Privacy Policy
Effective October 11, 2026. This policy explains what information Bubble handles, why it is used, where it is stored, and the choices available to you.
Information you provide
Bubble handles the mobile number you provide to verify and secure your account, plus profile details such as your name, biography, interests, and optional profile photo. It also handles posts, comments, reactions, messages, photos, videos, and voice recordings you choose to create.
Your phone number is sent to and stored by Google Firebase. Google also uses it for spam and abuse prevention across its services. Bubble does not use it for advertising or show it to other people.
Reports and blocks include the relevant content or account identifier and the reason you select.
Location
Location is optional. Bubble asks for location access only when you choose to tag a post with your approximate area, and it uses that single fix for that post alone. Your precise coordinates are never displayed to other people.
You can change location permission in iOS Settings. Every part of Bubble, including Sky, works without location access; only the optional area tag on a post is unavailable.
Camera, microphone, and photos
Camera access is used only when you take a photo or video in Bubble. Microphone access is used only when recording video or a voice message. The system photo picker gives Bubble access only to items you select.
Selected and recorded media is processed to preview, compress, store, or share it for the feature you chose. Face bubbles cover the faces in a photo for people who aren’t your friends when they view it in Bubble. The photo itself is stored as the original image, so Bubble cannot guarantee that someone who sees it outside the app will not see the faces.
How information is used
Information is used to operate profiles, Sky, posts, messages, media previews, safety controls, and your selected settings; to maintain security; and to investigate reported abuse.
Bubble shows no advertising and sells no personal information. Public post text and Discover interactions are used to recommend posts and honor your reading preferences. Private messages are not used for recommendations, advertising profiles, or unrelated analysis.
Bubble does not use precise location to publicly reveal where a person is.
How Bubble is built to know less
Bubble uses its own Discover recommendation records. Firebase Crashlytics collects crash reports to fix crashes; other Firebase components collect limited diagnostic and service-usage data to analyze and improve their operation. Bubble does not include advertising or attribution software, read the advertising identifier, or track you across other companies’ apps or websites.
A post other people can see does not carry the identifier of the account that made it. Ownership is recorded privately, so a public copy of a post cannot be traced back to its author through the post itself.
Notifications are deliberately incomplete. A lock-screen notification never carries a media thumbnail, because showing one would require giving the notification extension a credential able to fetch your media outside the app; media is fetched only by the app, after you are signed in. A knock from somebody you have not accepted arrives without their name.
The Home Screen widget runs in a separate sandbox and receives only a name, an initial, and whether a call is video — never a photo, and never an account identifier.
Signing out or deleting an account clears the notifications Bubble has already delivered, so a message body is not left behind in Notification Centre for the next person holding the phone.
Storage and retention
Editable profile fields, profile media, your posts, conversations, and their media are stored in Bubble’s private Application Support directory on this device. Settings and moderation choices are stored in the app’s private local preferences.
Local information remains until you delete it through an available in-app control or uninstall the app, except for Bubble group-chat messages. One-to-one messages remain until you delete their messages or conversation through an available in-app control, or uninstall the app. Cloud Bubble chat messages expire 28 days after they are sent. Messages in Bubble group chats stored only on this device are kept for the current and previous three Monday-start wall weeks. Messages outside the applicable retention window and chat media no longer referenced by retained messages are removed from this device automatically after the updated archive is saved. Settled bubble walls are separate and are not removed by these chat-retention rules.
Discover stores your reading-language preferences, which posts were visibly shown, and your likes, hides, reports, and blocks with your account to recommend posts and avoid repetition. Raw recommendation events are kept for up to 30 days and delivery tickets for 48 hours. Minimal private account-and-post records prevent repeated votes; these remain until you delete the account or the post is deleted. Recommendation records are removed through the same deletion process as other account and post data.
When you use Bubble with its online service — signing in, syncing posts and conversations, or calling — that content and your account details are also stored on Bubble’s servers so they can be delivered to the people you share them with and restored when you sign in again. The online service is hosted on Google Firebase (Google Cloud) in the United States, and information is encrypted in transit and encrypted at rest on those servers. Deleting one of your posts in the app removes its server copy. Deleting a one-to-one conversation or message removes your copy from your device and from Bubble’s servers. The other person’s copy remains until they delete it too; once both of you have deleted it, the server copy is erased. Unfriending or blocking someone removes your conversation with them from Bubble’s servers, and deleting your account erases all of your conversations. You can delete your whole account and its data at any time from Settings & Safety → Account → Delete account. Deleting closes the account immediately; the rest of the server-side removal finishes in the background — usually within seconds, and at most within 24 hours — and completes even if you delete the app first. A small number of records are kept permanently and deliberately: the retired identifiers of deleted accounts and posts, so they can never be reissued to somebody else, the fact that a connection was severed, blocks in both directions, and abuse reports. Deleted data may remain in backups and in soft-deleted storage for up to 14 more days before it is permanently erased; it is not used for anything during that time.
Sharing
Bubble does not sell personal information. iOS and Apple frameworks process permission prompts, photo selection, media capture, notifications, and device storage as needed to provide those system features.
The online service uses two providers: Google Firebase (Google Cloud) provides sign-in, database, media storage, message delivery, and crash reporting, and uses phone numbers for spam and abuse prevention as described above; Agora relays real-time audio and video during calls. Neither provider may use your posts, messages, or call content for advertising. When Bubble crashes, Firebase Crashlytics receives a crash report: the crash stack trace, your device model and system version, and the Bubble version. It is used only to find and fix crashes, is not linked to your account or used for tracking, and is kept for 90 days.
Your choices and rights
You can edit your profile, delete your own posts, unblock accounts, change permissions in iOS Settings, or delete your account entirely from Settings & Safety → Account → Delete account.
Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of personal information. Deletion of your account and its data is available in the app, in Settings & Safety → Account → Delete account; contact us for any other request.
Security, children, and changes
Information is protected with platform encryption on this device and, for the online service, with encryption in transit and at rest on Bubble’s servers — but no method of storage or transmission is completely secure. Do not use Bubble to share information that could put you or someone else at risk.
Bubble is not directed to children below the applicable minimum age. We will update this policy when data practices materially change and will request renewed acknowledgment where required.