Effective date: April 11, 2026
Operator: Eugenia L. Kato
Contact: eugenia.leong@icloud.com

1. Introduction

Boba Buddy ("we," "our," or "us") is a mobile app that helps you find bubble tea shops, save notes about your orders, and optionally keep your data in sync across devices. This Privacy Policy describes how we collect, use, store, and share information when you use the app Boba Buddy (the "App").

By using the App, you agree to this policy. If you do not agree, please do not use the App.

2. Information we collect

2.1 You provide or create in the app

Drink notes and related content - Text you enter about shops and visits, dates, and references to places (for example, Google Place IDs used to identify a shop in the App).

Photos - Images you choose to attach using the camera or photo library, stored on your device and, if you use cloud sync, uploaded to our backend (see Section 4).

Personal shop ratings - Thumbs up / thumbs down (or similar) preferences you save for shops. In the current App, these are stored on your device (local storage), not on our servers.

2.2 Location

Approximate or precise location - When you use nearby shops or improve search, the App may use your device location (as permitted by your system settings) to request shop results. Location is sent to Google as part of those requests so the Places service can return relevant businesses near you or biased to your area (see Section 5).

We do not use your location to build a continuous "location history" product beyond what is needed to respond to your searches while you use the feature, and we do not sell your location data.

2.3 Account and authentication (optional)

Email address - If you turn on cloud sync or sign in, we use your email to send a magic link (passwordless sign-in) and to identify your account.

Authentication identifiers - A user identifier and session data managed by our authentication provider so you can stay signed in securely on your device.

2.4 Technical / local data

Local preferences and cache - The App uses on-device storage (for example, to save notes, ratings, sync preferences, cached shop names, and session keys). This stays on your device unless you enable cloud sync (which uploads notes and related data as described below).

2.5 What we do not intentionally collect in the App today

The App is not integrated with third-party advertising or analytics SDKs for tracking you across other companies' apps or websites (for example, no ad attribution or behavioral analytics SDK in the current codebase).

Standard Apple and network logging on your device or at infrastructure providers may still occur (for example, HTTPS connections, App Store download, OS diagnostics).

If we add analytics or ads later, we will update this policy and, where required, App Store disclosures.

3. How we use your information

We use the information above to:

  • Show nearby and search results for bubble tea / related shops.
  • Let you create, edit, view, and delete notes and photos tied to shops.
  • Remember your ratings locally on your device.
  • Authenticate you and sync your notes and synced photos across devices if you choose to enable cloud sync.
  • Operate, secure, and improve the App (for example, fixing bugs, supporting you when you contact us).

We do not sell your personal information.

4. Cloud sync (Supabase)

If you enable cloud sync and sign in:

  • Your notes (including text, dates, shop identifiers, and references to photos) are stored in a database hosted by Supabase (or a successor backend we configure).
  • Photos you attach to synced notes may be stored in Supabase Storage so the App can load them on your other devices. Depending on how our storage bucket is configured, images may be referenced by URLs used only to display your content in the App. Do not upload photos you consider highly sensitive if you are uncomfortable storing them in the cloud.
  • If you disable cloud sync or sign out, new sync activity stops; data already stored in the cloud may remain until you delete it (see Section 8) or we delete it as part of account closure.

5. Google Maps / Places

To find and display shops, the App calls Google APIs (such as the Places API) from your device. Requests can include:

  • Search text you enter.
  • Coordinates (latitude and longitude) when you use nearby search or location-biased search.

Google's handling of that data is governed by Google's privacy policy: https://policies.google.com/privacy

We do not control Google's servers; we use them only to provide shop discovery features.

6. Service providers

We rely on service providers to run the App, including:

Provider Role
Supabase Authentication (magic link), database, and file storage for optional cloud sync. Privacy: https://supabase.com/privacy
Google Places / Maps-related APIs for shop search and details. Privacy: https://policies.google.com/privacy
Apple App distribution (App Store), device OS, and related services when you use an iPhone. Privacy: https://www.apple.com/legal/privacy/

The App is built with Expo tooling; Expo and EAS (Expo Application Services) may process limited technical or account information related to building or distributing the app. See https://expo.dev/privacy if you want details about Expo's practices.

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, local law may require us to identify the legal bases for processing your personal data. Where the GDPR, UK GDPR, or similar law applies, we rely on:

  • Contract - to provide the App and optional sync you request.
  • Legitimate interests - to secure the App, fix abuse, and improve stability (balanced against your rights).
  • Consent - where required for permissions such as location, camera, or photo library (you control these in iOS Settings).

Your rights. Depending on where you live, you may have the right to access, correct, delete, or export personal data we hold, to restrict or object to certain processing, and to withdraw consent where processing is based on consent. To exercise these rights, contact us at eugenia.leong@icloud.com. You may also lodge a complaint with a data protection supervisory authority in your country.

8. Retention and deletion

On your device: You can delete notes and photos in the App and clear local data by deleting the App (subject to iOS behavior).

Cloud: If you use sync, you can delete individual notes in the App (sync may propagate deletions depending on implementation). To delete your account or all cloud-held personal data, contact us at eugenia.leong@icloud.com and we will assist within a reasonable time, subject to legal retention needs.

9. Security

We use industry-standard measures appropriate to the service (for example, encrypted connections between the App and our providers). No method of transmission or storage is 100% secure.

10. Children's privacy

The App is not directed at children under 13 (or the age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will take steps to delete it.

11. International users

Our service providers may process data in the United States and other countries. If you use the App from outside your home country, your information may be transferred across borders as permitted by law.

12. Your choices (iOS)

You can control:

  • Location - Settings -> Privacy & Security -> Location Services -> Boba Buddy.
  • Camera / Photos - Same path under Camera / Photos.
  • Notifications - If added later, via Settings.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the new effective date at the top. If changes are material, we will provide notice as required by law or by the App Store (for example, in-app or by email).

14. Contact us

For privacy questions or requests (including access or deletion where applicable), contact:

Eugenia L. Kato
Email: eugenia.leong@icloud.com

For general help, you can also use the support page.