BubblesBubbles Social

Bubbles Social Privacy Policy

Last updated November 4, 2026

This policy explains what Bubbles Social, the Bubbles app for Android (the "App"), collects, why, who helps us process it, and the choices you have. The App is run by Bubbles ("we", "us") and uses the same account as the Bubbles website.

In short: we collect what we need to run your account and the social features, plus security signals to stop fraud and abuse. No ads, no selling of your data, no precise location, and no tracking or analytics tools in the App.

1. What the App collects

Account

  • You sign in with your email (a one-time code), X or Google through our sign-in provider Privy. Privy receives your email address, or your X or Google account's basic profile (name, username, profile picture, account ID). We keep your Privy account ID and, when you sign in with X, your X username and profile picture.
  • Your Bubbles username, display name and profile picture.

Linked wallet

  • The public address of the wallet linked to your Bubbles account, if there is one, and its public holdings, read from the public blockchain to show your profile and to unlock thesis posts. The App never asks for keys or seed phrases and never moves funds.

What you do in the App

  • Your posts and replies, likes, reposts, the people and traders you follow and the alerts you turn on.
  • The posts, replies and accounts you report, and the accounts you block.
  • The notifications we create for you (for example, when someone replies to your post or follows you).

Device, network and diagnostic data

  • Privy, our sign-in provider, receives your device's IP address when you sign in and processes device and diagnostic data (such as device model, operating system, app version, IP address and the approximate location derived from it) to sign you in securely and prevent fraud, under its own privacy policy.
  • Our servers receive your IP address with each request, as every server does, but for the App we store nothing derived from it: no IP address, country, region or city. Only if one address floods our servers (hundreds of requests a minute) do our error logs note it, with its last part removed, to stop the attack.
  • The App does not use your precise (GPS) location and asks for no location, contacts, camera or microphone permission.

2. How we use it

  • To create and secure your account and sign you in.
  • To show your profile, posts, replies and activity to other people, as part of the social features.
  • To moderate content: our team reviews reports and removes content and accounts that break our Terms or Community Guidelines.
  • To prevent fraud, spam and abuse, to fix problems, and to meet legal obligations.

We don't show ads, we don't sell personal information and we don't share it for advertising.

3. Who processes it

  • Privy: sign-in (account details above, device and diagnostic data, IP address and the approximate location derived from it).
  • Supabase: our database (your account, content and activity).
  • Cloudflare: hosting and security (IP address and request data).
  • Market data and blockchain providers: wallet and token addresses only, never your name or email.

Your profile, posts, replies, likes, reposts and follows are public: other users and visitors of the App and the Bubbles website can see them. We may also disclose information if the law requires it or to protect the safety of our users.

4. How long we keep it

  • We keep your information while your account exists.
  • When you delete your account in the App, we delete your profile, posts, replies, likes, reposts, follows, notifications and blocks right away, and your sign-in account at Privy with its wallets (Solana and EVM): if a wallet still holds funds, the App first shows what it holds and deletes only after you confirm. Copies in backups are deleted within 30 days. Deleting on the Bubbles website deletes your sign-in account and wallets too, after the same warning.
  • A thesis payout that hasn't been sent to your wallet yet is cancelled when you delete your account and is never paid; the warning before you delete names it.
  • Thesis reward, payout and trade records, bonus and referral reward records, your public theses, creator tasks and token pairs you opened, and your chat with the Bubbles Telegram bot (if you started it) are kept without your name. Rate-limit counters last at most 24 hours. Privy may keep archived records of a deleted sign-in account under its own policy. The full list is on Delete your account.
  • Reports you sent about others are kept without your name so that the review can finish.
  • Information on public blockchains stays there permanently; nobody can delete it.

5. Your choices

  • Delete your own posts and replies from their ⋯ menu; report and block accounts from the same menu.
  • Delete your account in the App (Profile, then Settings, then Delete account) or at Delete your account.
  • Depending on where you live, you may have the right to access, correct, delete or get a copy of your information, and to complain to your data protection authority. Email us to make a request.

6. Children

The App is only for adults aged 18 or over. We do not knowingly collect information from anyone under 18; tell us and we will delete such an account.

7. Changes

We may update this policy. We will change the date at the top and, for significant changes, tell you in the App.

8. Contact

Questions or requests about privacy: pop@bubbles.space.