Escarcha Beheer B.V. · Version 2 · Applicable to users in the European Economic Area
Effective date: 6 October 2026 (replaces version 1 of 30 April 2026)
Escarcha Beheer B.V., Utrecht, the Netherlands, Chamber of Commerce 73367710 (“Escarcha”, “we”) is the controller for the personal data processed through the Buble Messenger app (“Buble”) and the website buble.app. This Privacy Policy explains which data we process, why, on which legal basis, with whom we share it and which rights you and your child have. It belongs with the Terms of Service. Privacy questions: info@buble.app.
Principles. Buble collects as little data as possible, shows no advertising, sells no data and does not use children’s data for profiling or marketing. Our servers and database are in the European Economic Area; section 5 lists the suppliers that process data outside the EEA.
1. Who this policy applies to: parents, teachers and children
Buble has child accounts and adult accounts. A child account is created and managed by the parent or legal guardian (“Parent”). A child under the age of 16 cannot enter into a contract; the Parent enters into the contract as legal representative on behalf of the child. The processing needed to provide Buble (account, messages, calls, games, parental supervision) therefore rests on the performance of that contract, and safety measures rest on our legitimate interest and on legal obligations. At present there is no feature for which we ask separate consent within the meaning of Article 8 GDPR; if one is introduced, we will ask the Parent for it separately and the Parent can withdraw it at any time. Because the age threshold for consent differs between EEA countries (13 to 16), we apply the age of 16 everywhere; a child never accepts the terms themselves. Adult accounts are for parents and teachers; an adult accepts the terms themselves and the processing of their data rests on the contract with them. An adult who has been approved as a child’s contact accepts that the child’s Parent can read along with their messages to the child. This policy is written so that a child can understand it too; we recommend reading it together.
2. Which data we collect
Data you give us
- Adult account data. Name, username, e-mail address, password (stored as an irreversible hash that even we cannot reverse), role (parent or teacher), language of the app and of the phone, status text, profile photo, the country you choose yourself for the regional leaderboard, and the relationship to the child.
- Child account data. First name or screen name, username, the age group the Parent selects (6-8, 8-10 or 10+; the Parent can change it later), profile photo and the link to the parent account. We do not ask for a date of birth or a surname.
- Messages and media. Messages, photos, videos, voice messages, stickers and GIFs, group names, moments (text or photo) the child places for their contacts, and comments and emoji reactions on moments. Messages are sent encrypted (TLS) and are kept on our servers for as long as the conversation or the account exists, so they can be delivered, synchronised and, if the read-along setting is on, read by the Parent. Our nightly backups are stored encrypted (AES-256).
- Calls. Voice and video calls are only possible one-to-one between people who are also allowed to message each other. We do not record calls. We keep a call history (who, when, how long) that only the two participants can see; Parents do not see their child’s calls. The parent switch “calls” is on by default and only determines whether the child can start a call.
- Games. Game sessions, scores and ratings per game, and a score history. See section 4 for the leaderboards.
- Contacts and groups. Contacts are added through invitation and approval by the Parent; we do not upload the device’s address book. With a contact request, the Parent who has to approve it sees, before approving, the name and the e-mail address of the requester: of the adult themselves, or of the Parent of the child sending the request. This lets the Parent check who is asking for access to the child; the child does not see the e-mail address. Approval also applies in groups: a child is only in a group with approved contacts, unless the Parent turns on “may join groups with strangers” (off by default); the Parent is notified of every group and can remove the child from it. Class groups are the exception (a teacher puts their pupils together), and siblings with the same Parent are linked automatically.
- The child’s safety report (the shield). What happened, where, when and, if given, the name of the person concerned. The report goes to whoever the child chooses: their Parents, one or all teachers, or the trusted person, as an in-app notification, push message and e-mail; not to Buble. For each recipient we keep proof of delivery (e-mail address and the mail server’s response). If the child names someone in the app, the conversation between them is held for 90 days (section 6) and the Parents of both children can message each other through Buble to discuss the situation; the Parent of the named child then sees who made the report.
- Parent settings and family. Approved contacts, the daily time limit, notification preferences, the read-along setting, the location tracking setting, “share moments and comment”, “calls”, “share location”, “share GIFs”, “visible in leaderboards”, “may join groups with strangers”, and co-parenting proposals (a Parent proposes another adult as co-guardian of the child; once accepted, that adult is also a guardian). A teacher linked to a pupil can change some of these switches for the pupil.
