Privacy Policy

Who we are

bubbleme is run by bubbleme Media Pty Ltd (ACN 703 257 112, ABN 90 703 257 112), a company registered in Queensland, at 2/290 Boundary Street, Spring Hill QLD 4000, Australia. In this policy “we” and “us” means bubbleme Media Pty Ltd. You can reach us at hello@bubbleme.bio.

This policy covers the bubbleme website and app at bubbleme.bio, the bubbleme app for iPhone (from the App Store) and the bubbleme app for Android (from Google Play), and the creator bubbles hosted there. The iPhone and Android apps show the same bubbleme you use in a browser, so everything here applies to them too; where they collect something more, we say so. We treat the Australian Privacy Principles as binding on us.

What we collect

• Your account: your email address, a one-way scrambled form of your password (we can’t read it), your handle, your plan, when you joined, and whether you’re verified, and, if you came from a link with a tag on it (for example from our Instagram), that tag, so we know which links bring people. If you came from the “made with bubbleme” link at the foot of someone’s bubble, we note which bubble; once you confirm your email, that bubble’s owner sees one more in a count of people who joined from it, never who you are. If you add a passkey, we keep its public key and the name you give it. We never receive your fingerprint, face or screen lock.
• Signing in with Apple or Google (only if you use it): Apple or Google acts as an identity provider for you. When you sign up or sign in with them, they tell us the email address on that account (with Apple’s Hide My Email, a private address that forwards to your inbox), whether they’ve confirmed it, and an id for your account with them. We keep these with your bubbleme account to sign you in, and show the address and when it was added and last used in Settings. With Apple we also keep, encrypted, a token Apple gives us, only so we can tell Apple to end bubbleme’s access when you remove Apple or delete your account. We never get your Apple or Google password, and we don’t ask for your name, photo or contacts. You can remove either in Settings, or at account.apple.com (Sign in with Apple) or myaccount.google.com/connections. Your account with Apple or Google is covered by their own privacy policies.
• If you don’t finish signing up: if you start signing up as a creator, your bubble can go live straight away, but it stays out of our sitemap, Explore and Discover until you confirm your email, and you have a day from signing up to confirm. If you don’t, your bubble stops showing, and your account (your email, a scrambled form of your password, your draft and any pictures) is deleted: our daily clean-up does this within two days of when you started, or sooner if someone signs up with that address again before you’ve chosen a handle or published (unless we’ve suspended the account). A business sign-up that isn’t confirmed stays until it’s confirmed or deleted.
• If the address already has an account: so nobody can use sign-up to find out who’s on bubbleme, signing up with an address that already has an account looks the same as a new sign-up. We keep what was entered (the address, a scrambled form of the password, the draft and any pictures) for 24 hours, then delete it, unless it’s moved to another address in that time. It can’t be confirmed with that address or signed in to. We email the address’s owner to let them know.
• Your agreement: which version of the Terms and this policy you accepted, when, that you confirmed your age, and the country your connection came from at the time.
• Your bubble (your public page at bubbleme.bio/@handle): everything you add to your bubble, such as your name, bio, links, social links, look and settings, and its published versions (we keep the last 20).
• Your uploads: photos, short videos and fonts you upload for your bubble (photos after your device has resized them, and fonts after we rebuild them as a smaller WOFF2 file with only the characters a bubble uses). Before we keep a photo, we remove the details a camera or app can save in the file, such as where it was taken, the device and comments (for a JPEG we keep only which way up it goes, and its colour profile). Before we keep an MP4 video, we blank the details a camera saves in the file, such as where it was filmed and on what device. WebM videos are kept as you upload them. So bubbles load quickly, we also keep up to four smaller copies of each photo, made from its pixels, so nothing else saved in the file travels with them.
• Business registration documents: if a business owner sends their registration to confirm the business, we keep it encrypted, only people and services working for bubbleme can open it (and each opening is logged), and we delete it as soon as we’ve checked it, or after 60 days at most.
• Visit statistics: counts of visits and taps on your bubble, grouped by day, hour of the day, link, campaign name (if you use link tags), referring site type (for example Instagram or direct), country and device type (phone, tablet or computer). These are totals. We don’t keep visitors’ IP addresses, full browser details or names in them.
• Newsletter sign-ups: if a visitor subscribes on your bubble, we keep their email address, the date, the bubble they signed up on and the wording they agreed to, for you. You decide how to use it, and you’re responsible for that use (see below). Until the visitor confirms with the link we email them, we keep their address, the bubble and the wording for up to 7 days, then delete them.
• Messages left on your bubble (only for blocks you set to save them): when a visitor writes to you through a Contact form block, or the block that lets brands ask about a collab, set to save messages to bubbleme, we keep their name, email address, message, the block and the time, for you (see Messages visitors leave on a bubble).
• Sign-in and security data: a session cookie (__Host-bm_u) keeps you signed in for up to 30 days after you last used bubbleme, and never more than 90 days. For each signed-in browser we keep when it signed in, when it was last used and a label such as “Safari on iPhone”, so you can see your sessions and sign them out. Each sign-in also sets a device cookie (__Host-bm_dev, 400 days) holding a random ID, and we keep a scrambled form of that ID for a year, so we only email you when a new browser or phone signs in. When you sign up, a one-day cookie (bm_sv) remembers which browser started it, and we keep a scrambled form of it with your account, so nobody else can finish your sign-up. A second one-day cookie (bm_dv) holds a random number so we can count sign-ups from one browser. To limit abuse we count requests per IP address, and sign-up attempts per browser and per scrambled form of the email address, for an hour, or for a day for a few checks such as wrong passwords on a private bubble or contact cards saved; these counts aren’t linked to your account.
• Now playing (only if you connect Apple Music): the sign-in Apple gives us to read your recently played songs, kept encrypted and never shown to anyone, plus the last few songs you played (up to 12) so your bubble can show what’s playing. Visitors only see the current or last song, its artist and artwork. We only check while someone has your bubble open, and we don’t keep a listening history.
• Email tool (only if you connect one): the API key or webhook address you give us, kept encrypted, the name of the account and the list you pick, and the last 50 lines of what the sync did, with addresses partly hidden.
• Connected accounts (only if you connect one): when you connect Instagram, YouTube or TikTok, we read that account’s id, handle and follower count, and keep the sign-in the platform gives us, encrypted, so we can re-check the count at least every 7 days. We show the handle on your bubble as a confirmed account and the count on your rate card. We never post for you or read your messages (comment to DM, below, is a separate sign-in). For YouTube we use YouTube API Services, and Google’s Privacy Policy (policies.google.com/privacy) applies. You can also remove bubbleme’s access at myaccount.google.com/permissions, or for TikTok in the TikTok app (Settings and privacy, then the list of apps with access). When you press Disconnect, or delete your bubbleme account, we delete the connection and its count and also tell Google or TikTok to end bubbleme’s access. If you remove access at Google or TikTok yourself, we delete the connection and its stored count at our next check, within 7 days; TikTok also tells us straight away, and we delete it then. Our use of information from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
• Comment to DM (only if you connect it): a separate Instagram sign-in that lets bubbleme list your recent posts, hear about new comments on them and send messages for you. We keep that sign-in encrypted, your Instagram handle and account ids, the keyword replies you set up (the post’s address and the start of its caption, the keywords, message, link and public replies) and totals of messages sent and taps on the link, by day for 40 days. See People who comment on Instagram for what we handle about them.
• Products from your store (only if you connect one to a shop block): your store’s address, Etsy shop name or product feed address, a Shopify Storefront access token if you give one, and the public product list we read from it (names, prices, stock, photo addresses and links), up to 100 products. We read it again once a day. Visitors’ browsers get product photos from bubbleme, so your store doesn’t see who views your bubble.
• Latest posts (only if you add a feed to a Latest posts block): the YouTube channel, podcast or blog feed address you give, or that you used your connected YouTube or Instagram account, and the newest posts we read from it (titles, links, dates, episode lengths and picture addresses), up to 12 per feed. For Instagram we use the sign-in you already gave us when you connected the account. We read each feed again once a day. Visitors’ browsers get the pictures from bubbleme, so the platform doesn’t see who views your bubble.
• Moving in from another link in bio: If you paste the address of a Linktree, Beacons, Komi, Stan or Carrd page, or another public page, we read that page once (if its robots.txt allows it) to copy its links, titles, social icons, picture and colours into your draft. We don’t keep the page, only where it came from and when you moved it (your last 20 moves). Only import a page that’s yours. If a Linktree is verified or belongs to someone well known, we check it against your connected accounts, or ask you to put a short code in your Linktree bio and read the page again to see it, and keep a one-way code of the Linktree’s name with your account, so it can’t be moved to another bubble.
• bubble+ opening email (only if you ask): that you asked to be told when bubble+ opens. We send that one email to your account’s address, and you can turn it off on the bubble+ page.
• Official bubbles (only if you ask): your note, the date you asked, our decision, who on our team made it, and the name and handle we checked. We keep a squashed form of an Official bubble’s handle so lookalike handles can be refused.
• Emails we send: account emails such as confirming your address, resetting your password, invites you asked for, collab updates and welcome messages; receipts and refunds for a plan; a reminder before a free trial’s first charge or before an offer price ends; and, if you asked, the email when collabs or paid plans open. Creators also get a weekly email about their bubble, and businesses a weekly check-in (and, on business+, a monthly report). Each of those three has its own off switch and unsubscribe link. If an email to you can’t be delivered for good, or you mark one of ours as spam, we keep a scrambled form of your address and from then on send it only sign-in and account safety emails.
• Notifications (only if you turn them on): in a browser, the push address your browser gives us (it comes from Apple, Google, Mozilla or Microsoft), for each device you turn them on for, until you turn them off. A browser push we send through it carries no words: your device then fetches what to show from us, signed in as you. We also keep which notifications you want (milestones, new subscribers, new messages on your bubble, your week), how many we sent you today (never more than two a day for these), and any held overnight until the morning. Replies in a collab conversation aren’t held back. A notification about a message on your bubble never shows who wrote it.
• App notifications (only if you turn them on in the iPhone or Android app): the device token Apple or Google gives the app, which kind of phone it is, the app’s version and a scrambled id for that copy of the app (so a token can’t be taken over by another account), for each device you turn them on for. App notifications are different from browser ones: they go through Apple Push Notification service (APNs) on iPhone and Google’s Firebase Cloud Messaging (FCM) on Android, and carry the notification’s title and text (for example, that your bubble passed 100 visits, last week’s visit count, or that a brand replied in your Inbox) and the bubbleme screen a tap opens. Apple and Google see those words while they deliver them.
• Scanning QR codes in the app: the camera reads the code on your phone, and the picture never leaves it. On Android, the scanner is Google’s ML Kit, which sends Google the phone’s model and system version, the app’s version, an id for that copy of the app and how the scanner performed. It never sends the picture.
• The home screen widget (only if you add it in the iPhone app): the app gets a key that can only read today’s visit and tap counts for your bubble, and keeps it in your phone’s keychain, shared with the widget alone. The widget uses it to fetch those two numbers; it can’t see or change anything else, and it isn’t your sign-in. We store the key only in scrambled form. It stops working when you sign out (on that phone or everywhere), remove the widget, reset your password or delete your account, and after 90 days at most.
• Friend invites: if you joined with another creator’s invite, we note who invited you, so you both get a month of bubble+ when you make your bubble live.
• Updates you send to your subscribers: the subject and words of each update, kept while it sends, and the subject and date of your last 20 (see Newsletter emails creators collect).
• Publishing later: if you schedule a publish, a copy of your draft as it was, until it goes live or you cancel it.
• Milestones: a running count of your bubble’s visits, and which milestones you’ve already seen.
• The old waitlist: before invites, people could join a waitlist. If you did, we kept what you gave us then (your email, the handle you wanted, your platform, follower range and niche and, for brands, your name, company and budget). We use it only to invite you (your invite email, one reminder, and your place-in-line link if you ask for it), and we delete it when you ask us to or delete your account. The waitlist is closed, so nobody new is added to it.
• Asking for an invite: if you ask for an invite on our website, we keep your email, whether you’re a creator or a business, and the handle and Instagram or website you gave us. We use it only to invite you: we email you to ask you to confirm the request (again each week until you do, while we keep it; it joins the line only if you do), then a private link to your place in line, then your invite when your wave goes out and one reminder before it runs out. When a wave goes out we also keep a short record under a scrambled form of your email (which wave invited you, whether the invite went, and whether the reminder did). It goes 180 days after the wave ends, or when you delete an account you’ve confirmed with that address. We keep one request per address, until we’ve sent you an invite, 12 months at most, or until you ask us to delete it or delete an account you’ve confirmed with that address.
• Brand invite requests: if you ask for a brand invite, your name, website, email and note. We keep the newest 500 requests, each for 12 months at most, or until you ask us to delete yours or delete an account you’ve confirmed with that address.
• Unsubscribes: our unsubscribe links are signed, so only the inbox that got the email can use them; the link includes your address. If you unsubscribe, we keep a scrambled form of your address and which kind of email you stopped, so we never send you that kind again.

Brands and collabs

If you set up your rate card, the brands on bubbleme can see your categories, location (city and country), rates, reach, audience figures and past work in Discover, unless you hide it. Your private minimum rate is never shown. We record which brands viewed your profile and when, and show you how many; on bubble+, which brands and when. If our team checks your follower numbers, we keep the numbers, a note and who checked (the last 20 checks) until you delete your account. When you and a brand talk, we keep the collab request, offers, agreed terms, submissions and messages so both of you can see them. If you delete your account, we replace your name with “Deleted creator” but keep the thread for the brand, because it’s their record too.

Turning on your rate card shows it to brands on bubbleme, including brands that pay us. You can hide it any time. You need to be 18 or older to work with brands on bubbleme.

If you share your live media kit, anyone with its link can see the numbers you choose for it: follower counts, your bubble’s visits and link taps, your top links, the countries your visitors are in (only once you have 100 visits, and only countries with at least 10 visits and 5% of them) and your rates. These are totals, never anything about one visitor. Until you share it, only you can see it, and you can switch it off any time.

Collab results. After a collab is done, you can choose to share your bubble’s visit and tap totals for the days it ran with that brand. Nothing is shared unless you tap Share, and once shared the totals stay in that collab’s thread for both of you. To take shared results back out, email us.

Results cards. After a collab is done, you can make a results card: a page and a picture that anyone with its link can see, showing you, the brand, what you made and, only if you choose, links to the posts and numbers you type in yourself, labelled as self-reported. The brand sees the link too. Take it down any time and the link stops working. Deleting your account takes it down and deletes those numbers.

Businesses. A business’s bubble (its hours, address, menu and the rest) is public, like any bubble, and we count its visits and taps the same way, without storing who visited. A map on it loads from Google only when a visitor taps Show map. To confirm a business is theirs, an owner can give us an address at their website’s domain (we send a code to it and keep the address only until the code is used or runs out after 15 minutes), add a record to their domain, or give us the business’s phone number, ABN and a link to its public listing so we can call. We keep those until we’ve decided, 60 days at most, then delete them; we keep only how the business was confirmed and which domain. Once a week we email a business’s owner a summary of their hours and visits, and on business+ a monthly report; they can stop either at any time. The Wi-Fi card in QR & print is drawn in your browser: the network name and password are never sent to us.

Previews we make for a business. Before a business joins, we may make a sample bubble from its public details (name, address, phone, Instagram and a photo) to show the owner. It goes after 30 days, or 30 days after the owner takes it over.

Link tags. If a creator switches on link tags (off unless they do), a link on their bubble opens with utm_source=bubbleme, utm_medium=link_in_bio and a campaign name added to its address when a visitor taps it, so the site they land on can see the visit came from that bubble. Nothing else is added or shared, there are no pixels or third-party trackers, and links that already have tags, email and phone links and links to bubbleme are left alone. We count the taps for each campaign name in the creator’s stats, without storing who tapped.

Brand accounts. We keep the brand’s name, logo, website, location, team members’ emails and roles, campaigns and collab threads. Creators on bubble+ can see that your brand viewed their profile, and when. Brand owners can download the brand’s data and delete the brand in the app; team members can leave a team or delete their own login. You can also email hello@bubbleme.bio to get a copy of your data or delete your account; we’ll do it within 30 days.

People who comment on Instagram

If a creator switches on comment to DM, Instagram tells us about new comments on that creator’s posts: the comment, its id, and the commenter’s Instagram username and an id Instagram makes for bubbleme. We read the comment only to check it for the creator’s keywords and don’t keep its words or the username. When it matches, Instagram delivers one message from the creator’s account with a link from their bubble, and, if the creator set one up, a public reply under the comment. To send at most one message per comment and per person, we keep the comment id for 8 days and a one-way scrambled code made from the commenter’s id (it can’t be turned back into the id) until the creator removes that keyword reply or disconnects. Taps on the link are counted like taps on a bubble, without storing who tapped. We send these messages for the creator, who chose to send them; each one ends “Reply STOP to stop these”. Instagram also tells us about messages people send that creator, so a message that’s just STOP or START is heard; unless the creator set up a DM keyword reply, we look at nothing else in them and keep nothing of them. If you message just STOP (or STOP ALL, UNSUBSCRIBE, OPT OUT, CANCEL, END or QUIT), we keep a one-way scrambled code made from your id, with that Instagram account rather than the creator’s bubble, so you get no more automatic messages from it even if the creator disconnects and connects again. It goes when you send START (or UNSTOP or OPT IN), or 12 months after the last STOP anyone sent that account. You can also block or report the account on Instagram.

People who message a creator on Instagram. While a creator has Instagram connected for comment to DM, Instagram also tells us about messages people send that creator: the message, its id, and the sender’s id Instagram makes for bubbleme. We read each message only to check it for STOP or START and, while the creator has a DM or story keyword reply on, for their keywords. We don’t keep its words. When it matches, we keep the sender’s id only until the one reply goes, two days at most, and the message id for 8 days so it’s never answered twice. If someone messages just STOP, they get no more automatic messages from that creator, as described above.

Data from Google

When you connect YouTube or sign in with Google, we use what Google gives us only for what this policy describes: confirming your channel and its subscriber count, showing your newest videos in a Latest posts block, and signing you in. We don’t sell it or use it for ads.

bubbleme’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Connecting YouTube uses YouTube API Services, so the YouTube Terms of Service and the Google Privacy Policy also apply. You can disconnect YouTube in Settings, or remove bubbleme’s access at any time on Google’s third-party access page.

Search engines

Published bubbles are in our sitemap, so search engines can list them with your name, picture and handle. When a public bubble goes live, changes or is removed, our servers may also tell search engines through IndexNow (api.indexnow.org) the bubble’s public web address, so results stay up to date. No visitor or account details are sent. You can ask search engines not to list your bubble in Settings, then Visibility.

Link previews. When a bubble’s link is shared, apps show a preview picture we draw from its name, photo, handle and look. It’s public, like the bubble. Our CDN may keep a copy for up to 8 days after a change or deletion, and the app that showed the preview may keep its own copy under its own policy.

Links you add. When you paste a link in the editor, or use Check my links, our server visits that address to read the page’s title and preview picture, or to check it still opens. The site sees a visit from our server, not from you or your visitors. We keep the title and picture address for a day, and the result of a check for up to 6 hours, under a scrambled form of the address and not with your account.

Unsafe links. Once a day we download public lists of phishing and malware addresses (from sources such as OpenPhish, PhishTank and URLhaus); nothing about you or your bubble is sent to them. We check links against those lists when you save or publish, and when a bubble is shown. A listed link can’t be added, and on a live bubble it’s switched off for visitors. Our team then sees the bubble’s handle, how many links matched and the sites they point to, until the link is gone or the account is deleted.

Visitors to bubbles

When you visit a bubble we don’t set a cookie to count you. So that one visit counts once, we use a scrambled form of your IP address and browser type, made with our secret key and the date, so it changes every day. It can’t be turned back into your address, it can’t link today’s visit to yesterday’s, and we delete it within two days. If you pop a bubble, we also set a one-day cookie (bm_pt) that stops fake pops. The “made with bubbleme” link names the bubble it’s on in its address and sets nothing; our home page keeps that name in your browser tab until you close it, so it can go with an invite request or a sign-up. Separately, like every request to bubbleme, opening a bubble counts towards a short rate limit kept by IP address, which deletes itself within a minute (see Keeping it safe).

Embedded videos and music (YouTube, Vimeo, TikTok, Spotify, SoundCloud, Apple Music) load only when you press play. A creator can also turn on a muted preview for a YouTube video: it plays without sound while the video is on screen, but only after you’ve first tapped, clicked or pressed a key on that bubble. Once a player or preview loads, that provider receives your IP address and may set its own cookies under its own privacy policy.

Until then, a bubble contacts only bubbleme: the fonts and video previews come from us. The other times it contacts someone else are:

• A Now playing card loads the song’s artwork from Apple.
• On Apple devices, your browser may confirm with Apple that it’s a real device before you pop a bubble. Apple doesn’t tell us who you are, and we don’t tell Apple which bubble.
• A map loads from Google only when you tap Show map.

Reports. If you report a bubble we keep your reason and note, but not your IP address (we keep a scrambled form of your email or IP address for 24 hours so one person can’t report the same bubble over and over). Like every form on bubbleme, the report form also counts how many reports come from your IP address in an hour, to stop floods; that count holds the address itself and deletes itself after the hour. Your name and email are optional for most reports. Copyright, trademark, defamation and “this is my business” reports need both: we pass your name to the bubble’s owner with the complaint, and we may need to ask you questions. We use your email only to deal with the report, and keep it with the report record. We don’t give it to the bubble’s owner unless you say we can.

Messages to us. If you write to us from Help, we keep your email, the topic, your message, our replies and, if you’re signed in, which account sent it. We use them only to answer you and to look back at how a problem was sorted. A person on our team reads them and sends every reply. The note that says we got your message is sent automatically.

Paying for a plan. When you buy bubble+ or business+, Stripe runs checkout in a secure form inside bubbleme, and billing on its own pages. Your card details go to Stripe, never to us. To spot fraud, Stripe also collects details about your device and connection while you pay. We keep the customer and subscription ids Stripe gives us, and the date your plan is paid up to. Stripe keeps its own payment records, which the law requires it to hold for a number of years. Deleting your account cancels the subscription straight away, and time you’ve already paid for isn’t refunded, except where the law requires it. While an account is suspended, its billing is paused.

