Privacy Policy

1. Who we are

This Privacy Policy explains how Enheart ("we", "us"), the developer of Bubbly, collects, uses, shares and protects personal information when you use the Bubbly app for Android and the website at bubblydive.lovable.app (the "Service"). Enheart is responsible for your personal information. Privacy questions and requests: support@enheart.me.

2. Information we collect

Information you give us

• Account: your email address and sign-in method. If you sign in with Google or Apple, we receive the email address (Apple may give a private relay address) and the name that provider shares. If you use a password, it is handled by our authentication provider and stored only in hashed form.
• Dive logs: what you enter, such as dive dates and times, dive type, depth, duration, temperatures, dive-site name and coordinates, dive shop, equipment, conditions, mood, buddy names, notes, stickers and sticker notes, and your dive numbering.
• Imported dives: when you import from a dive-computer file (FIT, UDDF), the dive profile samples in it (for example depth, temperature, tank pressure and other gas or decompression values), the device manufacturer and model, a one-way hash of the device serial number (used only to detect duplicate imports), and the dive's identifier in the source file.
• Preferences: language and units.
• Support: the content of emails you send us, including any diagnostic report you choose to attach from the import screen.

Information from your device, with your permission

• Location (precise or approximate, as you allow), only when you tap the button to fill in a dive site's coordinates. We store the coordinates you save with the log. Bubbly does not access your location in the background.
• Photos and videos, read on your device (only the ones you allow) to show those taken on a dive day next to that dive. They are not uploaded to us or anyone else.
• Advertising ID, used by Google AdMob to serve ads on the free plan. You can reset or delete it in your device settings (Settings > Google > Ads, or Settings > Privacy > Ads, depending on your device).

Purchases and plan status

• Your plan (free or Premium), how Premium was obtained (subscription or promo code), subscription expiry, promo codes you redeem, and extra log passes earned from rewarded ads.
• Subscription events from our subscription provider, RevenueCat, such as the product, store, purchase and expiry dates, price and currency, country, and transaction identifiers. We never receive your payment card details; payment is handled by Google.

Stored on your device

• A copy of your profile, logs and stickers is cached on your device so the app works offline, and is synced when you are back online.

We do not use analytics or crash-reporting SDKs, and we do not collect contacts, microphone or camera data.

3. How we use information

• to create and secure your account and sign you in;
• to store, sync and display your dive logs and render the cards you create;
• to import dives from files;
• to provide Premium, verify subscriptions, apply promo codes and the free-plan limit, and grant rewarded-ad log passes;
• to show ads on the free plan;
• to answer support requests and fix problems you report;
• to prevent abuse and to comply with legal obligations.

We process information to perform our contract with you (running the Service), with your consent (location, photos), for our legitimate interest in keeping the Service secure, and to meet legal obligations. We do not use your information for automated decisions with legal or similarly significant effects, and we do not use it to train AI models.

4. Who we share information with

We do not sell your personal information. We share it only with:

• Supabase — database, authentication, file storage and server functions that hold your account and dive logs.
• Lovable — hosting of the Bubbly website and, when you sign in with Google or Apple on the website, the sign-in redirect.
• RevenueCat — subscription management. It receives your Bubbly account identifier and your store purchase records.
• Google — Google Play processes payments; Google and Apple provide sign-in if you choose them.
• Google AdMob — ads on the free plan. AdMob receives device and ad interaction data, your IP address and, where permitted, your advertising identifier. See how Google uses data in ads.
• OpenStreetMap — when a map is shown, your device downloads map tiles, which reveals your IP address. No account data is sent.
• Google Fonts — the app and website load their fonts from Google, which reveals your IP address. When you create a dive card, the set of characters that appear on the card (for example, letters of the site name and notes) is sent to Google Fonts so only the needed glyphs are downloaded.
• GitHub — app updates delivered outside the app store are downloaded from GitHub, which reveals your IP address. No account data is sent.
• Authorities, when required by law or to protect rights and safety.