- Recorded acceptance. At registration, and each time an adult accepts a new version of the Terms of Service or this policy, we record: which version of which document, date and time, the method (at registration or via the screen in the app), the IP address and the app version. This is our evidence of which terms applied.
- Support, reports and feedback. What you send us when you contact us, report something or give feedback via the feedback button in the app. When a person is reported from a one-to-one conversation, a copy of the last 10 messages between the reporter and the reported person is sent automatically with the report, including photos, videos and voice messages (a shared location is included without coordinates); the app warns the reporter of this. This copy therefore also contains messages from the reported person. No copy is sent from group conversations.
- Invitations. If you invite someone by e-mail, we process that person’s e-mail address to send the invitation.
Data collected automatically
- Usage data. When and how often the app is used, which features, times of sending and receiving, online status, “last seen”, read receipts and “typing…” (visible only to contacts and linked family; last seen and read receipts can be turned off), and a child’s screen time (seconds used per day, for the daily time limit).
- In-app notifications (the bell). Name of the sender, what happened and when you read it.
- Device and connection data. Whether it is an iPhone or an Android device, the app build number, the language of the app and of the phone, the time zone (for quiet hours), the last IP address used and push tokens. We do not collect the device model, the operating system version or a device identifier.
- Server log. Technical log entries and error messages on our own server. We do not use an external crash reporting service.
- Security data. Login tokens, verification codes and signals that help detect misuse or unauthorised access.
- App usage statistics. To see how Buble is used and where it can improve, we count events (online, message, conversation, game, moment, registration, verification) under a six-digit pseudonym instead of a name. In our administration environment these statistics are only visible in anonymised form; in the database they are pseudonymised until the period in section 6 expires, after which they are anonymised there as well.
- Website visit statistics. On buble.app we count page visits using a counter we built ourselves that runs on our own server; nothing goes to third parties. Per visit we store: which page, in which language, the browser’s language setting, the country, the domain name of the site the visitor came from (for example google.com), any campaign labels in the link, the type of device (phone, tablet or computer), the brand of the browser and of the operating system (without version number), how long the page was open, whether a store button (App Store or Google Play) was tapped, and whether it was a search engine robot. No version numbers and no full referring URL. Your IP address is never stored, not even in shortened form: it is used only briefly in memory to look up the country in a list on our own server and to create a code that counts the same visitor once per day per page. That code changes every day and differs per page, so a visitor cannot be followed.
- Location tracking by the Parent, only when that setting is on. If the Parent has turned on “location tracking” and opens the child’s location screen, the child’s app asks the device for its position and relays it (roughly every 5 seconds or 10 metres) through our servers to the Parent for as long as the Parent is watching and up to 90 seconds after the Parent’s connection drops. This only works while the child’s app is open; during that time the child sees a clear “Being tracked” banner on every screen. We do not store the positions anywhere, not even in logs; we only record in the child’s activity log and in our server log that and when the location was tracked and by which Parent, without coordinates.
- Location a user shares in a conversation. With the location button in the chat screen a user can share their location with a contact. Children aged 6-8 cannot do this; for 8+ the parent switch “share location” is on by default and the Parent can turn it off. This is an ordinary chat message: a fixed location is stored as coordinates in the message for as long as the message exists; a live location is shared for at most one hour, only the latest position is kept (no route is recorded) and after it ends the last known position remains in the message.
- Activity log. A record, visible to the child, of the Parent’s supervision actions: when which Parent viewed which conversation or tracked the location. Repeated viewing within 30 minutes counts as one entry. The log contains only time, Parent, type of action and conversation, no content and no positions; the child sees the most recent entries in the app. Turning read-along or location tracking on or off is not in the log, but the child immediately receives a notification and a push message about it.
- Deleted messages. When a user deletes a message it disappears from the conversation, but we keep its content for another 30 days (see section 9). This applies to all conversations, including those between adults.
Data others provide about you or your child
- Reports by other users. If an adult reports a message, moment, comment or account, we receive the report and the content concerned.
- A child’s safety report. If a child names you via the shield, the chosen recipients receive the report with your name.
We do not use tracking cookies or advertising identifiers. The website buble.app sets no cookies at all and stores no visitor code on your device; the font is loaded from our own server. The only thing the browser remembers is that you dismissed the notice “This site is also available in your language”, so it does not return.