Your own address. If you connect an address you own to your bubble, we keep the address and look up its public DNS records to confirm it’s yours. Our host (Vercel) issues its security certificate. Removing it, or deleting your account, disconnects it.

When something breaks. If one of our scripts hits an error on your screen, your browser sends us the error message, the file and line it happened on, the address of the page and your browser’s family (for example “Safari on iPhone”). It doesn’t include a cookie, your IP address or anything you typed, and we mask anything in the message that looks like an email or a code. We keep it, grouped with the same error from other people, for 30 days so we can fix it. Errors on our servers are logged the same way; we keep the last 200.

Don’t count my visits. If you’d rather your visits weren’t counted in any creator’s statistics, you can turn that off for this browser. It sets a first-party cookie (bm_optout) that tells us to skip you. It works on bubbleme.bio, not on a creator’s own address, and it covers visits and taps on bubbles: scans of a business’s QR codes, opens of a review link and taps on a Comment to DM link are still counted, without storing who.

Cookies and storage

We don’t use advertising or analytics cookies, ours or anyone else’s, so there’s no cookie banner to click through. These are the cookies and browser storage bubbleme uses, each one needed for something you asked for:

Players from YouTube, Vimeo, TikTok, Spotify, SoundCloud and Apple Music may set their own cookies, but only after you press play.

How we collect it

Most of it comes from you, when you sign up, build your bubble or use a feature. Visit counts come from people’s browsers when they open a bubble. If someone comments on a creator’s Instagram post with comment to DM switched on, Instagram sends us that comment as described above. If you connect Apple Music, Instagram, YouTube or TikTok, or sign in with Apple or Google, we get the details listed above from that service. If a creator connects Mailchimp, Kit, Klaviyo, Beehiiv or Flodesk, we read which addresses on that list have unsubscribed there, so we can take them off the creator’s list here too. If you connect a store, add a Latest posts feed or move in from another link in bio, we read those public pages or feeds. If someone reports a bubble or a business asks us to check its confirmation, we get what they send us. We don’t buy personal information or get it from data brokers.

Why we collect it

• To create and run your account and show your bubble.
• To keep accounts secure and stop misuse.
• To show you how your bubble is doing.
• To let brands and creators find each other and work together, if you choose to.
• To handle reports and keep bubbleme safe.
• To send account emails you need; collab updates, the weekly email and the monthly report, which you can turn off; and notifications, if you turn them on. Other emails about bubbleme go only to people who asked for them (like the email when paid plans open), to tell you about a reward you’ve earned (like a friend invite), or as an invite you asked for. Each has an unsubscribe link.
• To send the updates creators write to their subscribers, on the creator’s behalf, and to pass new subscribers to a creator’s own email tool if they connect one.
• To send the Instagram messages and replies a creator sets up with comment to DM, on the creator’s behalf.
• To improve bubbleme, using the totals described above, and a few counts for each bubble and account: whether it got a visit this week, when it first published and first got a visit, and which looks, blocks and features it uses. We count what a bubble or account does, never who visits it: no cookies, no pixels and no visitor IP addresses are used for this, and we don’t follow anyone from one bubble to another.

We don’t sell personal information and we don’t show ads.

Decisions made by computer. Our software makes these decisions on its own, without a person looking first. Each uses only the information named with it:

• counting a visit once, and filtering fake pops: a scrambled form of the visitor’s IP address and browser type, and the pop cookie;
• slowing down or blocking too many requests, for example sign-ups, sign-ins, reports and messages from one connection: the IP address, a browser cookie and a scrambled form of the email address;
• refusing a link that’s on a list of unsafe sites, and switching it off on a live bubble: the links on the bubble (see Unsafe links);
• whether a card payment goes through: Stripe checks it for fraud, using the card and device details it collects;
• moving a plan to Free when every retry of a payment has failed: the plan and what Stripe tells us about the payment;
• the order of Discover: the categories, reach, rates and engagement on a creator’s rate card, depending on how a brand sorts;
• matching Instagram comments and messages to a creator’s comment-to-DM keywords: the comment or message and the id Instagram gives its sender;
• the suggestions in your weekly email and health check: your bubble and its statistics;
• hiding a bubble for a short time after an urgent safety report, until a person decides: the report and the bubble it’s about.

If one of them affects you and you think it’s wrong, email hello@bubbleme.bio and a person will look at it.

Reports, support messages, appeals, Official bubble requests and business confirmations are decided by a person on our team. For an urgent safety report (for example child safety, intimate images, violence, self-harm, a scam or someone’s private details) we may hide a bubble for a short time while a person looks. That is a temporary step, not our final decision, and the owner is emailed that it’s temporary. If no person has decided within 72 hours, it shows again at our next daily check (so at most about four days), and the report goes to the top of our queue with an alert. A person on our team makes every final decision, such as taking a bubble down or suspending or deleting an account, and sends every reply. A report that someone is under 18 is only ever decided by a person. You’re told what was decided and why. You can appeal any decision about your account, and our team looks at it again. Because our team is small, the person who looks again may be the one who made the first decision; they wait at least 24 hours first, look at it afresh and write down what they checked. When we have a second reviewer, someone who wasn’t part of the first decision will decide it.

Newsletter emails creators collect

When a visitor subscribes on a creator’s bubble, the creator collects that email address and is responsible for how they use it, including following anti-spam law (in Australia, the Spam Act 2003) and offering a way to unsubscribe. We keep it on the creator’s behalf, with a record of when and where the visitor agreed. Every subscriber can unsubscribe with the link we give them, and can ask the creator, or us, to remove their address.

Creators can write to their subscribers through bubbleme. We send each update on the creator’s behalf, from “their name via bubbleme”, with that subscriber’s own unsubscribe link. If the creator has put an email address on their bubble’s contact card, replies go straight to that address. Otherwise replies come to bubbleme, not to the creator, and the email says how to reach them. We keep the update and the list it went to only while it sends (at most 14 days), and the subject and date of the creator’s last 20 updates so they can see what they sent.

A creator can connect their own email tool: Mailchimp, Kit, Klaviyo, or a web address they choose, such as Zapier or Make. We then send that tool each confirmed subscriber’s email address and, where the tool accepts them, when they signed up and confirmed and the wording they agreed to (a web address also gets the bubble’s handle), on the creator’s behalf. Only people who confirmed their sign-up are sent. From then on the tool keeps that copy under the creator’s account and its own privacy policy. When a subscriber unsubscribes through bubbleme, we tell the tool; when they unsubscribe in Mailchimp, Kit or Klaviyo, we take them off the creator’s list here too.

Messages visitors leave on a bubble

A creator or business can set a contact block on their bubble to save messages to bubbleme instead of opening your email app. If you write through one, we keep your name (optional), your email address and your message, with the time and which block it came from, and show them to that bubble’s owner (for a business, its team) so they can reply to you by email. Your email address isn’t shown on the bubble. The owner is responsible for how they use what you send, as they would be for an email.

To limit spam we briefly count messages per scrambled IP address and per email address (for at most one day), and an owner can mark a message as spam: later messages from that address then go to their Spam folder. An owner can also block a sender’s address: we keep a scrambled form of it and a partly hidden copy (such as j•••@example.com) so the owner can see and unblock it, and we drop later messages from that address. An owner can also send a message to us as spam, and a person on our team looks at it. We tell the owner a message arrived by email or a phone notification. The email leaves out any links in your message.

The owner can archive or delete a message at any time. Otherwise we keep it for 12 months (messages marked as spam, 30 days), and it goes when the owner deletes their account or business. To have a message removed sooner, ask the owner, or write to us at hello@bubbleme.bio.

Keeping it safe

Passwords are stored only as a one-way scramble, connections to bubbleme are encrypted, and access to the database is limited to the app and the people who run bubbleme. If a data breach is likely to cause you serious harm, we’ll tell you and the Office of the Australian Information Commissioner, following the Notifiable Data Breaches scheme.

Our host, Vercel, keeps a short log of requests to bubbleme (including the IP address, the browser and the address requested, such as an unsubscribe link) and of errors on our servers, to keep the service running and secure. It keeps them for a short time set by our plan with Vercel, and we don’t use them for statistics.

Rate limits. To stop floods, spam and password guessing, we count requests to bubbleme by IP address (for newer IPv6 addresses, by the network they belong to). These counts hold the address itself, not a scrambled form. Each one deletes itself when its time is up: a minute for opening bubbles, and 15 minutes, an hour or a day for things like sign-ins, sign-ups, reports and contact forms. We use them only to slow down or block too many requests.

Who at bubbleme can see your data

The people who run bubbleme use an admin console to run invites, handle reports and fix accounts. Every admin action is logged.

Where it’s kept

We use these service providers. Our database (Upstash) may be held in the United States. Our app runs on Vercel’s servers in the United States, and uploaded files are kept by Vercel, which may hold them in the United States, so your data may be stored or pass through there while you use bubbleme. Resend, Stripe and Anthropic hold their part in the United States. Apple, Google, Meta, Mailchimp, Kit, Klaviyo, Beehiiv, Flodesk and Shopify are based in the United States, and TikTok outside Australia; each may hold data there or in other countries.

