BubWatch privacy

Updated October 7, 2026

BubWatch lets two people share feelings, phrases, and images in a private pair. This page explains what the service stores and what happens when you delete your account.

Minimum age

BubWatch is for people 13 or older and is not intended for children under 13. The iPhone signup screen asks you to confirm that you are 13 or older before creating an account. This is a self-declaration, not age verification. BubWatch does not ask for or store your date of birth. The App Store's displayed age rating may be higher than this minimum.

Account information

The service stores your email address, display name, account identifier, and account timestamps. Passwords are stored as salted Argon2id hashes. Login sessions use random bearer tokens; the server stores hashes of those tokens, with expiry and revocation records.

Email/password registration does not verify ownership of the email address. Automated email verification and password recovery are not currently available.

Content shared with your pair

The server stores pair membership, bubmotion definitions, message text, read receipts, custom images, credit entries, Daily Bub answers, sticker collections, and other shared pair state. Your partner can access the content that the app reveals to the pair. Daily Bub answers remain hidden from the partner until the reveal condition is met.

The service also retains custom bubmotion use counts and recent send timestamps for first-party features such as the Classics cabinet, earned-credit rewards, and send-rate limits. The Classics cabinet selects and orders your pair's custom phrases by their use counts, personalizing which phrases you see. Retry records help prevent duplicate actions. These records remain linked to the pair and its members; they are not advertising data.

Current moods are replaced when you update them. The backend removes older mood values from its room revision history, but a backup taken before an update may still contain the previous state.

Private invitation letters

On iPhone, writing, decorating, choosing starter phrases, and previewing your own invitation stay local until you explicitly choose to share. Share letter and invite prepares a frozen copy on the server containing your selected note, decoration, Tuck look, and starter phrases. The server also stores its private link key, revision identifiers, and expiry. Your account supplies the writer's name. Preparation happens before the system share sheet opens; closing that sheet does not withdraw the prepared invitation.

The full private invitation link contains a pair code and a private access key. Anyone who has that complete link can read the selected letter and writer's name before signing in while the invitation is active. The note and phrases are not placed in the URL. A link can be forwarded, and a display name does not verify a person's identity. Share only with someone you intend to invite. An eight-character pair code or code-only link shows the inviter's name and availability, but does not grant access to the private letter.

Private invitation access expires seven days after first preparation; retrying that preparation does not extend it. After the service confirms withdrawal or replacement, the previous private key stops working. Editing or previewing your local draft does not change the shared copy. Expired pending copies are cleared when checked or during routine cleanup. Copies in backups or already saved by a recipient have separate retention.

After deliberate joining with the private link, the exact accepted letter becomes a keepsake in the pair. The service stores the writer and recipient account identifiers, writer's name, and acceptance time with it. An accepted keepsake does not expire with the original seven-day invitation and is available only to authenticated pair members. Joining with a code alone does not create an accepted-letter keepsake. Joining does not send starter phrases as messages, create custom bubmotions, or charge creation credits.

Blocking and content checks

Blocking a partner stores a relationship between your account identifier and theirs. It removes all pairs shared by those two accounts and prevents either account from joining the other's invitations while either person has an active block. Removing your block does not remove theirs or restore deleted content.

New custom phrases are checked on the server against a small set of English rules for targeted hate and explicit threats. These checks are not AI moderation and can miss harmful wording or reject legitimate context. Images are not classified by the server. The content check does not create a separate copy of a rejected phrase for support or moderation.

The safety report screen prefills your account identifier, the partner's account identifier when available, and the message identifier when reporting a specific bubmotion. You can review and edit the email before choosing to send it. Message text is included only if you select that option; images are not attached automatically. Email is handled outside the app's pair storage, and deleting an account does not automatically delete an email you sent to support.

Local personalization and image covers

Unshared invitation notes, decorations, starter-phrase drafts, and Tuck appearance are stored on your iPhone. Guest writing belongs to that installation; signed-in writing is scoped to the matching account and pair. Adding a starter phrase to Send is a separate deliberate action that sends the phrase and emoji to the service as a custom bubmotion. The system share sheet passes the invitation link and any shared card to the app or destination you choose, whose own privacy practices apply. BubWatch does not treat opening or closing a share sheet as proof that your partner received or opened the invitation.

Wallpaper photos and fridge arrangements are stored locally rather than uploaded to the pair. The incoming-image cover preference is also stored locally for the matching account and pair. Covers let you choose when to open incoming custom artwork; they do not classify images or establish that an image is safe.

Images and storage

Uploaded images are resized to at most 256 pixels on each side and saved as PNG files. Image access requires an authenticated member of the matching pair. The backend limits upload sizes, image dimensions, upload rate, and the number of images stored for a pair. Unused staged uploads expire after 24 hours.

Accounts, pair state, prepared invitation letters and accepted keepsakes are stored in SQLite, and custom images are stored as files on the DigitalOcean server. Messages, images, and invitation letters are not end-to-end encrypted. HTTPS and secure WebSockets protect data in transit; content remains readable by the server operator and authorized administrative access.

The app stores account credentials in your device's Keychain and keeps local copies of pair content and pending outgoing actions. Local content caches are not separately encrypted by BubWatch; device security and operating-system encryption protect them.

Notifications and service operation

If your device registers for push notifications, the service stores its Apple Push Notification service token, notification environment, and alert preference. Apple receives the token and notification payload when a push is sent. Normal push notifications use a generic message and unread count rather than the text of your bubmotion.

The backend uses IP addresses to limit authentication and invitation requests in memory, with a current five-minute rate-limit window. Expired entries are pruned when the limiter next checks a request or when the service process ends; the window is not a fixed deletion deadline. These rate-limit entries are held only in RAM.

Persisted operational and notification diagnostic records can include request identifiers, paths, status codes, account identifiers, notification test identifiers, IP addresses, and error details. Routine web access logging is disabled, but service and error logs remain. BubWatch has no analytics or advertising SDK, and message text is not intentionally written to operational logs.

Service journals rotate according to storage size and have no configured fixed age limit. Separate system log files rotate weekly and retain four compressed archives. Account deletion does not automatically erase earlier operational logs. These records have separate retention from the local database backups described below.

Deleting a pair or account

Deleting a pair removes its current state, revision history, custom images, pending invitation letter, and accepted keepsake from active service storage. Both people lose access to that pair's shared data. The other person's account remains. Blocking a partner also removes invitation letters and keepsakes with the pairs it removes.

Delete account in the app's settings removes your account, its login sessions and push registrations, and every pair containing your account, including shared messages, history, media, pending invitation letters, and accepted keepsakes. Connected clients receive a pair-deletion notice. Private media files are removed immediately when possible; a durable cleanup queue retries filesystem failures.

Account deletion also removes active block records involving that account identifier. Registering again creates a new identifier, even when the same email address is used. Blocks apply to account identifiers, not devices or email addresses; the service does not retain a separate identity blacklist after account deletion.

Copies in existing backups may remain until those backups rotate out. The server's routine local backup job removes backups older than 14 days; DigitalOcean infrastructure backups have a separate retention policy. Account deletion does not immediately erase every existing infrastructure backup. Deletions, blocks, and invitation withdrawals or replacements must be reconciled before restoring access from an older backup.

Copies retained by your partner outside BubWatch, such as screenshots or exported images, cannot be deleted by the service.

Privacy questions

Email support@bubwatch.com with privacy or deletion questions. Do not include your password, session token, pairing code, full private invitation link, or private message content.