BUGGO Privacy Policy
Last updated: [EFFECTIVE DATE]
The short version
- BUGGO is for parents and carers (18+). We collect what the app needs: your sign-in email, your Family name, your children's month and year of birth (never the day) and optional nicknames, your stroller type, your Buggs, Plans, Trips and saved places, and the photos you add to your Passport.
- Your Family starts hidden. Until you switch "Show my family to families nearby" on, other families see your Buggs as "a family". Our website never shows your notes or anything about your children.
- We never keep a history of where you are. When you Bugg, your phone's position is used once to work out how far you were from the place; we keep only that distance. If you tap "Ask Bugg what's near" on Welcome, we also keep a rounded area (about 1 km) as your Family's home until you change it or delete your account.
- Your photos (Memories) stay in your Family. They are never shown to other families, never put on our website and never sent to an AI model.
- BUGGO AI is off until you switch it on. When on, your Buggs, your questions, your children's age ranges and your stroller type go to AI model providers through Vercel's AI Gateway. They may not use them to train models, but they may keep a request for a short time (up to about 30 days) to detect abuse. Family and children's names are never sent on purpose; please keep names out of what you type.
- Anonymous usage counts are off until you switch them on. If you allow "Share anonymous usage", we count which features are used (for example, that a Bugg was saved) with PostHog in the EU. Never your name, children, places or position, and it is not linked to your account.
- The map and place search come from Google.
- No ads, no tracking across other apps, no sale of your data.
- You can see, correct, download or delete your data. Delete your account in the app at any time.
- Questions or complaints: privacy@getbuggo.app. You can also complain to the ICO.
1. Who we are
BUGGO is run by [OWNER NAME], a sole trader trading as BUGGO, [POSTAL ADDRESS] ("BUGGO", "we", "us"). We are the controller of your personal data and are registered with the Information Commissioner's Office (ICO) under number [ICO REGISTRATION NUMBER].
Contact: privacy@getbuggo.app, or the Contact BUGGO row in the app's Settings. We have no data protection officer because this kind of processing does not require one; [OWNER NAME] answers every data protection question.
This policy covers the BUGGO app and our website [WEBSITE]. BUGGO accounts are for adults (18 and over). Children may look at the Passport on a parent's phone, but must not have their own account.
2. What we collect
You give us
| What | Details |
|---|---|
| Sign-in | Your email address. You sign in with a one-time code sent to it (our sign-in provider, Clerk, also records the session, device and browser type and IP address it needs to keep you signed in securely). |
| Your Family | The Family name you choose (up to 40 characters), your stroller type (none, single or double), your home city if you set one, an area you pick on the map (its name and position), an optional nap window (for example 13:00–14:30), and whether your Family is visible to others. |
| Your children | For each child: the month and year of birth (never the day), and an optional private nickname of up to 20 characters. Please don't use a full name. The app only accepts births that have already happened, never an expected baby. |
| Buggs | The place, your verdict (excellent, good or difficult), your amenity answers, an optional note (up to 140 characters), and — if you are the first family to Bugg a place — the name (up to 60 characters), picture type and city (up to 40 characters) you give it. We save a snapshot of your children's age ranges and your stroller type with each Bugg, and the date and time you made it. |
| Plans and Trips | For a Plan: the places, day and times, an optional note (up to 140 characters), an age focus, how many families may join, who can see it ("Just us" or families nearby) and which families join. For a Trip: a city and dates, and the day-by-day plan if you save one. |
| Passport | The Stickers you earn, Memories (photos you add to a Sticker, with the date taken if your phone gives it), Albums (the story written for a Chapter) and Postcards (the caption, layout and a short share code). |
| Ask Bugg | The questions you type or say, if BUGGO AI is on. Speech is turned into text on your phone; the audio never leaves it. |
| Saved places, reports, blocks, feedback | Places you save, Buggs you report and the reason you give (up to 200 characters), families you block, and whether you found an AI answer helpful. |
| Waitlist (website) | Your email and town, if you join. |
| Messages to us | What you send us by email. |
We collect when you use BUGGO
| What | Details |
|---|---|
| Location | Your phone's location, only if you allow it, to show places near you, to search nearby, and to check whether you are at a place when you Bugg. Your position is sent to our servers for that one request. For the map and nearby search it is passed to Google without your name or email (section 5); for a Bugg our servers only compare it with the place's position. We keep only how far you were from the place (to decide whether the Bugg earns a Sticker); we never store your exact position or a history of where you've been. The one exception is "Ask Bugg what's near" on Welcome: it saves your position rounded to about 1 km, with a city name, as your Family's home area, until you change it or delete your account. Apple's geocoder on your phone turns the exact position into that city name. When you ask Bugg something, the position is rounded to about 1 km on our servers and is never stored. |
