Bubbly Thoughts — Privacy Policy

This page describes what Bubbly actually does, checked against the code rather than against intention — and it is kept that way by machine. One check fails the build if this page and the in-app consent screen stop agreeing with each other; another fails it if the app ever regains a route to an AI company this page says it does not use. Nothing you say to Bubbly leaves your phone. It used to: until 18 September 2026 the words of every thought were sent to Google's Gemini to be filed, answered and untangled. That is over, and the app is now built so it cannot happen again.

Last updated: 18 September 2026 Who this is from: Yehuda Green, operating Bubbly Thoughts as an individual (no company or LLC), based in Miami, Florida, United States. Contact: mindorb.app@gmail.com

The short version

Bubbly holds the things you do not say out loud. That deserves plain language, so here it is.

• Your thoughts are stored on your phone. If you sign in, they are also stored on our server so they reach your other devices.
• Turning your voice into words happens entirely on your phone. Your voice recording is never sent anywhere. If your phone can't do it (an older device, or the feature is unavailable), Bubbly tells you plainly and you can type instead; it does not fall back to sending the recording anywhere.
• The thinking happens on your phone too, as of 18 September 2026. Working out where a thought belongs, reading a date out of it, naming it, answering questions about your own thoughts, untangling one, organising a pasted list, reading a photograph of your notes — all of it now runs on the device, using Apple's own model. Your words are no longer sent to Google, or to any AI company, for any of it. Bubbly used to send them to Google's Gemini; that is over, and the app is now built so it cannot.
• One thing still leaves when you ask it to. If you tap Directions or Call on a bubble, a search made from that bubble's words — and, for Call, your approximate location — goes to Apple's Maps service, under Apple's own privacy terms, because finding the nearest real address is not something a phone can do by itself. It happens on the tap and at no other time. That is the only thing.

• We do not sell anything, show ads, or build a profile of you for advertising or marketing. (Section 2 below describes a much narrower thing: a short summary of your own naming habits, used only to file your own thoughts the way you already file them — never shared, never sold, never used to target you with anything.)
• You can export everything, delete your account, and erase the app's memory of you, from inside the app.

The rest of this page is the detail.

1. What Bubbly holds, and where

On your phone

• Every thought: what you said, its name, where it sits, when you made it, any deadline.
• Thoughts you have let go of ("Old Bubbles").
• What the app has learnt from correcting you: the times you moved, renamed, merged or split a bubble, the words you use often, and words the transcription tends to get wrong for you. The record itself stays on your device. A small summary of it is sent with each thought you file — see §2, "What the app has learnt about you", which sets out exactly what that summary contains.

• Your settings.
• If you turn on Keep Recordings (off by default): the audio files themselves.
• If you turn on Attach Location (off by default): the latitude and longitude where a thought was captured.
• Audio waiting to be transcribed, when you had no signal. Deleted the moment it becomes words, and in any case after seven days.

Bubbly does not encrypt this separately from your phone. It relies on iOS's own protection, which means it is protected by your device passcode. If you turn on App Lock, Face ID or your passcode is also checked before the app opens — that check happens inside iOS and Bubbly never sees your face data or your passcode.

On our server, if you sign in

Signing in is optional and the app works fully without it. If you do sign in, we store, with our hosting provider Supabase:

• Your whole galaxy — every thought, its full text, its position in the tree, deadlines, Old Bubbles, and (if you turned it on) the location tags. This is stored as ordinary data, and it is not end-to-end encrypted: we can technically read it. No person here reads it. But we do run automated jobs over it — see "one thing that happens with no action from you at all" in §2, which explains exactly what those are.

• Other records tied to your account, kept in separate tables: your filing corrections and the memory built from them, suggestions a background job has prepared for you, the shadow log described in §2 (which can hold real text from your thoughts), notification candidates and preferences (including your timezone), activity entries that carry a bubble's own words, anything in a Shared Bubble you belong to, your Bubbly+ status, feedback you have sent, and operator records about your account such as usage and job history. The complete, machine-checked list — every store, what it holds, and what happens to it when you delete your account — is kept in the repository as `docs/user-data-inventory.json`, and is the authority if this paragraph and that file ever disagree.
• Your account: your email address, your username, and the sign-in method you used. Bubbly has no password of its own — you sign in with Google, Apple, or a one-tap emailed link — so there is no password for us or anyone else to hold, hashed or otherwise.

