)

Automated Decision-Making

Reputation Scoring System

We automatically calculate reputation scores based on your behavior in completed bookings. These scores affect your ability to make and receive bookings.

How Scores Are Calculated:

• Pickup Punctuality Score (0-100): Based on whether you arrive on time for item pickups
• Return Punctuality Score (0-100): Based on whether you return items on time
• Condition Score (0-100): Based on the condition ratings you receive from hosts/owners
• Composite Reputation Score (0-100): Weighted combination of the above scores
• Completion Rate (%): Percentage of bookings completed without disputes

How Scores Are Used:

• Displayed on your public profile
• Visible to other users considering your booking requests
• May affect your ability to book items (low scores may limit access)

Your Rights:

• You can view your scores and the data used to calculate them
• You can contest disputes that negatively affect your scores
• You can contact us at support@bubblesapp.dev to discuss score-related concerns

Automated Booking Restrictions

If you have unresolved disputes or repeated violations, you may be automatically blocked from making new bookings until the issues are resolved.

Your Rights and Choices

You have the right to:

Access and Correction

• Access your personal information
• Correct inaccurate information
• Update your profile, photos, and listings

Data Deletion

Delete your account through the App settings

Important: Account deletion uses "soft delete" (anonymization):

• Your email, phone, and name are permanently deleted
• Your profile becomes "Deleted User"
• Your historical messages, posts, and booking records are preserved (anonymized) to maintain the integrity of other users' transaction history
• This is NOT full data erasure, but permanent anonymization

Restrictions on Account Deletion:

You cannot delete your account if you have:

• Active bookings as a guest
• Active bookings as a host
• Unresolved disputes

Communication Preferences

• Opt out of marketing communications (if we add them in the future)
• Control push notification settings in your device settings
• Manage in-app notification preferences

Device Permissions

You can control the following permissions in your device settings:

• Camera: For taking photos of spaces, resources, handoffs, and profile pictures
• Photo Library: For uploading existing photos
• Microphone: For identity verification video selfie
• Location: For showing nearby resources on maps
• Notifications: For receiving push notifications about bookings and messages

Denying permissions may limit certain App features.

Privacy Features

• Block users: Prevent specific users from seeing your profile, content, or contacting you
• Hide conversations: Hide message threads from your conversation list
• Location fuzzing: Resources automatically use fuzzed locations (±300m) for privacy

Data Export

You have the right to receive a copy of your personal information in a portable format.

How to Request Your Data:

1. Email support@bubblesapp.dev with the subject line "Data Export Request"
2. Include your registered email address and username for verification
3. We will verify your identity and provide your data in a machine-readable format (JSON)
4. You will receive your data within 30 days of your request

What's Included in Your Export:

• Account information (email, name, username, profile details)
• Your posts, comments, and messages
• Your listings (spaces and resources with descriptions)
• Your booking history (as guest/borrower and host/owner)
• Your reputation scores and statistics
• Photos you've uploaded
• Bubble memberships

What's NOT Included:

• Other users' private information
• System logs and metadata
• Deleted or anonymized data

Data Retention

We retain your information for as long as your account is active or as needed to provide services.

After Account Deletion

As described above, we use soft deletion (anonymization):

Personal identifiers are permanently deleted

Historical data is preserved anonymously for:

• Other users' transaction records
• Dispute resolution history
• Legal compliance
• Preventing fraud

Specific Retention Periods

• OTP codes: Deleted after 20 minutes
• Push notification tokens: Deleted when you delete your account
• Uploaded photos: Deleted when you delete the listing or your account
• Booking records: Preserved (anonymized) after account deletion
• Messages: Preserved (anonymized) after account deletion
• Dispute records: Preserved indefinitely for legal and safety reasons

Security

We implement reasonable security measures to protect your information:

• Encrypted connections: All data transmitted between the App and our servers uses HTTPS encryption
• QR code signing: Handoff QR codes are cryptographically signed to prevent forgery
• Webhook verification: Identity verification webhooks use HMAC-SHA256 signature verification
• Access controls: Database access restricted to authorized systems
• Image compression: Uploaded images are automatically processed to reduce file size

However: No method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Children's Privacy

The App is ONLY for users 18 years of age or older. We verify age through mandatory government ID verification.

We do not knowingly collect information from anyone under 18. If you believe we have inadvertently collected information from someone under 18, please contact us immediately at support@bubblesapp.dev, and we will take prompt action to delete it.

International Users

Your information may be transferred to and processed in the United States and other countries where our service providers operate. These countries may have different data protection laws than your country.

By using the App, you consent to:

• The transfer of your information to the United States
• Processing by Convex (US-based)
• Processing by Didit for identity verification
• Processing by other service providers listed in this policy

For EU Users: We rely on standard contractual clauses and service provider commitments to protect your data during international transfers.

State-Specific Privacy Rights

California Residents (CCPA)

If you are a California resident, you have additional rights:

• Right to Know: You can request details about the personal information we collect, use, and share.
• Right to Delete: You can request deletion of your personal information (subject to our soft delete policy described above).
• Right to Opt-Out of Sale: We do NOT sell personal information.
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at support@bubblesapp.dev.

European Economic Area Residents (GDPR)

If you are in the EEA, you have additional rights:

Legal Basis for Processing:

• Performance of contract (to provide App services)
• Legitimate interests (safety, fraud prevention, service improvement)
• Legal obligations (dispute resolution, compliance)
• Consent (where applicable, such as location access)

Your Rights:

• Right to access your data
• Right to rectification (correction)
• Right to erasure (subject to our soft delete policy)
• Right to restrict processing
• Right to data portability (contact us to request your data)
• Right to object to processing
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

To exercise these rights, contact us at support@bubblesapp.dev.

Third-Party Services and Links

The App uses the third-party services listed in the "Sharing of Information" section. Each service has its own privacy policy, which we encourage you to review:

• Convex: https://www.convex.dev/privacy
• Didit: https://didit.me/privacy
• Expo: https://expo.dev/privacy
• Mapbox: https://www.mapbox.com/legal/privacy
• Google Maps: https://policies.google.com/privacy
• Resend: https://resend.com/privacy

We are not responsible for the privacy practices of these third-party services.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will:

• Update the "Last Updated" date at the top
• Notify you through the App or via email
• Request your consent if required by law

Your continued use of the App after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us:

Email: support@bubblesapp.dev
Website: https://bubblesapp.dev/

For data-related requests (access, deletion, correction), please include:

• Your registered email address
• Your username (if known)
• A clear description of your request
• Verification information (to confirm your identity)

We will respond to all requests within 30 days.