3. Why we process data and on which legal basis
| Purpose | What we do | Legal basis | Data |
|---|---|---|---|
| Creating and managing accounts | Verifying the Parent’s e-mail address, linking child and parent account, co-parenting, linking teacher and pupil, storing settings | Performance of a contract (the Parent for themselves and as representative of the child) | Account data, parent settings, security data |
| Messages, calls and moments | Delivering, storing and synchronising messages and media; setting up calls; showing moments and comments to contacts | Performance of a contract | Messages and media, calls, contacts, device data |
| Games and leaderboards | Keeping game sessions, scores and ratings; showing leaderboards (for children only with the parent switch) | Performance of a contract | Game data, display name, profile photo, country |
| Parental supervision | Read-along (with the Parent’s read receipt visible to all participants), live location, daily time limit and screen time, contact approval, settings, activity log, weekly summary by e-mail | Performance of a contract (core feature of Buble) | Messages and media, usage data, screen time, location data, parent settings |
| The child’s safety report | Delivering the shield report to the adults the child chooses and holding the conversation concerned for 90 days | Performance of a contract; legitimate interest (safety of children) | Safety report, messages between those involved |
| Safety and integrity | Assessing reports, temporarily hiding moments and comments after three reports until a member of staff has looked, running every child’s GIF and sticker searches through our provider’s strictest content filter, keeping deleted messages for 30 days, detecting misuse and unauthorised access, suspending accounts | Legitimate interest (safety of children and of the service); legal obligation where applicable | All categories, as far as necessary |
| Operating and improving the service | Resolving failures, measuring performance, keeping pseudonymised app usage statistics and website visit statistics, asking adults, based on their use, to rate the app in the app store (never children) | Legitimate interest (a reliable service) | Server log, usage and device data, usage statistics |
| Service communication | Service notifications, in-app notifications, changes to terms, security warnings, invitations | Performance of a contract | Adult account data, in-app notifications |
| Support | Answering questions and complaints via info@buble.app | Performance of a contract | Support data, account data |
| Legal obligations | Responding to lawful requests from authorities, retention duties, reporting suspected child abuse | Legal obligation; vital interest in case of acute danger | All categories, as far as required |
| Legal protection | Defending against claims, establishing rights | Legitimate interest | All categories, as far as necessary |
| Evidence of acceptance | Recording which version of the Terms and this policy you accepted, when and how | Legal obligation (accountability, GDPR Art. 5(2) and Art. 7(1)); legitimate interest | Recorded acceptance, including IP address and app version |
Where we rely on legitimate interest, we have weighed the child’s interests as outweighing ours, unless the processing serves the child’s safety; you can object to these processing activities (section 8). We do not use children’s data for marketing, profiling or automated decision-making with legal effects. We do not use an automatic content filter for messages. A moment or comment reported three times by people who can see it is hidden automatically until a member of staff has reviewed it; the administrator is notified immediately. For every child, regardless of age group, GIF and sticker searches always use the strictest content filter of our provider; adults receive unfiltered results. The Parent can turn GIFs off entirely for a child with the “share GIFs” switch; for ages 6-8 it is off by default.
4. With whom we share data
- With the Parent. Through the parent account the Parent can view the contact list, today’s screen time against the daily limit, the child’s moments (only if the Parent is themselves a contact of the child), the conversations if the read-along setting is on (including messages deleted in the past 30 days), and the child’s current location if location tracking is on. A co-guardian through co-parenting can do the same. The Parent does not see the child’s call history or in-app notifications. The child receives a notification when the Parent turns read-along or location tracking on or off, sees in the conversation next to each message which Parent has read it, and has a log of those views. Parents receive a weekly e-mail summary of their child’s use.
- With the other child’s Parent. Messages your child sends to a contact may be read by that contact’s Parent if they have turned on the read-along setting; in a group this applies to the Parents of all participants. This is reciprocal: every Parent accepts this for their own child by agreeing to the Terms of Service. Parents may use what they read along only for the safety and guidance of their own child and may not keep, forward or share it (Terms of Service, section 3). The legal basis for this processing is the performance of the contract with both Parents.
- With teachers and trusted persons. A teacher linked to a pupil sees the pupil in their class group and can change some of the pupil’s settings. A child’s safety report goes only to the recipients the child chooses.
- With other users. Screen name, username, profile photo, status text, online status and sent messages are visible to the contacts and group members the child communicates with. If you or your child sends a contact request, the Parent on the other side sees your name and your e-mail address before deciding; this is a safety measure so that parents know who they are giving access to their child. A moment is visible only to the child’s own contacts; there is no public timeline. A comment your child places on a contact’s moment is visible to everyone who can see that moment, including people who are not contacts of your child; to them your child’s name and photo are not shown, only “Unknown user”. Emoji reactions are shown only as a count per emoji, without names. Approved contacts may also be adults (for example a teacher), after approval by the Parent. Others may keep or forward messages; that is another reason the Parent approves contacts.
