Privacy Policy

Last updated: 22 July 2026 — mirrors the German version of the same date.
Applies to the Bubbles app and the joinbubbles.app website.

1. Controller

The controller for data processing under the GDPR is:

Full provider identification: Legal Notice (German). There is no statutory obligation to appoint a data protection officer.

2. Principles

Bubbles is an app for meeting up in real life. Only the data needed to run it is collected. Nothing is passed on to advertisers, there are no advertising IDs, no profiling for advertising purposes and no third-party analytics SDKs.

3. This website (joinbubbles.app)

3.1 Hosting and server log files

The website is hosted by Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA; represented in the EU by Cloudflare Germany GmbH, Rosental 7, 80331 Munich). Cloudflare processes the data as a processor under a contract pursuant to Art. 28 GDPR.

When a page is requested, technically necessary access data is processed:

• IP address of the requesting device
• date and time of the request
• the address requested and the amount of data transferred
• the server’s status response
• browser type and operating system (user agent), where transmitted
• the previously visited page (referrer), where transmitted

This processing is necessary to deliver the page, to keep operations secure and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stable, secure operation). Access data is kept only briefly, usually a few days, and then deleted automatically; it is never evaluated for analytics or marketing.

Cloudflare runs a worldwide server network, so processing may also take place outside the EU. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, and standard contractual clauses under Art. 46(2)(c) GDPR are in place as an additional safeguard.

3.2 No cookies, no tracking, no external content

This website sets no cookies, uses no local storage and embeds no analytics, advertising or social media services. No JavaScript runs on this site. Every resource, including the Nunito typeface, is served from our own server and never loaded from third parties, so no connection to Google Fonts is created. Consent under § 25 TDDDG is therefore not required, and there is no cookie banner.

3.3 Getting in touch by email

If you write to support@mucode.de, your sender address and the content of your message are processed in order to answer your request. The legal basis is Art. 6(1)(b) GDPR for enquiries relating to your use of the app, otherwise Art. 6(1)(f) GDPR (legitimate interest in responding). The address is forwarded to a private mailbox via Cloudflare Email Routing (processor, see 3.1); messages are not stored there permanently but deleted once the request has been dealt with and no retention obligations apply.

4. Minimum age

Using Bubbles requires a minimum age of 16. People under 16 may only use the app with a guardian’s consent. No data is knowingly collected from children under 13.

5. What data the app collects

5.1 Account data

• email address and password (stored encrypted)
• username and display name
• date of birth (age verification; you control whether your age is visible on your profile)

5.2 Profile data

• profile photo (optional, stored on Supabase Storage, EU)
• town / postcode (optional, for nearby search)
• interests and tags
• mood / status (optional)

5.3 Social data

• friend connections
• community and group memberships
• organiser profiles

5.4 Content

• vibes: activity signals with a category, a time window and optional free text — these expire automatically (<24 h)
• events: gatherings with attendee lists
• chat messages and reactions

5.5 Communication and technical data

• phone number (optional, only for finding friends by number)
• push notification token (for notifications, revocable)
• read status of messages and notifications

5.6 Location data

• postcode / city for the explore feed (set once, no live tracking)
• optional location for nearby search (not stored permanently)

6. Purpose and legal basis

The data in section 5 is processed on the basis of Art. 6(1)(b) GDPR (performance of a contract) in order to provide the app’s functions. Push notifications are based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in your iOS settings.

7. Retention

Your data is stored for as long as your account exists. After you delete your account, all personal data is erased within 30 days. Vibes expire automatically, and chat messages are deleted along with the chat they belong to.

8. Third parties

The following service providers are used to run the app:

• Supabase Inc. — database, authentication, file storage (servers in the EU, Frankfurt)
• Cloudflare, Inc. — hosting of this website and email forwarding (see section 3)
• Apple Inc. — push notifications via APNs
• Expo (650 Industries Inc.) — app updates (OTA)

Nothing is passed on to advertisers.

9. Your rights

You have the right to:

• access the data stored about you (Art. 15 GDPR)
• have inaccurate data corrected (Art. 16 GDPR)
• erasure (Art. 17 GDPR) — in the app under Settings → Account
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

10. Changes to this privacy policy

This privacy policy is updated whenever the processing changes. You will be informed about significant changes by in-app notification or email. The date of the latest version is shown at the top.

11. Contact

For privacy questions: support@mucode.de