Privacy Notice

1. What We Collect

• Account information — your email address (and, if you sign in with Apple, the identifier Apple provides) used to create and authenticate your account.
• Profile & @username — the public handle and profile details you choose so others can send to you.
• Device identifiers — a push-notification token tied to your device so we can notify you about incoming transfers.
• Transfer metadata — technical details needed to coordinate a transfer, such as file hashes (SHA-256), file sizes, media type, and delivery status. Optionally, embedded media metadata such as capture date or dimensions travels inside your files; you can strip location data before sending in Settings.

2. What We Do Not Collect

We do not inspect, scan, or analyze the contents of your photos and videos. Media bytes are encrypted with AES-256-GCM before they leave your device and are only decryptable by the intended recipient. We cannot read your media.

3. How We Use Data

• To create and secure your account and authenticate you;
• To route and deliver your transfers and verify their integrity;
• To let other users find you by @username and to manage friend relationships;
• To send transactional push notifications about transfers you are part of.

4. Data Sharing & Third Parties

We do not sell your personal data. We rely on a small number of infrastructure providers strictly to operate the Service:

• Supabase — provides authentication, database, and encrypted object storage for relayed transfers.
• Apple Push Notification service (APNs) — delivers push notifications to your device.

These providers process data on our behalf under their respective terms. We may disclose data if required by law.

5. Data Retention & Deletion

Relayed media objects are stored transiently and automatically deleted from the server no later than 30 days after creation, typically sooner once accepted. Peer-to-peer transfers are never stored on our servers. Account data is retained while your account is active. When you delete your account, your account and associated data are permanently removed.

6. Your Rights

• Access — you can view your profile and account information in the app;
• Correction — you can update your profile and @username;
• Deletion — you can permanently delete your account in-app, which wipes all associated data.

Depending on where you live, you may have additional rights under applicable law. To exercise them, contact us using the details below.

7. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us personal data, contact us and we will delete it.

8. Changes to This Notice

We may update this Privacy Notice from time to time. We will revise the "Last updated" date above and, for material changes, provide notice within the app.

9. Contact

Questions about your privacy? Contact us at privacy@babybeeapp.com.