| Activity counts | Which places your Family opens, saves or plans around (to tell other families "your Buggs helped 12 families"); weekly counts of Plans made and Ask Bugg answers (for the free tier); how many times you opened Ask; which places families asked about that no one has Bugged yet ("Wanted"). |
| Notifications | If you allow them, a push token for your phone and your time zone (so none is sent at night). We send notifications when a family joins your Plan (on), the evening before a Plan (on), after a Plan with "How was it?" (off unless you switch it on), and a Sunday note (off unless you switch it on); each has its own switch in Settings. We also send trial and renewal reminders for Passport+ by push and email. The token goes to Expo's push service (and through it Apple or Google) only to deliver them; the text names the place, never a family. A log of what was sent (type and time, no text) is kept 14 days. The token is deleted when you sign out or delete your account. |
| Invites | When your Family's main member invites a partner or carer, we keep the invite as a one-way hash of its link with who made it and when it expires, for as long as the Family exists. The people in a Family see each other's name, taken from the sign-in email. |
| Shared AI summaries | With BUGGO AI on, Home's "Bugg's pick for today" is one line written per area, age range, stroller type and weather and shared by families like yours; "What families say" is a shared summary of at least three notes per place. Both come only from notes by families who switched BUGGO AI on, hold no personal data and carry a Report action. The pick is kept 24 hours; a Family's Report of one is kept 400 days. |
| Subscription | Whether you have Passport+, which product, renewal and trial dates, and the purchase events Apple or Google send through RevenueCat. We never see your card details. |
| Anonymous usage counts | Only if you switch on "Share anonymous usage" (off until you switch it on in Family › Privacy; no prompt asks you). We then count a few events: that a Bugg was verified at the place (and whether it is your first ever), that you shared a Plan invite, that you joined a Plan, and the Ask, Plan, Trip, Album, Postcard and Passport+ screens you use. Each event has only counts, yes/no values and a fixed reason, never your name, email, children, a place name, a question or your position, and no account ID: PostHog gives the phone a random ID that we never link to your Family. PostHog's location lookup and IP storage are off. Nothing is sent until you say yes, and nothing in BUGGO depends on your answer. |
| Crash reports | When the app crashes or hits an error: device model, operating system, app version and what the app was doing. We switch off Sentry's collection of personal data, console logs and web addresses' query strings. |
| Website | Aggregate page-view and speed statistics (Vercel Web Analytics and Speed Insights), which do not use cookies. The website sets no cookies. We use these statistics only to improve the service; to |
| object, email privacy@getbuggo.app. |
We don't use advertising, advertising IDs, or tracking across other companies' apps and websites. We don't access your contacts. We send no marketing notifications.
3. Why we use it, and our lawful basis
| Purpose | Data | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Create and run your account and Family, sign you in | Email, Family, children (month/year, nickname), stroller | Contract |
| Map, Bugging, Family Score, Passport, Plans, Trips, Memories, Albums, Postcards | The data for each feature | Contract |
| Show your Buggs to other families (as "a family", or by name if you choose) and count them in scores | Buggs, age ranges, stroller type, Family name if visible | Contract; legitimate interests (a useful shared map for all families) for Buggs of hidden Families |
| Use your phone's location | Location | Consent, given through your phone's permission; withdraw it any time in the phone's settings |
| BUGGO AI features | Section 6 | Consent (the in-app switch) |
| Check notes, place names and Plan notes for harmful content, act on reports and blocks | Notes, names, reports, blocks | Legitimate interests (keeping BUGGO safe for families) and legal obligation (Online Safety Act 2023) |
| Passport+ and the free-tier counts | Subscription status and events, weekly counts | Contract |
| Prevent abuse and control costs | Daily usage counts | Legitimate interests |
| Understand which features are used, so we can improve BUGGO | Anonymous usage counts (section 2) | Consent (the in-app switch) |
| Fix crashes | Crash reports | Legitimate interests |
| "Your Buggs helped N families" | Place opens, saves, plans | Legitimate interests |
| Measure the website | Aggregate, cookieless statistics | Legitimate interests |
| Waitlist email | Email, town | Consent (you confirm by email; unsubscribe any time) |
| Passport+ renewal reminders (from January 2027) | Email, subscription dates | Legal obligation (DMCC Act 2024) |
| Answer your messages and requests | What you send | Legitimate interests; legal obligation for rights requests |
For your children's details we rely on our contract with you and, for showing age ranges to other families, our legitimate interests.
