Nubylo ("we", "our", "us") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights.
1. Information We Collect
Account information: When you sign up, we collect your name, email address, and phone number. Your phone number is verified via one-time SMS code and then stored only as a SHA-256 hash — we do not store the raw phone number on our servers.
Location data: When you use the app, we collect your device's GPS coordinates to show your position on the map to your matched contacts. Live location is shared in real time and automatically removed from our servers when you close the app. A "last known" location is retained for up to 3 days, then permanently deleted.
Contacts: With your permission, we access your device's phone contacts to find mutual Nubylo users. Contact phone numbers are hashed on your device before being sent to our servers — we never see or store raw phone numbers from your address book.
Status messages: You may optionally set a short status message (e.g., "On my way!") visible to your matched contacts.
2. How We Use Your Data
- To show your location to your matched contacts on the map
- To match you with contacts who also use Nubylo
- To verify your identity via phone OTP
- To display your name and status to your trusted circle
- To improve app reliability and fix bugs
3. What We Don't Do
- We do not sell your data to anyone
- We do not use your data for advertising
- We do not share your location with third parties
- We do not track you across apps or websites
- We do not use third-party analytics or tracking SDKs
4. Data Storage & Security
Your data is stored using Firebase (Google Cloud Platform) with industry-standard security measures including encryption in transit and at rest. Access to your Firestore document is restricted to you and your matched contacts (limited fields only). Realtime Database entries are readable only by authenticated users.
5. Data Retention
- Live location: Deleted instantly when you close the app (via Firebase onDisconnect)
- Last known location: Auto-purged after 3 days
- Account data: Retained until you delete your account
- Phone hash index: Removed when your account is deleted
6. Your Rights
You can:
- Stop sharing your location at any time by closing the app
- Block any contact — blocking is instant and mutual
- Request deletion of your account and all associated data by contacting us at hello@nubylo.com
7. Children's Privacy
Nubylo is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.
8. Third-Party Services
We use the following third-party services:
- Firebase Authentication — for sign-in and phone verification
- Firebase Firestore & Realtime Database — for data storage
- Firebase Cloud Functions — for server-side contact matching
- Google Sign-In & Apple Sign-In — for authentication
These services have their own privacy policies. We encourage you to review Firebase's privacy policy.
9. Changes to This Policy
We may update this policy from time to time. Changes will be posted on this page with an updated date. Continued use of the app after changes constitutes acceptance.
10. Contact Us
If you have questions about this privacy policy or your data, contact us at: