Privacy Policy

1. Who we are

safeBubble is operated by SAFEBUBBLE (UEN 53526788J), a business registered in Singapore, with its principal place of business at 60 Paya Lebar Road, #06-28, Paya Lebar Square, Singapore 409051. For privacy inquiries: privacy@safebubbleapp.com.

2. What we collect

Account data (email, display name), location data you choose to share with your Bubbles, places and geofences you create, trip and event data generated by safety features, encrypted message ciphertext, the public keys your device publishes for end-to-end encryption, a push notification token issued by Google Firebase Cloud Messaging so we can deliver alerts, and crash reports (release builds only, via Sentry) used solely for diagnosing and fixing bugs.

If you buy a paid plan, the purchase is made through Google Play and we receive no payment or billing details at all — no card number, no name, no billing address. Google handles the transaction as the seller. What we hold is the record needed to grant your plan: the Google Play purchase identifier, which product you bought, and the dates it starts and renews. We also send Google a one-way hash of your account id so a purchase can be matched back to your account; it is not reversible into an email address or a name.

3. What we never do

We never sell personal data, never share it with data brokers or advertisers, and never embed advertising or marketing SDKs in the app.

4. How your data is protected

All data travels over TLS-encrypted connections between your device and our servers. Direct messages additionally use end-to-end encryption (X3DH key exchange and Double Ratchet, following the Signal protocol pattern) — encryption keys are generated and stored on your device, and our servers only ever handle ciphertext, which means message content stays unreadable to us even in storage. Other data, such as your location history and places, is stored in our database in a form our servers can read, on infrastructure protected by access controls rather than by per-record encryption.

5. Retention

Location history is retained according to your plan (1 day free, 30 days Premium, 90 days Platinum) and then deleted automatically. Trips are retained for 7 days on the free tier, 30 days on Premium and 90 days on Platinum. Alerts follow the same 7 / 30 / 90-day windows. Crash trips and SOS events are never deleted automatically on any plan — they remain until you delete them. Direct messages remain stored as end-to-end encrypted ciphertext until you or the other person deletes them, or until you delete your account.

5a. Billing records

Where you have made a payment, we retain the associated subscription and invoice records for five years after the end of the financial year to which they relate, as required of Singapore companies by section 199 of the Companies Act. This retention survives deletion of your account: the rest of your data is erased, and the accounting record is kept.

Deleting your account revokes any active subscription immediately, so no further charge is made and Google issues a prorated refund for the unused remainder. There is no customer record of yours for us to delete at the payment processor, because we never held one — Google is the seller and keeps its own records of the transaction under its own policy.

6. Where data lives

Your account, location, messaging and safety data is stored on servers we operate in Germany (EU). Crash reports are processed in the United States by Sentry, and push notifications are delivered through Google Firebase Cloud Messaging. Map tiles are fetched from OpenFreeMap, which means that service sees the map area your app requests. Payments are processed by Google Play, which stores your billing details and payment records on its own infrastructure, including in the United States; Google never receives your location, messages or safety data through us. Data in transit is always TLS-encrypted.

7. Your rights

You can delete your account, and the data attached to it, at any time from within the app. To access, correct, or receive a copy of your data, email privacy@safebubbleapp.com and we will handle the request within 30 days. A self-service export inside the app is not available yet.