Privacy Policy
Bulbulery · Last updated 12 September 2026
Who we are
Bulbulery is a group travel planner: plan an itinerary, track what everyone spent, settle up at the end. This policy explains what the app stores, where, and who can see it.
What Bulbulery collects
Your account. When you sign in with Google or with Apple, we receive your email address and basic profile information from whichever one you chose. Sign-in is handled by Supabase Auth; we use it to know that it is you when you open the app on another device. If you use Sign in with Apple and choose to hide your email address, the relay address Apple gives us is the only one we ever see.
What you type into the app. Trip names and dates, destinations, places you add to an itinerary (including their location), expenses and who paid, how a bill was split, settlements, notes, to-do items, and any photos or files you attach.
A display name and avatar colour you choose, which is what other members of your trips see.
Device-local settings, such as which maps app you prefer.
What Bulbulery does NOT collect
- No advertising, and no tracking you across other apps or websites. There is no advertising SDK in Bulbulery and we do not sell or share your data for advertising. This is a commitment, not a description of the current build.
- No contacts, no location tracking. The app never reads your address book and does not follow your location in the background. Places appear on a map only because you added them to an itinerary.
- No payment details. Bulbulery records what a trip cost among friends. It does not move money and never sees a card.
What leaves your device
If you are not signed in, nothing does: the app runs on a database on your phone.
Once you sign in, a trip and its contents are kept on our server so that the people you travel with can see them and so that you can open the same trip on another device. That means the trip itself, its members and currency settings, the spots on its itinerary, its expenses and how each was split, settlements, to-do items, the record of who changed what, and the files and photos you attach — the bytes of those are uploaded to our file storage, not only their names.
If you use place search, the words you type are sent to Google Places to answer it (see below). Nothing else you type is sent anywhere but our own server.
Crash and error reports
If the app crashes or runs into an error, a report is sent to Sentry, a third-party service we use to find and fix faults. This is the one thing Bulbulery sends that you did not put there yourself.
- A report carries the technical details of the fault: where in the code it happened, the app version, the device model and the operating system. It carries no name, no email address, no username and no IP address.
- It does carry an identifier generated for your installation of the app, so that one fault hitting the same phone repeatedly is counted once instead of many times. Because of that identifier we declare these reports as linked to you rather than anonymous.
- A crash report does not include a screenshot or a copy of the screen.
- Session Replay. When an error is captured, Sentry also uploads a recording of the minutes leading up to it, so we can see which sequence of taps produced the fault. Ordinary sessions are never recorded — only ones where something went wrong. In the recording all text, all images and all graphics are masked: it shows where a tap landed and which screen followed which, not what your trip says.
- On the App Store listing this is declared as Crash Data, Other Diagnostic Data and Product Interaction — used for app functionality only, and not used for tracking.
Where it is stored, and for how long
On our server: a Supabase Postgres database hosted in Tokyo (ap-northeast-1). On your phone: a local database, your session in the device's secure storage, and your preferences.
Your data is kept until you delete it. Delete a trip and it goes; delete your account and see below.
Who can see your trips
The people in the trip. Adding someone to a trip lets them see that trip's itinerary, expenses and splits — that is the point of a shared trip. They cannot see your other trips.
Nobody else. Access is enforced on the server per row, not just hidden in the app. Someone added to a trip today cannot read what was deleted from it before they joined.
We do not sell your data, and we do not share it with third parties for their own purposes. The only companies that process it on our behalf are Google (only if you choose to sign in with it, and for place search), Apple (only if you choose to sign in with it), Supabase (hosting) and Sentry (crash and error reports).
Deleting your account
You can delete your account from inside the app: Settings → Account → Delete account. You will be asked to sign in again first, because deletion cannot be undone.
What happens is worth stating plainly, because it is not "everything you ever touched disappears":
- Trips only you are in are deleted, along with everything in them.
- In trips you share with other people, your name stays and your expenses stay — but they are no longer connected to an account. You become a name in that trip, the same as someone who never installed Bulbulery. This is deliberate: removing your expenses would change what everyone else owes, and their record of the trip is theirs, not only yours.
- If you own a trip that other people are still in, the app will ask you to hand it over or remove the others first. We will not silently leave a group's trip without an owner.
Your account itself, your email, your session and your preferences are removed.
Children
Bulbulery is not directed at children under 13, and we do not knowingly collect their information.
Changes to this policy
If this policy changes materially, the app will say so rather than quietly updating this page.
Who publishes this policy, and under whose law
Bulbulery is published by Kwok Wai Kit, an individual, in the Hong Kong Special Administrative Region. This policy is governed by the laws of the Hong Kong SAR.