Privacy policy

bugungisi is a small, invite-only app: one live photo of your day, shared with people you chose. This page says, in plain words, what the app keeps about you, who sees it, and what you can do about it.

The short version

• Your postcards are for people you chose: your companions, and anyone you tag or send one to. A companion you tag on a postcard on the feed can repost it to their own companions.
• We never sell your data, and there are no ads.
• Most of your data is stored in Frankfurt, Germany, by a company that works for us.
• You can delete any postcard, or your whole account, in the app. Messages you sent stay with the people you sent them to.
• bugungisi is responsible for your data. Write to support@bugungisi.com about anything on this page.

Who is responsible

bugungisi is responsible for your data: it decides how your data is used. On this page, “we” means bugungisi.

To ask about your data, or to use any of the rights below, write to support@bugungisi.com. A real person reads it.

What the app stores

Your account. Your email address and a password. The password is stored by our sign-in service (Supabase) in a scrambled form called a hash; we never see it. Your first and last name and your username. If your name cannot make a username (for example, it is written in Cyrillic), or that username is taken, the app makes one from the part of your email address before the @, with a short code added; you can change it. The app also keeps what you choose to add: a profile photo, a short bio, your birthday (day and month only, never a year), the city you’re based in and its country, where you work and your role, where you studied and your subject, and the passport questions you chose to answer. It also keeps the date you joined, which members can see. And it keeps the last time you opened the app: one date and time that no member can see, used only for the counting described below.

Signing in. Our sign-in service keeps a record of each phone you are signed in on, so it can keep you signed in safely. That record can include the phone’s internet address, the kind of phone, and when it was last used.

Your postcards. Each postcard is a photo made live in the app. A front-and-back postcard also carries a small second photo from the other camera, taken the moment after the first, inside the same image. Each postcard is stamped with the time and your time zone, the city, the wider area and the country you were in, and the map coordinates of that spot, exactly as your phone reports them, not rounded. The app’s map never zooms in close enough to show the building, but the coordinates themselves are exact. A postcard also keeps its flavour and, if you add them, a spot name, a caption and the people you tagged. The app keeps where you put it: the feed, your Passport, a pin, or the people you sent it to.

Your activity. The app keeps your companions and connection requests, and the invites you made and used, including who invited you. It keeps your hearts, comments and reposts, and your messages and when each one was read. It keeps the people you blocked and the reports you filed. And it keeps which companions you removed from your close friends (no other member can see this). Tagging someone, or sending them a postcard, also puts it in your chat with them.

If you have not joined yet. If you signed up but have not been let in with an invite, we keep your email address, your name, your username, and anything you add to your passport while you wait. The app’s search does not show you until you join. Members can still read your name, your username and what you add to your passport by asking our database directly. To have it deleted, write to us.

Why we use it

We use your data to run bugungisi for you: to keep your account, show your postcards to the people your choices allow, deliver your messages and notifications, draw your map, and suggest people you may know (friends of your companions, with the number of companions you share).

We also use some of it to keep the app working and safe: crash reports, to find and fix bugs; simple counts, such as how many postcards were made, worked out from the data above; and reports, to deal with anyone who breaks the House rules.

Put simply: we use the first group because bugungisi cannot work for you without it, and the second because the app has to keep working and stay safe for everyone in it. Where your phone asks your permission (camera, location, photos, notifications), you can take it back at any time; see “Your rights” below.

What the app does not do

No ads, and we never sell your data or share it with advertisers or with companies that buy and sell data. No analytics or advertising trackers, in the app or on the website. The only reports the app sends about how it runs are the crash reports described below. Location is read only when you ask for it: as you make a postcard, or when you tap “Use where I am now” for your city. Never in the background. Photos come only from the in-app camera. Your profile photo is the one exception: you can choose it from your photos.

Who sees what

Your postcards. When you make a postcard, you choose where it goes:

• On the feed, or on your Passport: your companions see it. Taking a postcard off your Passport does not take it off the feed; only deleting it does.
• Sent to someone: the people you sent it to see it. If you later show it on your Passport, your companions see it too.
• Kept for yourself: it stays in your Diary. Only you see it, and anyone you tag on it. If you later show it on your Passport, your companions see it too.
• Anyone you tag also sees the postcard, wherever it went, even if you later stop being companions, unless one of you blocks the other.
• Reposts. If you tag a companion on a postcard on the feed, they can repost it. Then their companions see it too, including people you do not know, and they can heart it and comment. A repost stays until the person who made it removes it, or you delete the postcard. Blocking the person who reposted it does not remove their repost.

Anyone who can see a postcard can see its exact coordinates, who is tagged on it, its comments and how many hearts it has. Who hearted it is shown only to you and to anyone who reposted it. Anyone who can see a postcard can also save the full-size photo to their phone, and a saved copy stays with them even if you delete the postcard.

