Privacy Notice

1. Who is responsible for your data

The final legal operator, registered address, company identifiers, privacy contact and competent jurisdiction have not yet been supplied. They must appear here before MyBubble accepts public registrations.

MyBubble is the product name. Technical providers act only in roles defined by the final agreements and privacy review; their involvement does not replace the operator's responsibility to explain processing clearly.

2. Data MyBubble expects to process

The service is designed to process only information needed to provide, secure and improve the requested experience.

• Account and authentication data, including email address, user identifier, locale and session/security metadata.
• Bubbles and originals: notes, images, PDFs, filenames or storage paths, extracted text, summaries, facts, dates, amounts, people or organizations visible in the source, corrections, tags and suggested or accepted actions.
• Reminders and notification data, including time zone, locale, device installation identifier, push token, delivery state and the limited context needed to open the right Bubble.
• Questions, grounded answers and source references when you explicitly use Ask or meaning-based search.
• Preferences, tone, personalization choices, repeated confirmed behavior and optional analytics consent history.
• Plan, entitlement and usage records, future billing-event references, exports, deletion requests and content-free operational audit records.
• Support correspondence and diagnostic details you choose to provide. Do not send passwords, recovery codes or unnecessary sensitive source content.

3. Why data is processed

Expected purposes include creating and protecting your account; saving and displaying your Bubbles; extracting meaning you requested; providing search, questions, reminders and notifications; applying your corrections and preferences; enforcing allowances; exporting or deleting data; preventing abuse; diagnosing failures; and meeting legal obligations.

The precise legal basis for each purpose is not final. Processing needed to provide and secure the service should not be presented as optional consent. Optional product analytics is designed as a separate choice and must stay off unless you grant it.

4. Automated processing and providers

MyBubble may send the minimum context needed for a requested operation to an automated-processing provider. Repository code is designed to request non-persistent provider responses and to remove temporary uploaded PDF files on a best-effort basis, but final claims about provider retention, training and processing locations require current contractual verification.

Supabase is expected to provide authentication, database, file storage and server functions. OpenAI is currently represented in repository code for document and grounded-language processing. Expo push services and Android/Firebase infrastructure may participate in mobile notification delivery. Final provider names, roles, locations and safeguards must match deployed reality at release.

5. Sharing and external consequences

MyBubble is private by default. It is not designed to sell personal data or use it for advertising. A final Privacy Notice must confirm that operational practice and provider contracts support this promise.

MyBubble does not silently send your email, submit forms, make purchases, book services or take other external consequential actions. If future functionality changes who receives data, this notice and the product confirmation flow must be updated first.

6. Retention

Bubbles and originals are expected to remain while your account needs them, until you delete a Bubble or request account deletion, subject to a final backup, legal-hold and recovery policy. Existing repository contracts include shorter-lived request caches and export links plus longer content-free audit records, but there is not yet one counsel-approved retention schedule.

Final periods for active content, backups, failed uploads, provider files, support messages, analytics, billing records, exports, deletion tombstones and account-recovery windows must be listed before public release.

7. Your choices and rights

Subject to applicable law and verified identity, the service is intended to support access, correction, portability/export, objection or restriction where applicable, withdrawal of optional consent, deletion and a complaint to the competent authority.

• Correct important title, deadline and amount information without silently changing the original.
• Enable, disable or reset learned personalization.
• Choose whether to allow optional product analytics.
• Request a portable export through the authenticated product flow.
• Delete individual Bubbles and initiate account deletion. The public web flow requires an authenticated account and defers request state and cancellation eligibility to the service.

8. Security

Repository design uses private storage, row-level authorization, owner-bound operations, short-lived signed links, service-only privileged functions and content-minimized telemetry. These controls reduce risk but no service can promise absolute security.

A public security contact, incident process, deployed-environment verification and final browser security headers are release requirements, not claims established by this draft.

9. Children, changes and contact

MyBubble is intended for adults and is not directed to children. The final age requirement and handling of an inadvertently created child account need legal confirmation.

Material changes should be explained before they take effect. A version and effective date will be added after review. Privacy questions must use the monitored contact published in this notice; it has not yet been supplied.