Where we rely on legitimate interests you can object (section 12).
4. Who sees what
Your Family sees everything in your Family's account. A Family has up to 6 adults. The main member can invite a partner or carer with a single-use link that works for 7 days. Everyone in a Family sees everything in it, including your children's details and Memories, and sees the name taken from your sign-in email. The main member can remove you; your sign-in stays.
Other people using the BUGGO app — other families (every app screen needs a signed-in Family; there is no guest mode):
- You start hidden. While "Show my family to families nearby" is off, other families see your Buggs as "a family", with the verdict, amenity answers, your note (once it has passed our checks), the age ranges and stroller type saved with the Bugg, and the day of the Bugg, never its time. Your Buggs still count in Family Scores and amenity counts.
- If you turn it on, anyone using the app also sees your Family name on your Buggs; signed-in families also see it in Matches and Plans, with where you are going on a Trip (a city and dates, for example "in Gran Canaria, 3–10 Oct") or your home city. Other families see the day of a Bugg, never its exact time; you see the time of your own Buggs.
- Plans are "Just us" by default — only families you invite see them. If you choose "Families nearby", families nearby can see the places, day and times, your Family (hidden or named as above), the note and the age ranges, and can join.
- Families you block, and families who block you, don't see each other's Buggs.
Anyone on the internet (our website and links you share):
- Place pages show the place's name (as its first Bugger named it), its Family Score and how many families it comes from, amenity counts and how recent they are, the day the place was last Bugged, and which age ranges have visited overall. Never a Family name, a note, or a particular family's children.
- Neighbourhood pages show place totals, and the names of Founding Families who are visible (hidden Founding Families appear as "a family").
- A Plan link you share shows the places, day and times, the area, how many families are going and their age ranges combined, and the name of the Family that made it if that Family is visible. It never names the families who joined. Anyone who has the link can open it.
- A Postcard link opens a page for the place. Never your photo, caption or Family.
Never shown to anyone outside your Family: your email, your children's birth month and year and nicknames, your Memories, your Ask Bugg questions, your saved places, your nap window, your position.
5. Who we share it with
We use the companies below to run BUGGO. Processors act only on our instructions under a contract (Art. 28) that requires them to protect your data to the same standard as this policy. Independent controllers decide how they use data under their own privacy policies. We have listed where each one processes data; section 10 explains how data leaving the UK is protected.
| Company | What for | What they get | Where | Role |
|---|---|---|---|---|
| Convex, Inc. | Our database, file storage (including Memories) and server code | Everything in section 2 except crash reports, website statistics, and the sign-in sessions Clerk holds | EU (Ireland) | Processor |
| Clerk, Inc. | Sign-in | Email, one-time codes, sessions, device and browser type, IP address | United States | Processor |
| Vercel Inc. | Our website; routing BUGGO AI requests (AI Gateway); website statistics | Website requests; the contents of AI requests (section 6) | United States and global edge | Processor |
| AI model providers reached through Vercel's AI Gateway: OpenAI, Google (Gemini API and Vertex AI) and Microsoft Azure (which runs OpenAI models); no other provider is allowed | BUGGO AI answers, plans, stories, captions and note checks | Only what section 6 lists | United States and other regions where each provider runs | Processor, engaged through Vercel |
| PostHog, Inc. | Anonymous usage counts, only if you allow them | The events in section 2 with a random phone ID; no name, email or account ID | EU (Frankfurt) | Processor |
| Functional Software, Inc. (Sentry) | Crash and error reports from the app and website | Crash data (section 2) | EU (Germany) | Processor |
| RevenueCat, Inc. | Passport+ subscriptions | Your Family's BUGGO ID and your purchase history from Apple or Google | United States | Processor |
| Resend (Plus Five Five, Inc.) | Sending waitlist emails and, from January 2027, Passport+ renewal reminders | Email address, email content | EU | Processor |
| Google (Google Maps Platform) | The map, place search and details, place photos, walking times, some AI answers about a place | Your position or the map area, your search words, place IDs; with BUGGO AI on, your question about a place. From our servers these go without your name, email or account ID. The map itself runs on your phone and connects to Google directly, so Google also receives your phone's IP address, device information and how you use the map. | Global | Independent controller — Google Privacy Policy |
| Apple (App Store) and Google (Google Play) | Selling Passport+ and taking payment | Your purchase (you are already their customer) | Global | Independent controllers |
| Apple WeatherKit | The weather for a city | A city's position, nothing about your Family | United States and global | Processor (Apple Developer Programme terms) |
| Expo (Expo Inc.) | Delivering notifications and app updates | Push token, phone model, IP address | United States | Processor |
We also generate City Sticker art with Recraft from a city name only; no family data is sent.