• Search "fingerprints" made before 15 September 2026 (lists of numbers, not words), which used to be generated in the cloud and stored here. They are being deleted. Since that date every fingerprint is made by Apple's own model on your phone and stored only on your phone — nothing is sent to make one, and there is deliberately no cloud fallback. See §2.

• Your corrections, if you're signed in — the times you moved, renamed, merged or split a bubble, and the words involved. Used, on a periodic pass, to fold your recent corrections into standing filing habits (see §2). Not sent if Learn From Corrections is off.
• Anything you share by link, for as long as the link lives (see §5).
• Shared Bubbles you create, join, or add to — a different, ongoing kind of sharing from the read-only link above, added 1 September 2026. See §5 for what this holds and who can see it; it is never stored on your device the way the rest of your galaxy is, and requires signing in on every side.

Your calendar — Bubbly has no access to it

Bubbly does not ask for calendar access and does not have it. It cannot read your calendar, and it cannot add anything to it on its own.

What it does instead: a thought you gave an actual time to has a Calendar button. Tapping it opens your phone's own new-event screen, run by iOS or Android rather than by Bubbly, with the title and time already filled in. You choose which calendar it goes in and whether to save it. Bubbly never sees that screen's contents, never learns which calendar you picked, and keeps no record of what you saved.

An earlier version of this feature worked differently — it kept its own "Bubbly" calendar and needed full calendar access to create it. That was removed on 19 August 2026 in favour of the approach above, which needs no permission at all. If you granted calendar access to an earlier build, you can revoke it; nothing in Bubbly uses it.

Your Reminders — a real permission, unlike Calendar above

This is different from Calendar, on purpose, and worth saying plainly. Adding a bubble to your Reminders app is a real permission: the first time you use it, iOS asks you directly whether Bubbly can access your Reminders, the same system prompt any app would show you. If you say yes, tapping the button writes the bubble's title, any extra detail, and its due date (if it has one) straight into your Reminders app — unlike Calendar, there is no second screen showing you the reminder before it saves; granting the permission is the only checkpoint. You choose to use this on a per-bubble basis; it never happens on its own. Nothing about this goes to our server or anywhere else — it is a direct write from your phone to Apple's own Reminders data, the same as any other app that asks for this permission. You can revoke it any time in iOS Settings › Bubbly › Reminders, the same as any other app.

Nowhere else

Bubbly has no advertising SDKs, no analytics SDKs, and no tracking. Beyond what's described above for Reminders, it does not read your contacts (it lets you pick ONE from the OS's own picker when you use Call — Bubbly never sees or stores the rest of your contacts), your photos library (beyond the single photo you pick), your health data, or anything else on your phone.

The one thing that happens without you doing anything is an update check on launch, which tells Expo your IP address and which version you are running. It carries nothing you have written. See §3.

2. What leaves your phone, exactly

This is the part most privacy policies are vague about, so it is set out in full.

This section used to be long. Until 18 September 2026 the words of every thought went to a server we run and from there to Google's Gemini. That has been removed — not switched off, removed: the app no longer contains a way to reach it, and the build is refused if one is ever added back.

What is left is short enough to state in one place. Your thoughts, your questions, your photographs of notes and your recordings do not leave your phone. The table below is everything that still does.

Feedback and support messages are delivered to our inbox by email; the server records only that one was sent, and how long it was, never what it said.

And one thing that happens with no action from you at all

Everything else in this section is a list of things you do. This part is not, and it belongs here for exactly that reason.

If you are signed in, your galaxy syncs to your account, and once a day our server runs a set of background jobs over that synced copy — tidying up, working out whether a notification is worth sending you, and similar housekeeping.

None of them send anything to an AI company any more. Until 18 September 2026, five of them did: your morning briefing was drafted before you opened the app, and jobs looking for loops and standing patterns read your galaxy and sent parts of it to Google's Gemini, on a schedule, whether or not you had opened Bubbly that day. Those five are switched off, and nothing in the app reads what they produced any longer.

If you are not signed in, none of this happens to you — nothing is synced, so there is no copy for a job to read. Deleting your account removes the synced copy these jobs run on.

What the app has learnt about you

Alongside the rows above, a short summary of what Bubbly has learnt from your corrections travels with each request, so the AI files things the way you have already shown it you want them filed. It is the only thing in this section that is not something you just said or wrote, which is why it has its own heading rather than a row.

The underlying record — every correction you have made, and when — stays on your phone always, and, if you are signed in, also goes to our server, tied to your account. Only while AI Filing & Search AND Learn From Corrections are both on. This is not the same as the per-request summary above: it is the raw record itself, kept so a periodic pass (not tied to any one capture) can fold your recent corrections into a handful of standing filing habits — the same kind of rule the on-device summary already states, just built from a longer history than one device can hold, and built for you specifically, not shared with or shown to anyone else. Each standing habit is kept for a limited time and re-derived from there forward, not accumulated forever. You can read the whole record — the device copy, the standing habits, and the server copy alike — and erase all of it in one place, in Settings › Privacy & Security › What It's Learned; erasing there reaches the server too, not just this device.

Two things are not sent:

• Nothing at all is sent until you use one of those features. Typing a thought and never asking anything about it means the words never leave, unless you are signed in — in which case they sync to your account, which is you, not a third party.
• If Bubbly recognises that you have said something about wanting to die or to hurt yourself, that thought is never sent to the AI to be sorted or filed. It stays as a plain bubble named by your phone. And a bubble Bubbly has recognised that way is never offered to the AI afterwards either — not as a place to file something else, not in the index behind a question, not when it works out what you have been avoiding, and not in anything it learns from your corrections.

One honest limit on that promise, because a limit you are not told about is not a promise:

• If you *spoke* it, the recording had already been sent to be transcribed before Bubbly could recognise anything. Recognition happens on the words that come back. Only the filing step is skipped.
• If you photograph a batch of notes, the photo itself is sent to be read before there is any text yet to recognise anything in. Once the words come back from that reading step, they are treated exactly like a paste (below) — checked before anything is organised.
• If you paste a batch of notes, it is split into paragraphs and each one is checked before any of it is sent to be organised. A paragraph that reads as being about wanting to die or hurt yourself is held back and kept as a plain bubble, the same as if you had spoken it — the rest of the paste is organised as normal. Existing crisis bubbles are still kept out of the destinations offered for filing, as they always were.

The live words on screen

While you speak, the words appear as you say them. That uses Apple's own speech recognition, and Bubbly requires it to run on your device. It is not a preference we set and let iOS override: if your phone cannot recognise speech locally for your language, the live words simply do not appear. The recording is still transcribed on your phone either way, so nothing is lost except the words-as-you-speak readout.

No audio is sent to Apple, or to us, or to anyone.

Your IP address

Any request to our Worker carries your IP address, as every internet request does. Cloudflare uses it to rate-limit abuse. We do not write it into our own server log.

3. Who else is involved

If you tap a crisis helpline, your phone dials or opens a link. Bubbly does not tell anyone you did, and does not record it.

What happened to Google, and what it means for you

Until 18 September 2026 this section was the most important part of this document, and it said something uncomfortable. Bubbly used the free tier of the Gemini API, and on the free tier Google's own terms say that what you send may be used to improve their products and train their AI models, and that their staff may read it. The honest advice that followed was: do not put anything into Bubbly that you would mind a stranger at Google reading.

That is over. Bubbly does not send your words to Google, or to any AI company, at all. The thinking moved onto your phone — Apple's own model, running on the device — and the ability to send anything to Gemini was removed from the app rather than switched off. A check runs on every release build and refuses it if any route to Gemini exists in the code.

Two things are worth being precise about, because a privacy claim that is nearly true is worse than none:

• A place lookup leaves, and only on your tap. If you use Directions or Call on a bubble, a search made from that bubble's words — and, for Call, your approximate location — goes to Apple's Maps service, under Apple's own privacy terms, to find the real nearest match. It goes from your phone to Apple, not through us: we never see it, and it is not a local lookup — Apple processes the search. Nothing reaches Google at all, and no lookup happens unless you press one of those two buttons.
• "Nothing leaves your phone" is not quite the right sentence, which is why we do not use it. Your thoughts do not. Your recordings never did. But if you sign in, your galaxy is stored on our server so it reaches your other devices — that is a backup, not an AI, and §1 describes it.

Nothing here is a promise about anybody else's security, only about what is sent and to whom. Apple, Supabase, RevenueCat and Cloudflare are third parties operating under their own terms; what we can tell you plainly is what reaches them, which is what the table above does.

If Bubbly ever moves onto the paid tier, this section changes first and the app's consent screen changes with it — before the change takes effect, as §11 requires. It would not be quietly left as written.

4. Why we process it, and your consent

• To provide the app you asked for — storing your thoughts, syncing them to your account, transcribing and filing what you say. We do this because it is the service you are using; there is no way to use Bubbly without it.
• Because your thoughts are likely to include health information — under laws like Washington's My Health My Data Act, what you write in Bubbly, including anything that reveals or lets someone infer something about your mental health, is treated as consumer health data. We ask for your explicit, affirmative consent — separately for collecting it and for sending it to our AI provider — before either happens. You give it through the consent screen the first time you use an AI feature; you withdraw it by turning that feature off in Settings, which stops your thoughts being sent to the AI without deleting your journal, or by deleting your account entirely if you want to stop everything.
• Optional extras — Keep Recordings, Attach Location, sending feedback — are opt-in, given by turning them on, withdrawn by turning them off.
• Keeping the service working and unabused — rate limiting, error logs. This is basic operational necessity, not something we ask separate permission for.

We do not use your thoughts for marketing, profiling, or automated decisions that have a legal effect on you. We do not sell your consumer health data, and we do not share it except as described in §3.

If you are in California

California residents have rights under the CCPA/CPRA to know what personal information we hold, to delete it, to correct it, and to opt out of the sale or sharing of personal information — we do not sell or share your information with third parties for their own advertising, so there is nothing to opt out of on that front, but you can still exercise the other rights through §6. Sensitive personal information (which your thoughts likely qualify as) is used only to provide the app, not for anything else.

If you are in Washington or Nevada

Washington's My Health My Data Act and Nevada's equivalent law give you specific rights over "consumer health data" — broadly, anything that reveals or lets someone infer something about your physical or mental health. You have the right to know whether we are collecting or sharing it, to access it, to have it deleted across all our systems, and to withdraw your consent at any time without losing access to the parts of Bubbly that do not depend on it. See §6.

5. Sharing

Bubbly has two different ways to share something, and they work differently enough that they get their own headings.

One bubble, by link

If you create a share link, that bubble and everything inside it is copied to our server. Your username is stored alongside it, so whoever opens it can see who sent it.

Opening a shared bubble does not require an account. The link goes to a plain web page — anyone who has it can read that thought and everything filed inside it, with no sign-in and no app install needed. That page also offers to download the app, but reading the shared bubble itself never requires that.

Because reading the link no longer needs a sign-in, treat the link itself as the whole protection: anyone who has it can read the bubble, including anyone it gets forwarded, screenshotted, or leaked to.

• Links stop working after 30 days.
• You can revoke a link at any time from inside the app, which deletes it.
• Anything you share is your responsibility, including anything in it about another person.

#### If someone shares a bubble with you

You can read a shared bubble on the web page the link opens without an account. Saving it into your own galaxy in the app still requires signing in — that step collects your email address and account id, the same as for anyone else who signs in, and you are told this at the sign-in step itself, not only here.

The person who sent you the link cannot agree to that on your behalf. If you would rather not have an account, you can still read what they shared on the web page; just don't sign in to save it. Nothing about your account is shared back with them beyond the fact that the link was opened.

Shared Bubbles — an ongoing, multi-person space

A Shared Bubble is different from the link above in a real way: it is not a one-time copy. Everyone in it can keep adding to it, and everyone in it sees what gets added, for as long as the bubble exists.

Signing in is required on both sides — the person who makes it, and everyone who joins it. Unlike the read-only link above, there is no sign-in-free web page for a Shared Bubble; opening the invite link and joining both happen inside the app, and both require an account.

What we store, with Supabase: the bubble's title; who owns it; each member's account id and when they joined (never their email or username — see "Who can see who's in it," below); and everything anyone adds to it — its words, any deadline, and whether it's been marked done. This is never copied onto your own device's local storage the way the rest of your galaxy is (§1) — it is fetched from our server each time you open the bubble, and only kept in the app's memory while you're looking at it.

What is not stored, or not shared. A voice recording used to add something to a Shared Bubble is transcribed the same way any recording is (§2, §3) but the audio file and any location tag stay on the device that made them — neither is copied into the shared bubble or seen by anyone else in it. Only the resulting text is shared.

Who can see who's in it. Anyone in a Shared Bubble can see how many other people are in it. The bubble's owner can additionally see, for each member, an anonymous entry — an account id and the date they joined, nothing else — and can remove a member from there. We do not show your email, username, or name to other members of a bubble you're in; this app does not otherwise have a way for one user to look another up, and Shared Bubbles does not change that.

