Privacy policy
Last updated: September 30, 2026
- We only collect what Glub needs to work: your account, your profile and what you post.
- Your data is stored in the European Union (Ireland).
- No ads, no audience measurement tools, and we never sell your data.
- Your date of birth, gender and email address are never shown to other users.
- You can delete your account at any time from the app: your data and photos are then erased.
1. Who is responsible for your data?
The data controller is Florian Rochault, publisher of Glub (see the legal notice). For any question about your data, write to support@glubapp.com.
2. What data, and why?
| Data | What it's used for | Legal basis |
|---|---|---|
| Email address and password (stored encrypted, never readable) | Creating your account, signing in, confirming your address, resetting your password | Performance of the contract (terms and conditions) |
| Username, first name, profile picture, description, traveler type | Your profile, visible to other signed-in users | Performance of the contract |
| Date of birth | Checking that you are at least 16. It is not shown to others. | Performance of the contract and legal obligation |
| Gender | Giving access to "Women only" groups. It is not shown to others. | Performance of the contract |
| City (chosen by you) and search radius | Suggesting groups and posts near you. The app does not use your phone's GPS location. | Performance of the contract |
| Languages spoken | Showing the languages spoken in each group. You are asked for them when you join or create your first group. | Performance of the contract |
| Groups joined or created, messages, reactions | Running groups and messaging | Performance of the contract |
| Posts (type, texts, photos, videos and their preview image, chosen place), comments, likes, collections and the posts saved in them, follows between users | Running the feed, collections and My map | Performance of the contract |
| Shared collections: who shared which collection with you, and who you share yours with | Giving you access to the collections shared with you, and letting you know when their owner adds posts | Performance of the contract |
| App language (French or English) | Sending you notifications in your language | Performance of the contract |
| Your phone's notification token and notification preferences | Sending you the notifications you accepted | Consent (asked by your phone, can be withdrawn at any time in its settings) |
| Reports (what you report, or reports about you) | Moderating and protecting the community | Legitimate interest (community safety) |
| Premium subscription: plan, dates, Stripe customer ID | Managing your subscription. Your card details are entered directly with Stripe: they never go through our servers. | Performance of the contract and accounting obligations |
| Technical data (IP address, error logs, crash reports) | Securing the service, preventing abuse, fixing problems | Legitimate interest |
3. Who sees what?
- Other signed-in users see your public profile (username, first name, picture, description, city, traveler type, Premium badge, your followers and the people you follow), your posts and the place attached to them, and your comments.
- Members of a group see that group's messages.
- Your collections are private. A collection you share is visible to the people you share it with (they must follow you). Its content is only accessible to Premium accounts; its name and yours remain visible to the person who receives it, even without Premium.
- Someone without an account sees nothing, except a post or collection a member shared by link: they then see that content, with its author's username and profile picture, on a page of the glubapp.com website. These pages are not listed by search engines. A collection's owner can turn off its link at any time.
- No one except the Glub team sees your email address, date of birth, gender, or who you reported.
4. Who is it shared with?
We never sell your data and never share it for advertising. It is only entrusted to the technical providers the service needs, who are not allowed to use it for their own purposes:
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, accounts, server functions | European Union (Ireland) |
| Cloudflare (R2) | Storage of photos and videos | Cloudflare's global infrastructure |
| Resend | Sending the app's emails (confirming your address, forgotten password) | European Union (Ireland) |
| Stripe | Payment of the Premium subscription | European Union (Ireland) and United States |
| Expo, Apple and Google | Delivering notifications to your phone | United States |
| Sentry | Detecting app crashes and errors (technical report: error, phone model, app version, technical account ID; no email, username or content) | European Union (Germany) |
| Geoapify | City and address suggestions while you type (only receives the text searched, through our servers: neither your identity nor your IP address) | European Union (Germany) |
The glubapp.com website loads its fonts from Google Fonts, and share pages show an OpenStreetMap background map (loaded with the Leaflet tool, via unpkg). As with any website, these services receive the visitor's IP address in order to send these files. No cookies are set.
When data is processed outside the European Union, these transfers are covered by the safeguards provided by the GDPR (European Commission standard contractual clauses, or certification under the EU–US Data Privacy Framework).
5. How long is it kept?
| Data | Retention |
|---|---|
| Account, profile, posts, comments, collections, groups | As long as your account exists. Deleted as soon as you delete your account. |
| Photos and videos | As long as your account exists. Erased when you delete your account. |
| Group messages | 1 month, then erased automatically |
| Account never confirmed by email | 7 days, then deleted automatically |
| Reports | 3 years at most |
| Invoices and payment records | 10 years (accounting obligation), kept by Stripe and by the publisher |
After a deletion, copies may remain for a limited time in our providers' technical backups before being overwritten.
6. Your rights
At any time, you can:
- access your data and get a copy of it;
- correct it (mostly directly in the app, from My account);
- delete it: My account → Delete my account. Deletion is immediate and also stops your Premium subscription;
- retrieve it in a reusable format (portability);
- object to processing based on legitimate interest, or ask for it to be restricted;
- withdraw your consent to notifications, in your phone's settings;
- set instructions about what happens to your data after your death.
To exercise these rights, write to support@glubapp.com from your account's email address. We reply within one month at most.
If you believe your rights are not respected, you can file a complaint with the CNIL, the French data protection authority, or with the authority of your country.
7. Minimum age
Glub is for people aged 16 and over. Age is checked at sign-up using the date of birth.
8. Security
Exchanges between the app and our servers are encrypted. Access to each piece of data is limited by security rules enforced directly by the database: everyone only accesses what they are allowed to see. Passwords are never stored in plain text.
9. Cookies
The glubapp.com website does not use tracking or audience measurement cookies. The app contains no ads and no audience measurement tools.
10. Changes
If this policy changes significantly, we will notify you in the app before the changes take effect.
The French version of this policy is the legally binding one.