We may also share data if the law requires it, to protect someone's safety, or if BUGGO is sold or merged (the new owner would have to keep to this policy). We don't sell your data and don't share it for advertising.
6. BUGGO AI
BUGGO AI is off until you switch it on — the first time you use an AI feature, or in Settings or Family › Privacy ("Let BUGGO AI use my Buggs"). Switching it off stops new AI requests straight away. Answers already made are kept for the periods in section 8, or until you delete your account.
What we send to AI model providers, through Vercel's AI Gateway, when it's on:
- your Ask Bugg questions (typed, or spoken and turned into text on your phone) and the area you are looking in;
- when you talk to fill in a Bugg, the words you said;
- your children's age ranges (for example "1–2y") and your stroller type, your nap window if you set one, and your Trip's city and dates;
- places near you as BUGGO knows them: the names families gave them, their city, Family Scores, amenity counts, age-range counts, and up to three recent notes only from families who have also switched BUGGO AI on;
- the weather for the day;
- for an Album story or a Postcard caption: your Buggs, Stickers, Plans and Trips in that Chapter, the place names, dates and weather;
- for a note check: the note itself (section 6, Moderation).
What we never send on purpose: your email, your Family name (Album stories and Postcard captions are written with a placeholder that we fill in on our servers after the answer comes back), your children's birth month and year, your position, Google's own place content (except for the place questions below), or any photo.
Names in what you type. We replace your children's nicknames with "[child]" before a question reaches the AI in the main question box and in "Ask about a place". We cannot catch every name, and we don't mask the notes families write on Buggs. Please don't type anyone's name, health details or anything private into a question or a note.
Protections. Every request tells the AI Gateway that providers may not use it to train their models, and the Gateway only sends it to providers on our approved list that have agreed to that. We do not buy "zero data retention": a provider may keep a request for a limited time under its own terms (up to about 30 days) to detect abuse, and then deletes it. We don't log what you send: our logs record only the type of request, the model and how long it took.
Moderation. If your Family has BUGGO AI on, an AI model checks the notes on your Buggs for harassment, contact details and sexual content before other families see them; a note it flags is hidden. If BUGGO AI is off, or the AI is unavailable, we check the note with our own word list on our servers instead. Place names, city names and Plan notes are always checked with our word list only, never by AI.
Place questions and Google. Some answers about one place (for example "is it busy at lunchtime?") use Google Maps' AI tools. Google receives your question and the place's position, without your name or account. What Google sends back is then summarised by the AI model.
Automated decisions. AI answers are labelled "Suggested by BUGGO AI" and can be wrong; check before you go. The note check decides automatically whether a note is shown to others; if you think a note was hidden wrongly, contact us and a person will look at it. No AI decision has a legal or similarly significant effect on you.
7. Photos (Memories), Albums and Postcards
- You choose which photos to add, using your phone's photo picker. Before upload, your phone re-draws the photo at a smaller size, which removes its hidden data (EXIF), including where it was taken. We keep the date it was taken, if the phone provides it.
- Memories are stored in our file storage and shown only to your Family. They are never shown to other families, never on our website and never sent to an AI model.
- Albums (including the PDF) and Postcards are put together on your phone. The PDF and the finished Postcard picture are not uploaded to us; they go wherever you share or save them. We keep the Album's story text and the Postcard's caption, layout and share code.
- If you undo a Bugg, its Postcards are deleted and their links stop working; the Memory's photo stays in your Passport. If you delete a Memory, its Postcard is deleted too.
