Privacy Policy
What is Bobine
Bobine is a private photo-sharing app for families. You and the people you invite share photos within a private monthly "cycle." Photos are visible only to members of your family group.
What information we collect
To run the service, we collect and store:
- Phone number — used to authenticate you via SMS one-time code (Firebase Phone Authentication).
- First name — chosen by you during sign-up. Visible to other members of your family group.
- Profile photo (optional) — if you choose to add one.
- Photos you upload — visible only to members of the family group(s) you belong to.
- Family group identifiers — the 6-digit code(s) of the family group(s) you join, plus a label chosen by the group's creator.
- Push notification token (optional) — if you opt in to push notifications, we store the device-specific token issued by Apple (APNs) or Google (FCM) so we can send you alerts.
- Anonymous usage events — app opens, photo uploads, family creations, push subscriptions. Used in aggregate to improve the product. No third-party analytics SDKs.
What we do NOT collect
- We do not collect your contacts.
- We do not track your location.
- We do not use third-party advertising or marketing SDKs.
- We do not sell or share your data with advertisers.
- We do not analyze the content of your photos.
How we use the information
- Authenticate you and keep you signed in.
- Show you and your family members the photos shared in your group.
- Send you push notifications (only if you opted in) about new photos and new family members.
- Operate, debug, and improve the service.
Who processes your data
Bobine relies on a small number of infrastructure providers (sub-processors). These providers process data on our behalf under Data Processing Agreements and do not have an independent right to use it:
- Cloudflare, Inc. (US, with EU data centers) — hosts the backend (Workers, KV, R2 object storage). Stores user records, family metadata, photos, and push subscriptions. Encryption at rest using Cloudflare-managed keys.
- Vercel Inc. (US, with EU edge) — hosts the web frontend and serves the PWA assets.
- Google LLC (Firebase Authentication) (US) — verifies phone numbers via SMS one-time codes. Firebase receives your phone number; it does not receive your photos or family content.
- Apple Inc. (APNs) (US) and Google LLC (FCM) (US) — deliver push notifications to your device when you opt in. Receive a device-specific token, not the content of your photos.
- Functional Software, Inc. d/b/a Sentry (EU region — Frankfurt, Germany) — error monitoring and performance tracking to debug crashes and failed requests. Receives anonymized error events with stack traces and your user ID (no photo content, no phone number).
Cloudflare, Vercel, Google, and Apple are based in the United States. We rely on the European Commission's Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework to lawfully transfer data to these providers. Sentry processes our data in the EU (Frankfurt) under GDPR.
How long we keep your data
- Account, profile, and photos — kept as long as your account is active.
- Session tokens — automatically expire after 30 days of inactivity.
- Error logs (Sentry) — 90 days, then automatically deleted.
- Server access logs — 7 days, then automatically deleted.
- Anonymous aggregated usage counters (app opens, photo uploads, etc.) — kept indefinitely in aggregated form. Cannot be tied back to an individual user.
If you want to delete your account and all associated photos, see the "Your rights" section below. We delete your data within 30 days of a valid request.
Your rights
Under the European General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), you have the right to:
- Access — request a copy of all personal data we hold about you, free of charge, delivered in a structured machine-readable format (JSON + ZIP of your photos) within 30 days.
- Rectification — correct any inaccurate personal data we hold.
- Erasure ("right to be forgotten") — delete your account and all associated photos within 30 days. This cascades to remove your photos from R2, your records from our KV store, your session tokens, and your push notification tokens.
- Portability — receive your data in a format you can transmit to another service.
- Withdraw consent to push notifications at any time via Profile > Settings > Notifications.
- Object to processing in some circumstances.
- Lodge a complaint with your local data protection authority (in France: CNIL, cnil.fr).
To exercise any of these rights, email dimittrichoudhury.dc@gmail.com with the phone number used to sign up. We respond within 30 days (typically much faster). These rights are exercised free of charge, except for manifestly unfounded or excessive requests.
Children
Bobine is intended for users 15 years and older in France (per article 7-1 of the French Data Protection Act, transposing GDPR article 8) and 13 years and older in other jurisdictions. We do not knowingly collect data from users below the minimum age in their country. If you believe a minor has provided data to us without parental consent, please contact us so we can delete it.
Security
All traffic between the app and our servers uses HTTPS. Phone authentication relies on industry-standard Firebase tokens (RS256-signed JWTs). Photos are stored in encrypted-at-rest object storage on Cloudflare R2. Push notifications are encrypted end-to-end using the standard Web Push protocol (RFC 8291 / 8292).
Changes to this policy
If we materially change this policy, we will update the "Last updated" date at the top of this page and notify users via push notification. Continued use of the app after a change constitutes acceptance.
Contact
Questions or concerns: dimittrichoudhury.dc@gmail.com