- Leaderboards. The Global and Regional game leaderboards show the display name, profile photo and score of adults, and of a child only if their Parent turns on the “visible in leaderboards” switch (off by default). No username or other way to make contact is shown. Every user also sees a top 3 of their own contacts.
- With our administrator, only in case of a report. In case of a report, Buble’s administrator can view the attached copy of the last 10 messages and the messages between the reporter and the reported person, including messages deleted in the past 30 days. In case of a report about a moment or a comment, the administrator can view that moment or comment, including its photo and the comments below it. Every access to content and every measure (blocking, unblocking, deleting, IP block, hiding a comment, erasing files) is recorded in our audit log.
- Processors. We engage suppliers that process data solely on our instructions and under a data processing agreement: our hosting provider (server, database and local backups, in the EEA); BunnyCDN for storing and delivering photos, videos, voice messages, profile photos and encrypted backups (storage in Germany, delivery via servers close to the user); Expo, Apple and Google for push notifications (push token, sender name and a preview of the message); LiveKit for voice and video calls (call data and the device’s IP address, processed in the EU); and Gmail for the info@buble.app mailbox. GIFs and stickers come from Klipy, but Klipy is not a processor of user data: our server forwards only search terms without user data and fetches the chosen GIF itself and passes it on, so Klipy never sees the IP address or any other data of a device. Verification and service e-mails are sent from our own mail server.
- Authorities. We share data with the police, judicial authorities or regulators where we are legally required to do so or where necessary to protect a child or another person from serious danger.
- Business transfer. In a merger, acquisition or sale, data may pass to the new party; you will be informed and this policy will continue to apply.
We do not sell data and do not share data with advertisers.
5. Transfers outside the EEA
Our servers, database and backups are in the European Economic Area, and voice and video calls are processed in the EU. Four suppliers process data in the United States: Expo and Google (push notifications) and Gmail (e-mail to info@buble.app) under the EU-US Data Privacy Framework, for which they are certified, and Apple (push notifications) under the EU standard contractual clauses, with Apple Distribution International Limited in Ireland as the contracting party. Information is available at info@buble.app.
6. How long we keep data
| Data | Retention period |
|---|---|
| Messages and media in conversations | For as long as the conversation or the account exists |
| Content of deleted messages | 30 days after deletion, then erased automatically, unless the hold rule below applies |
| Photos, videos and voice messages that have disappeared from a conversation | 30 days after the message disappeared from the app, then permanently erased, unless the hold rule below applies |
| Location data during tracking by the Parent | Not stored; only relayed live to the Parent while tracking is running |
| Location shared in a conversation | As a chat message: for as long as the message exists; live location active for at most one hour, only the latest position is kept |
| Moments, comments and emoji reactions | For as long as the moment exists; the text of a deleted moment or comment is erased after 30 days. All of the user’s moments, comments and emoji reactions are deleted when the account is deleted |
| Call history | 12 months |
| Game sessions | 90 days; scores, ratings and score history 12 months |
| Screen time | 90 days |
| In-app notifications (the bell) | 12 months |
| Reports to Buble and safety files | 12 months after handling; open reports and accounts on hold remain until handled |
| The child’s safety report (the shield), with proof of delivery | 12 months after sending |
| Copy of the last 10 messages attached to a report | 30 days after the report is closed or expired, then erased. A hold for an authority or another open report between the same two people keeps the copy longer |
| Hold rule for reports and requests from authorities | Content (text and files) linked to an open report or a request from an authority is not erased until the matter is closed. Linked means: for a report about a user, the messages and files between the reporter and the reported person; for a report about a moment or comment, the photo of that moment; for a safety report in which the child names someone in the app, 90 days after the report. For a request from the police or another authority, the administrator places an account on “hold” manually and with a mandatory reason; release is also manual, and both are recorded in our audit log. A report on which nothing has been done for 6 months is automatically marked “expired”; a manual hold ends after 6 months unless the administrator extends it with a stated reason. After that the normal periods apply again |
| Co-parenting proposal | Closed after 30 days without a response; the record of the proposal stays with the account |
| Activity log | 12 months; older entries are erased automatically every day. If the child or the Parent is deleted, their entries disappear within a day |
| Server log | 90 days |
| Administrator audit log | 2 years |
| App usage statistics | 180 days pseudonymised, then anonymised |
| Website visit statistics | 400 days (so one year can be compared with the previous one), then anonymised; IP addresses are never stored |
| Recorded acceptance (version, time, method, IP address, app version) | As long as the account exists and up to 2 years after deletion, then erased automatically |
| IP address of the account | Erased immediately when the account is deleted, whether by the user, the Parent or the administrator |
| Blocklist | An IP address the administrator blocks for serious abuse is kept on a blocklist separate from the account. It is a block, not account data, and remains for as long as the block is needed; the administrator removes it manually |
| Request to rate the app in the app store | When we asked: 2 years, then anonymised |
| Mail log of the weekly summary for parents | Anonymised after 90 days: the e-mail address and the link to the user are removed, only the count remains |
| Mail log of e-mail invitations | 90 days |
| E-mail addresses that reject our mail | 12 months after the last rejection |
| Support correspondence via info@buble.app | 2 years in the info@buble.app mailbox |
| Feedback via the feedback button | After 2 years anonymised: the link to the user and all personal data are removed, and only the content is kept to improve Buble. When the account is deleted, the feedback is anonymised the following night |
After the period ends we delete or anonymise the data.