We share only what each provider needs, and we use only providers that protect personal information to a standard at least equal to this Policy. When you share a dive card or a .bubbly file, it goes to the people and apps you choose.

5. International transfers

To run the Service, personal information is transferred over the network, as you use it, to providers outside Korea (and outside your country, if different):

• Supabase — database in Japan (AWS Tokyo); server functions may run in other regions. All account and dive-log data. Kept until you delete your account.
• RevenueCat, Inc. — United States. Account identifier and purchase records, for subscription management. Kept under RevenueCat's retention policy or until we request deletion.
• Google LLC (AdMob, Google Fonts, Google sign-in) — United States. Device, ad and network data as described above.
• Lovable — website hosting and web sign-in. Network data and sign-in redirect.

These transfers are necessary to provide the Service under our contract with you. You can refuse them by not using the Service or by deleting your account; the Service cannot operate without them.

6. How long we keep information

• Account data and dive logs are kept while your account exists and are deleted when you delete your account.
• Records of subscription transactions are retained for 5 years after the transaction, as required by the Korean Act on Consumer Protection in Electronic Commerce, including after you delete your account.
• Deleted data may remain in our providers' backups for a limited time until they are overwritten.
• The offline cache on your device is removed when you delete your account in the app or uninstall it.
• RevenueCat and Google keep purchase records under their own policies; ask us and we will delete your record at RevenueCat.

7. Deleting your account

In the app: Settings > Delete account. On the web: open bubblydive.lovable.app/delete-account and sign in, or sign in at bubblydive.lovable.app and go to Settings > Delete account. Deletion is permanent and removes your profile, dive logs, imported dive data, stickers and promo redemptions. You can also email support@enheart.me from the address on your account to ask us to delete it.

Deleting your account does not cancel a store subscription. Cancel it first in your Google Play subscriptions, as described in the Terms of Use.

8. Your rights and choices

• You can view and correct your dive logs and preferences in the app at any time.
• You can ask us for access to, a copy of, correction, deletion or restriction of your personal information, or object to its processing, by emailing support@enheart.me. We reply within 10 days, or explain if we need longer.
• You can withdraw consent at any time without affecting earlier processing.
• Location and photo/video permissions can be turned off at any time in Android Settings > Apps > Bubbly > Permissions. Turning one off stops future access; data already saved to your account stays until you delete it or your account.
• If you are not satisfied with our answer, you can complain to your data protection authority. In Korea: the Personal Information Infringement Report Center (privacy.kisa.or.kr, call 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, call 1833-6972).

9. Additional information for users in Korea

• Processing entrusted to others: Supabase (data storage, authentication, server functions), Lovable (website hosting, web sign-in), RevenueCat (subscription management). We do not provide personal information to third parties for their own purposes, except to Google for advertising as described above and where the law requires.
• Destruction: when you delete your account, or a retention period ends, the data is deleted from our database without delay; copies in provider backups are overwritten on their backup cycle. Records kept under law are stored separately from other data.
• Automatically collected information: the app stores an offline copy of your data in your device's local storage (not cookies); remove it by deleting your account or uninstalling the app or clearing its storage. Advertising identifiers and ad interaction data are collected by Google AdMob to show and measure ads; you can refuse through your device's Ads settings.

10. Security

Information is encrypted in transit, and database access rules limit each account to its own data. Passwords are stored only in hashed form. Access to production systems is restricted. No system is completely secure; if a breach affects your information, we will notify you and the authorities as the law requires.

11. Children

The Service is not directed to children, and you must be at least 14 to use it. We do not knowingly collect personal information from children under 14. If you believe a child has given us information, contact us and we will delete it.

12. Changes to this Policy

We will post any update on this page with a new effective date. Where the law requires, we will also notify you before material changes take effect.

13. Contact

Privacy contact: Enheart — support@enheart.me