Your feed shows your own postcards, your companions’ postcards and the ones they repost, and postcards on the feed that you are tagged on.

Your profile. Every member can see, and copy, your name, username, profile photo, bio, birthday (day and month), the city you’re based in, where you work and your role, where you studied and your subject, your passport questions and the date you joined. Every member can also find out who invited you, whom you invited, and the companions you have in common. Your companions can see your full list of companions. They can also see the people you have shared postcards with, and how many with each. Friends of your companions may see you under “People you may know”, with the number of companions you share.

Finding you. Only members, people who joined with an invite, can search for you by name or username. Search shows them your name, username and profile photo. Someone who made an account but has not joined finds no one.

Your profile photo is kept apart from your postcards. It is served from an ordinary image link, which opens for anyone who has that link, signed in or not. No account can ask our storage for a list of other people’s profile photos.

Postcard photos are kept in private storage. The app opens them with links that work for one week, given only to people allowed to see that postcard. A link someone already has keeps working until its week ends, and a phone may keep a photo it has shown for a while, even after a block or a disconnect.

Messages are seen only by the two people in the chat. But we, who run bugungisi, can read everything in the database, messages included. Messages are not locked with a key that only the two of you hold. (That kind of lock is called end-to-end encryption.) We look at a message or any other content only when it is reported to us, when you ask us to, or when the law requires it.

Blocking. Members you block cannot find you, open your passport or see your postcards. For your postcards and your passport questions, the database itself stops them, not only the app. There are some exceptions. Messages you exchanged before the block stay readable to them. A photo link they already had works as described above. If they reposted one of your postcards before the block, their repost stays, as described above. If they block you too, they can still read your name, your photo and the other details on your profile, but not your questions or your postcards. And anyone who has one of your unused invite codes can see your name, username and photo.

The app never puts your postcards on the open web.

Notifications

We send a push only when a person is waiting on you: a message, a request to connect, or being added to someone’s postcard. Hearts and comments never notify you. The text never carries a name or the content itself, so a glance at your lock screen tells somebody nothing about who you know. There is also an optional daily reminder you can set for yourself. It is off unless you turn it on, your own phone schedules it, and it never leaves the device. To deliver a push we keep a code that points to your phone (a device token). It is used for nothing else, and it goes when you sign out, turn notifications off in the app’s Settings, or delete your account.

Crash reports

When the app crashes, freezes or hits an error, we receive a technical report: what the code was doing, the phone model, its system version and the app version. It is handled for us by Sentry, on servers in the European Union. We do not attach your username, your email or your account to it.

Some reports can still carry things that point to you. A few reports are sent straight from the phone and never pass through the app’s own checks: freezes, and some crashes. Such a report can carry a number that marks the app on your phone. It stays the same every time. It can also carry the web addresses the app used just before. Those addresses can hold the code of a member’s account (an id). An id is not a name or a username. The app takes ids out of the reports that pass through it, but it cannot reach the ones sent straight from the phone.

The crash-report tool also tells Sentry each time the app opens, so Sentry can count how often the app crashes. It works this way unless it is switched off, and we have not switched it off. That signal carries the app version. It can also carry the number that marks the app on your phone, described above. This is why bugungisi’s privacy label on the App Store says crash data is linked to you.

Sentry can also work out a rough place, a town or a country, from the internet connection a report arrives on. It is not tied to your account, and we do not use it.

The website

The website, bugungisi.com, runs on Cloudflare. It sets no cookies and runs no analytics scripts. Like any web host, Cloudflare sees your internet address and the page you open. An invite link carries its code in the address, so Cloudflare sees the code too. If a page fails to load, some browsers send Cloudflare a short error report, so the problem can be found.

Where it lives, and who helps us

Most of your data is stored with Supabase, on servers in Frankfurt, Germany. These companies help us run bugungisi, and each gets only what its job needs:

• Supabase keeps the database, the photos and your sign-in. Our contract is with its company in Singapore. Its traffic passes through Cloudflare’s network, and its own helpers, some in the United States, may reach the data, for example for technical support.
• An email service that works for us sends the emails the app sends you: sign-up and sign-in codes, and the links to change your email. It gets your email address and the code or link in the email.
• Expo, a United States company, delivers notifications and the app’s updates. For a notification it gets your device token and the one-line text, never a name or what was said. It also gets its own fixed number for the app on your phone, when the phone signs up for notifications and each time the app checks for an update.
• Sentry receives crash reports on servers in the European Union, as described above.
• Apple (on iPhone) and Google (on Android) deliver notifications to your phone, with the same one-line text. To name a place, your phone asks Apple (on iPhone) or Google (on most Android phones). It sends them the map position of your postcard, or of where you are when you tap “Use where I am now”. When you type a city, it sends them the city. They also draw the map: Apple Maps on iPhone and Google Maps on Android, which are told which part of the world to show. On Android, the phone’s location itself comes from Google’s services.
• Cloudflare, a United States company, runs the website, and passes on email sent to support@bugungisi.com to the inbox where we read it.

