Your privacy is our core foundation. Bubblez is engineered with End-to-End Encryption (E2EE) and zero-knowledge principles so your conversations remain strictly between you and the people you talk to.
🔒
End-to-End Encrypted
Messages, audio notes, and media are encrypted with X25519 and AES-256 before leaving your device. Only recipient keys can unlock them.
🚫
Zero Ad Tracking
We do not sell, rent, or trade your personal data or conversation records to data brokers or third-party advertising networks.
🫧
Ephemeral Architecture
Ephemeral bubbles and messages vanish when their timers expire, keeping your digital footprint lightweight and safe.
🛡️
Total User Control
Easily delete your account, manage synced contacts, revoke device sessions, or export your account metadata at any time.
01. Information We Collect
We believe in minimal data collection. We only collect the minimal information necessary to deliver and maintain our communication services:
A. Account Information
Phone Number: Used as your primary identifier for authentication, account security, and one-time verification (OTP).
Profile Details: Your optional display name, unique Bubble ID (username), avatar picture, and bio.
Cryptographic Public Keys: Your public X25519 encryption key used by other users to establish encrypted private channels.
B. Device & Diagnostic Information
When you use the app, our systems gather minimal device diagnostic data to troubleshoot hardware-specific compatibility and ensure app security:
Device Model, Manufacturer, and Hardware Brand (e.g. Samsung, Apple, Google Pixel).
Operating System Version (e.g. Android 14, iOS 18).
App Version and unique installation ID to detect duplicate sessions and prevent unauthorized access.
C. Information We DO NOT Collect
We never have access to: Your private encryption keys, plaintext chat messages, photo/voice attachments, audio contents, or precise GPS location history.
02. End-to-End Encryption & Security
Bubblez implements state-of-the-art cryptographic protocols based on the Diffie-Hellman Elliptic Curve X25519 and symmetric AES-256-GCM / Salsa20 encryption:
Private Key Storage: Your private keys are stored solely inside your device's hardware-backed Secure Enclave / Keystore using encrypted storage. They never leave your device.
Zero-Knowledge Transit: Chat messages travel across our WebSocket servers strictly as unreadable ciphertext envelopes. Even if intercepted, no third party—including Bubblez—can decipher them.
Kinetic Pod Security: Group conversations ("Pods") use isolated shared channel keys negotiated securely between authorized pod members.
03. Contacts & Friend Discovery
Bubblez makes it effortless to connect with friends while respecting their privacy:
Optional Contact Sync: You can choose whether to grant contacts permission. If granted, phone numbers are securely transmitted to determine which contacts are already registered on Bubblez.
Duplicate Prevention: Contacts are deduplicated per account to avoid redundant processing.
Friend Joined Alerts: With your explicit consent, when you join Bubblez, we can notify existing friends that your Bubble ID is now active.
External Invites: For contacts not yet on Bubblez, you can send invite messages via SMS or WhatsApp with your Bubble ID and download link.
Control: You can disable contact access or revoke permissions at any time through your device system settings.
04. How We Use Information
We process your data exclusively for the following purposes:
Service Operation: Authenticating logins, routing encrypted message packets, and managing kinetic bubble physics.
Customer Support: Resolving technical issues and crash reports reported by you.
In-App Purchases: Validating subscription statuses and premium badge unlocks via official Google Play / Apple App Store APIs.
05. Notifications & Messaging
To alert you when new bubbles arrive while the app is in the background:
Push Notifications (OneSignal / FCM): We dispatch push alerts containing only delivery metadata (e.g. sender username and avatar indicator). The alert payload never contains decrypted message text.
SMS & WhatsApp Gateway (Twilio): When triggered, automated SMS or WhatsApp notifications are dispatched securely via Twilio for account verification and friend invites.
06. Data Sharing & Third Parties
We do not share your personal information except with trusted service providers essential to app infrastructure:
Infrastructure & Hosting: Secure PostgreSQL database and WebSocket relay servers.
Push Notification Gateways: OneSignal and Firebase Cloud Messaging for instant background alert delivery.
SMS & Telecom Services: Twilio for OTP verification and automated invitations.
App Stores: Google Play Store and Apple App Store for billing and payment fulfillment.
Legal Disclosures: We will only disclose metadata if strictly required by lawful court order or subpoena. Because our messages are End-to-End Encrypted, we cannot provide plaintext message contents to any law enforcement entity.
07. Retention & Account Deletion
You have full ownership of your data on Bubblez:
Ephemeral Expiration: Vanishing bubbles and temporary media automatically delete upon expiration.
Account Deletion: You can delete your account directly inside the app (Settings → Profile → Delete Account). Upon deletion, your profile records, avatar images, device associations, and contact mappings are permanently purged from our databases.
08. Your Rights (GDPR & CCPA / CPRA)
Depending on your location, you hold statutory privacy rights, including:
Right to Access: The right to request copies of your stored personal metadata.
Right to Rectification: The right to correct inaccurate profile information.
Right to Erasure: The right to request complete deletion of your data ("Right to be Forgotten").
Right to Portability: The right to receive your data in a structured, machine-readable format.
Non-Discrimination: We will never penalize or alter service quality for exercising your privacy rights.
09. Children’s Privacy
Bubblez is not intended for children under the age of 13 (or under 16 in certain European jurisdictions). We do not knowingly collect or solicit personal information from children under these ages. If we discover that a minor under the minimum age has created an account, we will take immediate steps to terminate the account and purge their data.
10. Contact Us & Inquiries
If you have any questions, feedback, or data privacy requests regarding this Privacy Statement, please contact our Data Protection Office: