Bubbly Thoughts — Washington Consumer Health Data Privacy Policy

Last updated: 7 August 2026 Applies to: Washington State residents, under the My Health My Data Act (RCW 19.373). Who this is from: Yehuda Green, operating Bubbly Thoughts as an individual, based in Miami, Florida, United States. Contact: mindorb.app@gmail.com

1. What consumer health data we collect

Bubbly is a journalling app. You speak or type a thought and it is saved and organised. It does not ask you for health information.

Because you can say anything to it, some of what you save may nonetheless identify your past, present or future physical or mental health status. We treat the following as consumer health data:

The words of any thought you save that concerns your own health — a symptom, a condition, a medication, an appointment, a treatment, or how you are feeling mentally or physically.
Words that indicate a mental health status, including anything the app's crisis detection matches — for example a thought expressing that you want to hurt yourself. We treat these as consumer health data as a matter of policy, and we do not rely on the argument that you did not label them as health information.
Any deadline, reminder or location you attach to such a thought.
The audio recording of such a thought, if you have turned on Keep Recordings (off by default).

About other people. Bubbly is a journal, so what you write may mention someone else's health as easily as your own. We do not ask for that and the app has no way to tell whose health a sentence is about — but it is collected, stored and (if you use an AI feature) sent, exactly like the rest of the thought. If you are not a Bubbly user and believe something about you is held here, write to mindorb.app@gmail.com and we will find it and delete it.

2. Where it comes from

Consumer health data covered by this policy is collected directly from you, when you speak or type a thought into Bubbly, or attach a date or a location to one.

We do not buy, licence or scrape consumer health data from any third party, and we do not receive it from data brokers, advertisers or analytics providers.

3. Why we collect and use it

To save your thought and show it back to you.
To organise it — work out what it is about and where it belongs among your other thoughts.
To answer questions you ask about your own saved thoughts.
To remind you about something you asked to be reminded about.
To show you crisis helpline information, when the app detects language suggesting you may be in danger. This detection happens on your device.

We do not use it for advertising, profiling, scoring, or any decision about you.

4. What is shared, and with whom

Categories of consumer health data shared:

The words of a thought, and where a question is asked, an index of your other saved thoughts.
The audio recording, whenever you speak rather than type — turning speech into words happens entirely on your phone, so the recording itself is not sent.
A photograph of notes, if you import one that way.
A short summary of what the app has learnt from your corrections — words you use often, your recent renames, and words the transcription has got wrong for you before — which travels with each thought so it is filed the way you have shown you want it filed.

Categories of recipients:

Recipient	Role	What they receive
~~Google (Gemini API)~~	Removed 18 September 2026. Until that date this row said Google organised thoughts and answered questions on the free tier of the Gemini API. None of it is sent any more, and the app is built so it cannot be.	—
~~Google (Places)~~	Removed 18 September 2026. Until that date, tapping Directions or Call sent a search to Google Places through our Worker. It now goes from your phone directly to Apple Maps, and Google receives nothing.	—
Supabase	Processor — stores your account and syncs your data	Everything you have saved, but only if you choose to sign in
Expo	Checks whether an app update is waiting	Your IP address and app version on launch. Never any thought content.
Cloudflare	Processor — runs the Worker that handles sign-in, sync, and support messages	Your account data in transit if you sign in or sync; a support message if you send one. We do not write thought content into its logs.
RevenueCat	Processor — manages Bubbly+ subscriptions	Your Bubbly account id and the subscription state Apple reports, if you buy or start Bubbly+. Never your card — Apple holds that.
Web3Forms or Resend	Delivers a feedback/support message to our inbox	Whichever one is configured; only one is used at a time, and neither receives anything else.
Apple	Processor — turns a coordinate into a place name if you attach a location; the Directions/Call place search now goes directly to Apple Maps. Turning your voice into words happens on your phone using Apple's on-device Speech framework; no recording is sent to Apple	The coordinate attached to a thought when you open it, and that bubble's words for a Directions/Call search. Never the audio recording.

A note on Cloudflare. Our Worker runs on Cloudflare's network. When you sign in or sync, it has to read your account data in readable form to pass it to Supabase; when you send a support message, the same is true of that message. It is therefore a processor of that content, not merely a pipe carrying it. We do not write thought content into its logs, and since 18 September 2026 nothing about a thought's own words passes through it for AI purposes at all — that ended with Gemini.

Two things are never shared with anyone:

Crisis-detected thoughts are never sent to the AI. Detection happens on your device. If you are signed in, the thought is backed up to your own account like any other thought, but it is never sent to be sorted or filed. One honest limit: if you *spoke* it, the recording had already gone to be turned into words before the app could recognise anything.
Nothing at all is shared if you do not sign in and do not consent to AI features. Both are off until you choose them.

We do not share consumer health data with affiliates, because there are none. We do not share it with advertisers, data brokers, or law enforcement absent a valid legal demand.

5. Your rights under this Act

If you are a Washington resident, you have the right to:

Confirm whether we are collecting, sharing or selling your consumer health data, and access it, including a list of everyone it has been shared with.
Withdraw your consent to our collection and sharing of it.
Have it deleted from our systems, and to have us notify our processors and any other recipients of your deletion request. Two honest limits: our hosting provider keeps point-in-time backups we cannot selectively purge, so a deleted item can persist there for a short recovery window; and what we can do about a recipient's own copy is instruct them, not reach into their systems.
Not be discriminated against for exercising any of these rights.

We do not sell consumer health data, so no authorisation to sell is sought or required.

6. How to exercise them

In the app: everything below is reached from Settings, in different places — read and export your data (Settings › Your Data › Export Your Data), delete a single thought (open it and use Delete on that thought's own card), delete everything at once (Settings › Danger Zone › Start Fresh), and turn AI features off (Settings › Privacy & Security › AI Filing & Search), which withdraws that consent immediately.

By email: mindorb.app@gmail.com, with "Washington consumer health data" in the subject line.

We will respond to your request within 45 days. Where reasonably necessary we may extend that period once by a further 45 days, and we will tell you why.

If we refuse, we will tell you why and how to appeal. To appeal, reply to that message with "Appeal" in the subject. We will decide the appeal within 45 days and explain the outcome in writing. If the appeal is denied, you may complain to the Washington Attorney General at www.atg.wa.gov/file-complaint.

*This policy covers only consumer health data and only Washington residents. Everything else about how Bubbly handles your information is in the general Privacy Policy.*