7. Security
We take appropriate technical and organisational measures: encryption of data in transit, passwords stored as irreversible hashes, encrypted backups, restricted staff access, an audit log of every administrator view and measure, and logging. No system is completely secure; we ask you to protect your account with a strong password you use nowhere else and to report suspicious activity. In case of a data breach that poses a risk, we inform the Parents concerned and the Dutch Data Protection Authority within the statutory time limits.
8. Your rights and your child’s rights
You have, also on behalf of your child, the right of access, rectification, erasure, restriction, portability and objection. A child may also exercise these rights, with the Parent’s help. You exercise these rights via info@buble.app; access and portability are handled manually, and we respond within one month. If you object to processing based on legitimate interest, we stop the processing unless compelling legitimate grounds prevail. You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, www.autoriteitpersoonsgegevens.nl) or the supervisory authority in your own EEA country.
9. Deleting data
Deleting an account. You delete your own account via Profile > Delete account (the app asks for your password). A Parent deletes a child account via the Family tab > “Delete …’s account”. A Parent with children first deletes each child separately and then their own account; a co-guardian can delete their own account without the child disappearing. Deletion is immediate and irreversible: e-mail address, password, name, username, profile photo, status text, language and country, last seen and last login, app version and platform, IP address, push tokens, pending verification and reset codes, any block reason, contacts, group memberships, moments, comments and emoji reactions are erased; settings and game scores return to their defaults; the activity log disappears within a day and feedback is anonymised the following night. Your e-mail address is also removed immediately from our mail logs, from the delivery records of safety reports and from the list of rejected addresses; only the fact that a report was delivered (channel, time, mail server response) remains as evidence, without address or name. Only an empty row remains, with an internal number, the role and the dates of creation and deletion, so that other people’s conversations stay intact. Messages already delivered to other users remain on their devices. Data we must keep longer under section 6 (such as the recorded acceptance and open reports) is retained in restricted form until the period expires.
The copy on the phone. A received photo, video or voice message is kept in the app on the recipient’s phone; the app shows the file from the phone, not from our server. If the sender deletes a message for everyone, the app also erases the file from every phone that received it; a phone that is offline at that moment does so as soon as the conversation is opened again. “Delete for me” erases nothing from anyone else’s phone. A screenshot, or a copy someone saves outside the app, cannot be retrieved by us; this is true of every messaging app and is a reason to approve contacts carefully.
Deleted messages. Whoever deletes a message no longer sees it; the other participants only see “message deleted”. Only the sender can delete a message for everyone. We keep the content of a deleted message for another 30 days and then erase it automatically, unless the message is linked to an open report or a request from an authority; in that case we keep it until the matter is closed (see the hold rule in section 6). During those 30 days the message can only be seen by a Parent reading along in their child’s conversation, regardless of who deleted it, and by our administrator solely in case of a report, and then only the messages between the reporter and the reported person. A message the child deletes only for themselves with “delete for me” always remains visible to a Parent who reads along. This is also explained in the app.
10. Changes to this policy
This policy carries a version number. We update it when our service or the law changes. For a material change, such as a new processing activity, our administrator e-mails all adult users in advance and the app asks every adult user to accept again before the app can be used further. The effective date at the top is updated and earlier versions are available on request.
11. Contact
Escarcha Beheer B.V. · Utrecht, the Netherlands · info@buble.app · Chamber of Commerce 73367710
This Privacy Policy is written in English, and the English text is the binding version. Translations are AI-generated, provided for convenience only and labelled as such; in the event of any difference the English text prevails.