Where a provider handles information for us, we use its data processing terms, which require it to protect personal information and use it only to provide its service to us. Some providers, marked above, also act for themselves under their own privacy policies. We take reasonable steps to make sure providers handle it consistently with the Australian Privacy Principles, and we remain accountable for how they handle it.

How long we keep it

Your choices and rights

• Access and export: download your account, bubble, versions, statistics, sign-ups, messages left on your bubble, rate card, connected tools, collab threads and the other records we keep about you (such as Official and invite requests) any time from Settings, then Your data. Our decisions and appeals about your account, and the counts we use to improve bubbleme, aren’t in the download. Email us for those, or for anything else, and we’ll send it within 30 days.
• Correction: change your bubble, handle, email and password in the app. To correct anything else we hold about you, email us. If we can’t give you access to something or correct it, we’ll tell you why in writing and how to complain.
• Deletion: delete your account in Settings, in the app or on the web at bubbleme.bio/app/settings (no app needed). If you can’t sign in, email us from the address on your account and we’ll delete it within 30 days. Deleting removes your account, bubble, uploads, statistics, sign-ups, messages left on your bubble, passkeys and Apple or Google sign-in straight away (we also tell Apple to end bubbleme’s access), and cancels any paid plan. Collab threads stay for the brand, with your name replaced. Messages you sent us from Help are deleted with your account. A few records stay because we need them: reports about your account and reports you made, our decisions with a copy of what the bubble showed, and any appeal (about 13 months); a scrambled copy of your email if you unsubscribed from our emails, or took up a free trial or offer (3 years); and, for 30 days, a scrambled copy of your email that lets only you take your handle back. Emails you sent to our inboxes stay there until we delete them. Stripe keeps its own payment records. If our file storage can’t be reached at that moment, we try again each day until your files are gone. Smaller copies of photos kept in Vercel Blob are deleted within 30 days of being made. Copies of your pictures already saved in visitors’ browsers can take up to a year to clear, and our CDN’s a few days. If we delete an account or a business for breaking our Terms, its data is deleted the same way, and we keep our decision and the reasons for about 13 months.
• Search engines: turn this off in Settings, then Visibility.
• Emails: choose every message, once a day or never for collab emails, and for emails about messages left on your bubble, in Settings. Turn off the weekly email in Settings, a business’s weekly check-in and monthly report in Business settings, and emails about new creators in Discover, or use the unsubscribe link in any of them.
• Notifications: turn them off in Settings (a business: in Business settings), in your browser’s settings, or in your phone’s settings for the bubbleme app.
• Subscribers: anyone who signed up on a bubble can unsubscribe with the link in any update, or ask us to remove their address.
• Now playing: disconnect Apple Music in the block’s settings any time. We delete the sign-in and the songs we kept straight away.
• Connected accounts: disconnect any in Settings. We delete the sign-in straight away, and your follower count goes back to self-reported.
• Email tool: disconnect it in Settings any time. We delete the key straight away. Addresses already sent stay in your tool until you remove them there.
• Comment to DM: disconnect it in Settings or on the Comment to DM screen, or remove bubbleme from your Instagram settings. We delete the sign-in, your keyword replies and their totals straight away. A deletion request made through Instagram does the same.
• Questions or complaints: email hello@bubbleme.bio, including if you think we’ve breached the Australian Privacy Principles. A person on our team looks into it and replies within 30 days with what we found and what we’ll do. If you’re not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

If you’re in the UK

We don’t offer bubbleme in the European Union or the European Economic Area. If you’re in the United Kingdom, the UK GDPR applies to what we hold about you. To have an account you need to give an email address and a password, or sign in with Apple or Google; everything else is up to you. We rely on: contract (to run your account and bubble), legitimate interests (security, abuse prevention, aggregate statistics, improving bubbleme; you can object), consent (newsletter sign-ups collected for creators, and notifications; you can withdraw it), and legal obligation. You can ask to access, correct, delete, restrict or port your data, and object to processing based on legitimate interests. Your data goes to Australia, where we are, and to our providers in the United States under the UK Extension to the EU–US Data Privacy Framework or standard contractual clauses with the UK Addendum. To use these rights, write to us at hello@bubbleme.bio. You can also complain to the Information Commissioner’s Office (ico.org.uk).

Age

bubbleme is for people aged 18 and over. Everyone confirms their age when they sign up. If we learn that someone under 18 has an account, we close it and delete their data.

Changes

If we change this policy we’ll update the date at the top, and tell account holders by email about significant changes, before they take effect. When a change matters, we’ll also ask you to accept the new version the next time you use bubbleme while signed in.