Privacy policy

Draft, not yet legally reviewed. Details marked in yellow will be added. The German version is legally binding. Last updated: [date]

This policy applies to the CineBubble app (iOS and Android) and to this website. It explains which data we process, why and for how long, and what rights you have.

1. Controller

[First and last name or company]
[Address]
Email: kontakt@cinebubble.com

2. This website

The website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. When you visit it, the server stores technically necessary data (IP address, time, page requested, browser) in log files to keep the service running and secure (Art. 6(1)(f) GDPR). They are deleted after [period per all-inkl]. The website sets no cookies and uses no tracking.

When you open a shared link (e.g. to a call or an event), the page loads its public details directly from our database provider Supabase (servers in Frankfurt am Main); this makes your IP address visible to Supabase. Only content that is public anyway is shown.

The “Email confirmed” page reads the confirmation code from the link only in your browser and removes it from the address bar right away.

3. Account

For an account we store your email address, your password (only as an encrypted hash) and your username. You must be 18 or older; you confirm this when you sign up. The legal basis is the user agreement (Art. 6(1)(b) GDPR). Emails from the app (e.g. password reset codes) are sent through the mail server of ALL-INKL.COM.

Guests (without an account) can search in a limited way and read public content. We store nothing about them, except a hash of the IP address with a time window to prevent abuse of the search; these entries are deleted daily (Art. 6(1)(f) GDPR). For logged-in users the account ID is counted instead.

4. Profile and visibility

All profile details are optional (except a username, a name, at least one category and a home city). You decide for every single detail who can see it: only you, your Bubble (people you follow who follow you back) or everyone. New profile details start out public; date of birth, phone number, email address, body measurements and build start out private. You can change this default in the settings. Other content (e.g. listings, notes) starts out private.

In ghost mode you appear in no lists, search results or suggestions. You can then only be found by your contact code or your complete username, and even then nobody sees anything of your profile until you accept a Bubble request. In public groups you appear under an alias.

People you block no longer see anything of you, and you see nothing of them.

5. Content you post

We store what you create in the app, with the visibility you chose: listings (events, places, rentals), casting and crew calls, job searches, marketplace ads, short films, album, projects, equipment, certificates, notes and your calendar entries. Uploaded images and files are kept in private storage and can only be accessed by authorised people.

• Casting and crew calls are always public. When you apply, the poster sees your profile card (photo, name, categories, playing age and, if entered, your age in years, never your date of birth).
• Calendar: only you see your entries. Others only see whether you are free, tentative or busy in a period, and only for entries you mark for this.
• Marketplace: ads show only the city, never an address.
• Credits (short films, album) are linked to your profile only after you confirm them.

6. Messages and Q&A room

Chats (private, groups, project rooms) are stored on our server. They are not end-to-end encrypted; technically the operators could read them. We only do so when a message is reported or when we are legally required to. “Typing” indicators are not stored; we only store up to when you have read a chat (to show unread messages). The microphone is only used while you record a voice message (at most 1 minute).

The groups in the Q&A room are public and readable by guests, including images and files in them. Opening a group makes you a member so you get notifications. Votes for new cities are only counted; nobody sees who voted.

7. Location

• Your home city (up to 5 cities) is stored rounded to about 1 km and shown on the map only as an approximate point around the city, according to the visibility of that detail.
• “Share approximate location” is optional. Only a point on a grid of about 3 km is stored, never your exact position (Art. 6(1)(a) GDPR, can be switched off at any time).
• For distances (e.g. rentals nearby) the app uses your exact location only on your phone; it is not stored, and only a roughly rounded area is sent to the server.
• Place search and maps are provided by the operating system: Apple (iOS) or Google (Android).

8. Camera, photos and notifications

Camera and photo library are only used when you take or choose a picture yourself or scan a QR code. For push notifications we store your phone’s device token and language; notifications are delivered via Expo, Apple and Google and contain no message content. You can turn them off in your phone’s settings.

9. GIFs

When you search for GIFs in a chat, your search term goes through our server to GIPHY (Shutterstock, USA). Your phone loads the GIFs directly from GIPHY, which makes your IP address visible to GIPHY.

10. Reports and moderation

You can report people and content. Reports and team actions (e.g. removing content, restrictions) are logged; the people affected receive a reason and can object (Art. 6(1)(c) and (f) GDPR). Feedback sent from the app also goes to the team.

11. Business accounts and tickets

For a business account we store the organisation’s name and type, city, website/Instagram, description and review status (visible only to you and the team). If you get tickets for an event, the organisers see your username on the guest list.

12. Service providers

• Supabase (database, sign-in, files): servers in Frankfurt am Main (EU). The provider is Supabase Inc., USA; [add data processing agreement and basis for transfers to the USA, e.g. EU-US Data Privacy Framework or standard contractual clauses]
• ALL-INKL.COM (website, email delivery), Germany
• Expo (650 Industries, USA): delivery of push notifications
• Apple and Google: push notifications, place search, maps
• GIPHY (USA): GIF search

13. Retention

• We keep your data as long as you have an account.
• Deleting your account: the account is hidden from everyone at once. You can restore it within 30 days; after that everything is deleted for good, including your files. Text messages you sent to others stay in their chats as “Deleted account”; your images, videos and files in them are removed.
• Marketplace ads are deleted 3 months after they expire or are sold, short film trailers 45 days after publication.
• Entries that protect the search from abuse are deleted after one day.

14. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time. Much of this works directly in the app:

• Settings → Download my data (a copy of all your data as a file)
• Settings → Delete account
• The visibility of every detail directly in your profile

For anything else, write to kontakt@cinebubble.com. You can also lodge a complaint with a data protection supervisory authority, e.g. [competent authority depending on location].

15. Changes

When the app changes, we update this policy. We inform you in the app about significant changes.