Supabase, the email service above, Expo, Sentry and Cloudflare work for us: they handle your data only to give their service to bugungisi, and their own terms bind them to protect it. Apple and Google run maps, place names and their phone services under their own privacy policies: Apple’s and Google’s. The inbox where we read your email is kept by our email provider, under its own terms. When you download bugungisi, Apple or Google also know you did, under their own terms.

So your data is kept mainly in Germany, and parts of it are kept in, or pass through, other countries, including the United States.

How long we keep it

Your data stays until you delete it, or delete your account. Nothing you make or write expires on its own. When you delete your account, most of it goes at once; the next section says what goes and what stays.

Some things are kept with no end date. Chats and the record of who invited whom are kept, because they also belong to someone else. They stay even after both people have left. Your old invite codes are kept too, switched off, so nobody can ever use them. A report someone filed about you is kept for as long as the person who filed it keeps their account.

The companies above may keep their own copies, such as crash reports, backups, email logs and records of sign-ins and requests, for their own set periods.

Deleting things

You can delete any postcard in the app. That removes its photo and everything attached to it: hearts, comments, tags, and every repost of it. Chat messages that carried it stay, and read “This postcard isn’t available.” You can delete any comment you wrote, and any comment on your own postcard, and remove your own repost. When a comment is deleted, the replies under it go too.

You can delete your whole account in the app: Settings → Help, rules and account → Delete account, then type DELETE. It removes your postcards, your companions, your comments and hearts, your tags on other people’s postcards and your profile details at once, and there is no undo. Replies other people wrote under your comments go with them. Your photos are deleted from storage at the same moment. If that last step is cut short (for example, if your phone loses its connection), nobody can get a new link to your postcard photos, and we will remove anything left over if you write to us. Until then, your profile photo may still open from its old link, and a postcard photo link that someone already has keeps working for up to a week.

If you cannot get into the app, or you would rather we do it, email support@bugungisi.com from your account’s address and we will delete it within three days.

A few things stay, because they live in other people’s data:

• The people you messaged keep your chats with them, your own messages included.
• The people you invited keep the record of how they joined.
• A postcard someone else made and tagged you on stays theirs. Your tag goes, but if your name was printed on the photo itself, it stays there.
• If someone reported you, that report is kept.

In chats and invite records your name becomes “A former member”. Copies other people saved to their phones are out of our reach. The full detail is on the Delete your account page.

We may also remove a postcard, a comment, a message or an account that breaks the House rules. If we remove your postcard, the app tells you.

Your rights, and how to use them

You have rights over your data. Most of them work right in the app.

• See it. Most of what we keep is in the app: your Passport and Diary, your chats, your profile, and your email in Settings. For a copy of all of it, write to us from your account’s email address and we will send it to you.
• Correct it. Edit your profile at any time: your name, username, photo, bio, birthday, city, work, studies and questions. Change your email and password in Settings. A postcard’s photo, time, place and caption cannot be changed, because they are what make it real; a spot name can be added once. If a postcard is wrong, you can delete it.
• Delete it. See “Deleting things” above. You cannot remove some things yourself in the app today: a message you sent, your tag on someone else’s postcard, a repost someone made of your postcard (except by deleting the postcard), and your profile photo without choosing a new one. Write to us about any of them.
• Take back a permission. Turn off the camera, location, photos or notifications for bugungisi in your phone’s settings at any time. Turn off the daily reminder or notifications in the app’s Settings. Disconnect from, or block, anyone.
• Ask us to stop or pause. If you think something we keep is wrong, out of date, or used in a way it should not be, write to us. We will look at it and answer you, and if you are right, we will stop using it.
• Complain. Write to us first; we want to fix it. You can also complain to the authority for personal data where you live, or to a court.

Keeping it safe

The app talks to our servers only over encrypted connections, and the website opens only over an encrypted connection. Rules inside the database decide, row by row, who may read what; this page describes those rules. Postcard photos are in private storage, opened by links that expire after a week. Your password is stored only as a hash. Before a profile photo is uploaded, the app removes the hidden details a phone writes into a photo, such as where it was taken and the camera. A postcard is saved as a new image, without them.

No system is perfect. If a leak puts your data at risk, we will tell you.

Age

bugungisi is for people aged 13 and over. The app does not ask your age; you join only with an invite from someone already inside. We do not knowingly keep data about anyone younger. If you believe a child has an account, write to support@bugungisi.com and we will remove it.

Questions

Write to support@bugungisi.com. If this policy changes in a way that matters, the date at the top changes with it. See also the Terms and the House rules.