8. How long we keep it
| Data | How long |
|---|---|
| Account, Family, children, Buggs, Plans, Trips, saved Trip and day plans, Memories, Albums, Postcards, saved places, AI feedback | Until you delete them or your account |
| Weekly free-tier counts | 8 weeks |
| Subscription events | 400 days |
| Push token (notifications) | Until you sign out or delete your account; 270 days after the app last refreshed it |
| Notification log (type and time) | 14 days |
| Home area (Welcome) | Until you change it or delete your account |
| Invites | As long as the Family exists |
| After you delete your account | Your Family is hidden at once and removed from BUGGO in the background, normally within minutes and at most 30 days. Your sign-in account at Clerk and your subscriber record at RevenueCat are deleted at the same time. Copies in our database provider's backups are overwritten within 14 days. |
| AI answers, including stored Ask Bugg questions | Up to 30 days (some sooner) |
| System records of background tasks (they can include an AI question or spoken text) | Up to 7 days |
| Photo uploads never attached to a Memory | About 1–2 days |
| "Helped" counts (which places a Family opened, saved or planned around) | 60 days |
| Daily usage counts | 7 days |
| "Wanted" (which Families asked about a place with no Bugg yet) | 365 days after the last ask, or until the place is Bugged or your account is deleted |
| Reports | 400 days, or until the reported Bugg, or the reporting Family, is deleted |
| Blocks | While either Family's account exists |
| Google Maps answers about a place (no family data) | 30 days |
| Crash reports | 30 days |
| Anonymous usage counts | Up to 12 months [OWNER: set this as the PostHog project's data-retention period] |
| Waitlist | Until you unsubscribe (deleted within a day) or we have sent the one email; unconfirmed sign-ups after 30 days |
| Emails to us | 12 months after the matter is closed |
Totals that no longer identify anyone (Family Scores, amenity counts) stay after your Buggs are deleted. The name you gave a place as its first Bugger stays as that place's name (Terms §4).
9. Children
BUGGO is for parents and carers, but it holds some information about children, and children may look at the Passport on a parent's phone. We design BUGGO around the ICO's Age Appropriate Design Code (the Children's Code):
- Only what we need: month and year of birth (never the day), turned into an age range such as "1–2y" when needed, and an optional private nickname. We never share a child's photo.
- Only age ranges leave your Family — to other families (with your Buggs), to AI providers (if you switch AI on), and as combined totals on our website. Never a child's nickname or birth month and year.
- Private by default: new Families start hidden, new Plans start "Just us", BUGGO AI starts off, and location is off until you allow it.
- No profiling of children, no ads, no streaks, countdowns or guilt notifications. Notifications are in Settings and none is sent between 20:00 and 08:00.
- We do not market BUGGO to children, and it is not designed to appeal to them.
- A child must not have their own account. If we learn that an account belongs to someone under 18, we will close it.
10. Where your data is stored
Our main database is in the EU (Ireland). The UK treats the EU as giving adequate protection. Some of the companies in section 5 are in the United States or process data there. When your data goes to the US, we rely on the UK Extension to the EU-US Data Privacy Framework for companies certified to it (for example Clerk), and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment. Ask us for details at privacy@getbuggo.app.
11. Keeping it safe
Data is encrypted between your phone and our servers. Your Family's private data is shown only to signed-in members of your Family, and our team accesses it only when needed to run BUGGO, answer you or fix a fault. Server keys are never in the app. Your position is sent to Google through our servers without your identity. If a breach puts you at high risk, we will tell you without undue delay.
12. Your rights
You can ask us to:
- see a copy of your data (access);
- correct it — most of it you can change in the app;
- delete it — delete a Bugg, Memory, Trip or Plan in the app, or your whole account in Settings › Delete my family and account;
- have it in a machine-readable format (portability) — in the app, Settings › Download my data; this does not include your photos, which we send by email within one month;
- restrict how we use it, or object to uses based on legitimate interests;
- withdraw consent at any time — switch off BUGGO AI or "Share anonymous usage" (Family › Privacy), location in your phone's settings, or unsubscribe from the waitlist. Switching off usage counts stops them at once and resets the random phone ID. This doesn't affect what we did before.
Email privacy@getbuggo.app. We reply within one month (we can extend this by two more months for complex requests, and will tell you why). We may ask you to confirm it's you. You don't have to pay.
Deleting your account. If you are the only member of your Family, or its main member, deleting your account deletes your Family, children, Trips, Buggs, Plans you created (you are taken off Plans you joined), Memories and their photos, Albums, Postcards, saved places, reports you made, blocks, AI answers and feedback, and your subscription records, and deletes your sign-in account at Clerk and your record at RevenueCat. A partner or carer who deletes their account removes only themselves; the Family stays. It does not cancel a Passport+ subscription — cancel that in the app store you bought it from.
Complaints. If you're unhappy with how we handle your data, tell us first at privacy@getbuggo.app. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
13. Changes
If we change this policy, we'll update the date at the top and tell you in the app before important changes take effect. If a change needs your consent (for example sending new kinds of data to AI, or sending photos to AI), we'll ask first.