Joining, leaving, and being removed.

• Joining requires an invite link from the bubble's owner. The link works for 30 days and for any number of people the owner sends it to, unless the owner revokes it sooner.
• You can leave a Shared Bubble at any time; anything you added stays for everyone still in it.
• The owner can remove anyone else from a Shared Bubble at any time.
• The owner can delete a Shared Bubble entirely. This removes it, and everything anyone ever added to it, for every member at once — a real deletion, not the recoverable "Let go" every ordinary bubble gets (§1), and there is no undo.
• Removing one thing you added, for yourself only, leaves it in place for everyone else. You (or the bubble's owner) can also remove one thing for everyone in the bubble, which is permanent for that one item.

Responsibility. The same as the link above: you are responsible for what you add to a Shared Bubble, including anything in it about another person — and now, because more than one person can add to the same space, that applies to everyone in it, not only whoever created it. Bubbly cannot see or moderate what gets added beyond what is described in this section.

6. Your rights

Wherever you are, you have the right to see your data, get a copy of it, have it deleted, and withdraw consent at any time. We apply these rights to everybody, not only where a specific state's law requires it.

Complaining to us

If you are unhappy with how we handle your data, tell us first — write to mindorb.app@gmail.com with "Data complaint" in the subject. We will respond within 45 days. Where reasonably necessary we may extend that once by a further 45 days, and we will tell you why.

If we say no, we will tell you why and how to appeal. To appeal, reply to that message with "Appeal" in the subject. We will decide the appeal within 45 days and explain the outcome in writing.

Complaining to a regulator

You can also complain to a regulator, whether or not you have come to us first.

• In the United States, you can contact the Federal Trade Commission (reportfraud.ftc.gov) about unfair or deceptive privacy practices, or your state Attorney General — for example, Washington's or Nevada's, if you believe your consumer health data rights under those states' laws have been violated, or California's, if you believe your CCPA rights have been violated.
• Bubbly is a US service, operated from Florida for users in the United States at this time. It is not currently offered to people in the UK or EU; if that changes, this section and the international-transfers section below need a UK/EU-specific rework before it does.

Someone acting on your behalf, and checking it is you

You can have someone else make a request for you — a lawyer, a family member, anyone you authorise. Send us written permission signed by you, or a power of attorney, along with the request.

We will check that a request is really from you before acting on it, because a deletion request honoured for the wrong person is the same harm as a breach. Usually that means replying from the email address on the account, which is enough on its own. If we cannot be reasonably sure, we will say what else we need rather than refuse quietly — and if we still cannot be sure, we will refuse rather than guess, and tell you why.

We will not ask you to create an account in order to make a request.

Doing it yourself, in the app

You do not have to ask us for most of it:

• Withdraw consent to AI processing — Settings › Privacy & Security › AI Filing & Search. Turning it off stops Bubbly filing, searching and untangling for you, and the microphone will not start. Nothing about that is to do with anything being sent anywhere — the AI runs on your phone and sends nothing, with or without this switch. The microphone stops because this app has no way to capture spoken words without also filing them, and filing is what you just turned off. Typing still works exactly as before — though if you are signed in a typed thought still syncs to your own account, which is a separate choice. It does not delete your journal, and nothing you have already captured is affected. See "The AI, and what it means right now" in Settings.

• See and copy it — Settings › Your Data › Export Your Data writes your thoughts, Old Bubbles, lists and share links to a single JSON file and hands it to your phone's share sheet. It leaves out what the app has learnt from correcting you and your app preferences — neither is a record of something you said, and the learning memory has its own screen to read and erase (Settings › Privacy & Security › What It's Learned).

• Delete an account — Settings › delete your account. It is soft-deleted first, with a short window to change your mind, and then permanently removed from our server.
• Erase locally — Start Fresh erases everything on the device, including any kept recordings.
• Make the app forget what it learnt — you can read everything Bubbly thinks it has learnt about you, and throw any of it out.
• Leave, remove, or delete a Shared Bubble — leave one you're in, or (if you own it) remove a member or delete the whole thing, all from the bubble's own card. See §5's Shared Bubbles section for what each of these actually does.

For anything else — including a request for your data in a form we do not offer, or to correct something — write to mindorb.app@gmail.com. We will respond within 45 days, on the same terms and with the same appeal route as above. One request method, one appeal method, one response period, wherever you happen to be reading — see also the Washington Consumer Health Data Privacy Policy, which uses the identical process.

Two honest limits:

1. Export produces a file; there is currently no import. You can take your data out and read it, but you cannot load it back into Bubbly, and we cannot send it to another service on your behalf. 2. Deletion reaches our systems directly, and the AI provider only through them. When you ask us to delete, we delete from our systems, and where the law requires it we direct our processors and any other recipients to delete it too. Some information may be held for a limited period where required or permitted by law, contract, security or backup requirements. We are honest about the limit: we control our own copy completely, and we can only *instruct* a processor about theirs.

Washington and Nevada residents have specific additional rights about health-related information, set out in their own documents: the Washington Consumer Health Data Privacy Policy and the Nevada Consumer Health Data Privacy Policy.

7. How long we keep things

• On your phone: until you erase it (from Old Bubbles, if you have let it go first) or delete the app. Letting go moves a thought into Old Bubbles — it is still held there, not removed, the same list described in §1 above.

• On our server, signed in: until you delete it or delete your account.
• Your corrections, on our server: the raw record for up to 30 days, by which point it has been folded into a standing filing habit or discarded as too thin to say anything real. A standing habit itself is kept up to 180 days and then re-derived from your more recent corrections, never left stale forever. Erasing in Settings › Privacy & Security › What It's Learned removes all of it immediately, on our server as well as your phone.
• A deleted account: removed after the 7-day grace period Settings itself states when you delete it. Not recoverable after that.
• Share links: 30 days, after which the server refuses to open them, and the stored copy is deleted by a job that runs every day. Revoking a link deletes its copy straight away, without waiting for that.

• Shared Bubble invite links: 30 days, after which the server refuses them, same enforcement as share links above and the same honest limit — the row itself is cleared out on the next scheduled purge, not the instant it expires. Revoking one from inside the app deletes it immediately.
• A Shared Bubble and what's in it: until its owner deletes it, or — item by item — until whoever added something removes it for everyone. Leaving a bubble, or being removed from one, does not delete anything that's in it; it stays for the members who remain.
• Audio: deleted as soon as it becomes words, unless you turned on Keep Recordings. Audio waiting for signal is deleted after seven days at the latest.
• Feedback messages: kept in our inbox until we clear them. Not kept on the server — only the fact that one was sent, and its length.
• At the AI provider: see §3.

8. Children

Bubbly is not for anyone under 18, and we do not knowingly collect anything from under-18s. This is not a formality: the AI provider's own terms forbid making the service available to people under 18, and the app is built for adult reflection.

If you believe a child has been using Bubbly, write to mindorb.app@gmail.com and we will delete the account and its contents.

9. Where your data goes in the world

Bubbly is operated from the United States, and our AI provider and our infrastructure are US-based. If you are using Bubbly from within the United States, your data generally is not leaving the country.

Bubbly is a US service for US users at this time. It is not currently offered to people in the UK or EU. If that changes, this section needs a full rework with each provider's actual certification status checked and cited before Bubbly is offered there — not a claimed safeguard that isn't actually in place.

10. Security, and what we cannot promise

We use HTTPS everywhere, our database enforces row-level security so one account cannot read another's, and Bubbly has no password of its own to store — see §1.

What we will not claim: Bubbly is not end-to-end encrypted. Your thoughts sit on our server in a form we could read if we chose to. We have chosen not to build anything that does, and we would rather say so plainly than imply a protection that is not there.

If something goes wrong, we will tell you

If we discover that your data has been accessed by someone who should not have it, we will tell you without unreasonable delay, and in any event within 30 days of confirming it. That message will say what we know: what was taken, when, what we have done about it, and what you can do. We will tell you even where the law would not strictly require it — including when we are not certain, in which case we will say that too.

We will also notify the authorities the law requires us to, in the states and countries where affected people live.

We will not wait to have a complete picture before telling you. A first message that says "this is what we know so far" is more use to you than a tidy one three weeks later.

11. If this changes

If what Bubbly collects or who it shares with changes, this page changes first, and the app will say so before the change takes effect.

12. Not a health service

Bubbly is a notebook. It is not therapy, not medical advice, and not a crisis service.

If you say something that sounds like you might be in danger, Bubbly offers you phone numbers. That is all it does — it does not contact anybody, it does not alert anyone, and nobody is watching. If you are in danger, call emergency services. See the Terms for more on this.