Privacy Policy

Information we collect

Information you give us

• Account details: your name or display name, email address or mobile number (used for sign-in codes), an optional profile photo, and your birth year so we can apply age rules.
• Groups and events: the groups you create or join, group names and categories, events you create, invites, and your responses (Going, Maybe, Can't go).
• Messages and shared content: chat messages, replies and reactions, plus photos, videos, files and places you share with a group.
• Contacts you choose to invite: if you invite someone, we use the phone number or email you pick to send the invite. If you allow contacts access, the app reads your contacts on your device to help you choose people. We don't upload your whole address book.
• Support and feedback: what you send us when you contact support, report a problem or report content.

Location, only when you turn it on

Location sharing is optional and tied to a single event:

• Bluup asks about an hour before an event, and only if you've marked yourself Going.
• While you're sharing, we collect your device's location to show your position, travel mode and estimated arrival time to the other attendees. This can include while the app is in the background, so your group still sees you on the way.
• Sharing ends when you tap Stop, when you get home, when the event wraps up, or after your chosen time past the event's end. It never runs longer than six hours.
• Home-safe check: if you set a home location, it's stored only on your device. When you arrive, the app sends your group a "home safe" signal, not your home's location.
• We also use an approximate area to help you search for places when you create an event.

We keep detailed location points only while sharing is active and delete them within [24 hours] after sharing ends. Arrival times and "arrived" or "home safe" status may stay in the event's history for your group.

Information collected automatically

• Device and app data: device type, operating system, app version, language, and a push-notification token so we can send you alerts.
• Usage and diagnostics: basic records of how the app is used, such as screens opened, crash reports and performance data, to keep Bluup working and improve it.
• Security data: IP address, sign-in attempts and similar records used to prevent fraud and abuse.
• Website: getbluup.com uses only the basic logs needed to run the site. It doesn't use advertising cookies. If you sign up for early access, we store your email address, the time you signed up, the page you used, your browser type and a scrambled (hashed) version of your IP address to prevent abuse. We use it only to email you about Bluup's launch. Every email includes an unsubscribe link.

How we use information

• To run Bluup: create your account, sign you in, deliver messages and invites, show events, and share location with the people you chose.
• To send notifications you've turned on, such as new messages, invites, someone on their way, or someone home safe.
• To keep people safe: check uploads for harmful content, review reports, enforce our Terms and Child Safety Standards, and prevent fraud and abuse.
• To provide support and respond to your requests.
• To fix bugs, measure performance and improve features, using combined or de-identified data where we can.
• To meet legal obligations.

We don't use your messages, photos or location for advertising, and we don't build advertising profiles.

How information is shared

• With your groups: your profile, messages, shared content, responses and (when you turn it on) live location are visible to members of the group or event you share them with.
• With service providers who run parts of Bluup for us under contracts that limit how they use the data and require them to protect it at least as well as we do. These include:
  • cloud hosting, database, file storage and email/SMS delivery (Amazon Web Services);
  • maps, place search and route estimates (Google Maps Platform [and Apple Maps on iPhone]);
  • push notifications (Apple Push Notification service, Firebase Cloud Messaging and Expo);
  • [crash reporting and analytics provider].
• With a parent or guardian: for users under 18, the linked parent account can see the groups their child is in, who's in them, and their chats and photos, and can manage the child's settings.
• For safety and legal reasons: when the law requires it, to respond to valid legal process, to protect someone from harm, or to report child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC).
• In a business transfer: if Bluup is merged, acquired or sold, information may transfer as part of that deal. This policy would continue to apply to it.

We don't sell personal information or share it for cross-context behavioral advertising.

Children and families

Bluup is for people aged 10 and up. Children under 10 may not use Bluup.

• Under 18: every account must be linked to a parent or guardian, who supervises it. Location sharing, adding new contacts and sharing personal details require the parent's approval. Kids see an in-app reminder about staying safe online before they can share photos or messages.
• Ages 10 to 12: the parent must also give consent before the child can use Bluup, and we collect only what the app needs to work.
• Parents' rights: a parent can review their child's information, change their settings, withdraw consent, or have the account and its data deleted, in the app or by contacting hello@getbluup.com.

We handle children's information in line with the Children's Online Privacy Protection Act (COPPA) and similar laws. If we learn we've collected information from a child under 13 without a parent's consent, we'll delete it.

How long we keep information

• Account and profile: as long as your account is open.
• Messages and shared content: as long as the group exists, unless you or a group admin delete them sooner.
• Detailed live location: deleted within [24 hours] after sharing ends.
• After you delete your account: we delete your account and personal information within 30 days. Copies in encrypted backups are erased within a further 35 days. We may keep limited records longer when the law requires it, to resolve disputes, or to act on safety reports. See Delete your account for details.

Your choices and rights

• Permissions: you can turn location, contacts, camera, photos and notifications on or off at any time in your phone's settings. To stop location sharing for an event, tap Stop.
• Access, correction and deletion: you can edit your profile in the app, ask us for a copy of your information, or delete your account.
• Withdrawing consent: you can withdraw consent at any time by turning off the feature or contacting us. This won't affect anything processed before you withdrew.
• State and international rights: depending on where you live (for example California, other US states, the UK or the EU), you may have rights to know, access, correct, delete or move your information, and to object to or limit certain uses. We won't treat you differently for using these rights. To make a request, email hello@getbluup.com. We may need to confirm your identity first.

Security

We protect your information with encryption in transit and at rest, access controls, and private links for shared files. No system is perfectly secure, so please keep your phone and sign-in codes private. If we learn of a breach that affects you, we'll tell you as the law requires.

Where information is stored

Bluup is run from the United States, and your information is stored on servers in the United States. If you use Bluup from outside the US, your information is transferred there, with protections that the law requires.

Changes to this policy

We'll update this page when our practices change, and change the "Last updated" date above. If a change is significant, we'll tell you in the app before it takes effect.

Contact us

Privacy questions and requests: hello@getbluup.com
[Company legal name], [Mailing address]