Privacy Policy

Ideal Vibe is a personal project operated by a private individual: Rumen Radev, Varna, Bulgaria ("the operator," "we," "us," or "our"). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application ("App") and our website at idealvibe.app ("Website") (collectively, "Services"), and which rights you have.

This Privacy Policy is a notice that explains how we process personal data. It is not part of any contract with you, and where we need your consent we ask for it separately in the App. Section 15 adds information for specific countries and regions.

1. Who We Are

The controller responsible for your personal data is Rumen Radev, Varna, Bulgaria. For information about the operator, contact legal@idealvibe.app.

• Privacy contact: privacy@idealvibe.app
• Data Protection Officer: we have not appointed a Data Protection Officer. Please send any privacy question or request to the address above.
• Person responsible for the protection of personal information: the operator, Rumen Radev, Varna, Bulgaria. Contact: privacy@idealvibe.app. The operator answers questions about how we handle personal data and is the contact point for the countries in Section 15 whose laws ask for one.

2. Information We Collect

We collect the following types of information:

• Personal Information: Your name, email address, and location data (with your permission) when you register or use location-based features.
• Sign-in Data: If you sign up with an email address, your name, your email address and a password, which Google Firebase Authentication stores only in protected (hashed) form. If you sign in with Google or Apple, the identifier of that account together with your name and email address (with Apple, you can choose to hide your email address).
• Saved Locations and Settings: The places you save (with their coordinates), your notification settings, your favourites, and, on your device only, the activities you plan in the App.
• Age Information: We ask for your year of birth to check that you are an adult and to show venues centred on alcohol, tobacco or gambling only from the local legal age. It is kept on your device and is not sent to us. On Android the App may also ask Google Play, and on iOS 26 or later Apple, whether your store account belongs to an adult. Google Play or Apple may first ask you whether to share your age range. The App receives an age range, never your date of birth, and keeps only whether it shows an adult or a person under 18. This answer stays on your device. We do not receive it, and we use it only to keep the App for adults, never for advertising, analytics or any other purpose.
• Usage Data: Information about how you use the App, including IP address, device name or model, operating system and app version, a device or system-build identifier for the list of devices signed in to your account, the screens and features you use (subject to your consent choices), and timestamps. We also derive your country or region from your IP address, SIM card or location so that we can apply the privacy rules of your country. Earlier versions of the App also saved a usage streak and a daily check-in count to your account. Current versions no longer read or update that data. If your account has it, it stays there until your account is deleted, and it is included when you ask for a copy of your data.
• Weather and Activity Data: Weather conditions for your approximate area and your activity preferences (such as chosen categories and favourites) to provide recommendations.
• Purchase and Subscription Data: If you buy PRO, the transaction is processed by the Apple App Store or Google Play. On Apple devices, our subscription-management provider RevenueCat processes purchase validation and subscription status; on Android, we validate purchases directly with Google Play. On Apple devices, RevenueCat also receives your account ID when you sign in to the App, whether or not you buy. We never receive your full payment card details.
• Push Notification Tokens: A device token (via Firebase Cloud Messaging) used to deliver the news and service notifications you have opted into. Weather alerts are created on your device and do not use this token.
• Newsletter Record: If you subscribe to the newsletter, your email address, your language, whether you have confirmed the subscription, and the dates of subscribing and unsubscribing.
• Help & Feedback Messages: If you suggest an activity or report a problem in the App, the text you write, the options you choose (such as a category or the part of the App concerned), any screenshot you attach, your account ID and, if you allow us to reply, the verified email address of your account. A problem report also includes your app version, operating system and its version, device model, the App's language, your plan (free or PRO) and the screen you opened the form from; an activity suggestion includes only your app version, platform, the App's language and the screen you opened the form from. The App shows you this list before you send. A screenshot is re-encoded on your device, which removes its location and other metadata, and is attached to the email to our support team; it is not stored on our servers.
• Consent Records: The privacy choices you make in the App (analytics, crash reports, personalised ads, location, marketing emails, third-party sharing and, where the App asks for it, the transfer of your data abroad), the privacy rules that apply to you, your country or region and which kind of signal decided it (IP address, SIM card or location), your device's ad-tracking setting, the app version, and the time of each choice.
• Photos, Videos, and Camera Data: If you use the Share Studio feature, the photos and videos you capture or pick from your gallery are processed on your device and are not sent to us. If you enter a Creator Bounty, we process the photos and videos (or the links to them) that you submit with your entry. Camera access is used only while you actively use Share Studio. If you attach a screenshot to a problem report, that one image is sent to us (see Help & Feedback Messages).
• Calendar: If you turn on Smart Calendar (where this feature is available), the App reads your device calendar to work out when you are busy or free, so that it can suggest activities for times when you are available, and it can add the activities you plan to your calendar. This happens on your device; your calendar entries are not sent to us. The activities you plan in the App and your choice of calendars are also stored only on your device; they are not sent to us.
• Advertising Identifiers: On the free tier, our advertising partner (Google AdMob) may process your device advertising identifier to serve ads in the App, subject to your consent choices. On Android, the App reads whether you have limited ad tracking in your device settings, and on iOS it records your answer to the tracking prompt, so that it can honour that choice.
• Website Data: When you visit the Website, our hosting provider records technical request data and your browser stores your language choice, as explained in Section 5. The Website uses no analytics or advertising cookies.

What you must provide and what is optional. To create an account with an email address you must give your name, an email address and a password; if you sign in with Google or Apple, that provider gives us your name and email address instead (with Apple, you can choose to hide your email address). To use the App you must then give your year of birth, which stays on your device (see Section 10). Everything else is optional: location (you can type a city instead), analytics, crash reports, personalised ads, the newsletter, camera and photos, calendar, a message sent through Help & feedback, and entering a Creator Bounty. If you choose not to provide optional data, only the related feature is switched off.

We do not collect health or biometric data. Precise location is collected only with your permission.

3. How We Use Your Information

We use your information to:

• Provide your account and the core App features, including activity recommendations based on weather data, saved locations, favourites and settings.
• Show nearby places and place-search results when you use those features.
• Send notifications and service messages, and the newsletter if you subscribed.
• Show advertising in the free tier, measure how the App is used and fix crashes, according to your privacy choices.
• Keep the Services secure and prevent abuse and reward fraud.
• Keep the App for adults and apply the right rules for your country: ask for your year of birth, show venues centred on alcohol, tobacco or gambling only from the local legal age, and work out your country.
• Process purchases and subscriptions, and verify rewards from rewarded ads.
• Run the Creator Bounty Programme.
• Answer your emails, your activity suggestions and problem reports, and your other requests, and handle data protection requests.
• Comply with legal obligations.

Safety and informational-use notice: Location data and weather insights are used to provide informational recommendations only and are not intended for emergency or life-safety purposes. Always verify conditions with official sources.

4. Legal Bases and Retention

Where the EU or UK General Data Protection Regulation (GDPR) applies, we process personal data only where we have a legal basis under Article 6(1) GDPR. The legal basis and the retention period for each purpose are listed below:

• Your account and core App features (profile, saved locations, favourites, settings, the list of devices signed in to your account, recommendations): performance of our contract with you (Art. 6(1)(b)). Kept until you delete your account; server data is erased about 30 days after you confirm a deletion in the App (normally between 30 and 31 days), or within 24 hours after we process a request made by email (see Account & Data Deletion).
• Location-based features: your consent to location access (Art. 6(1)(a)), which you can withdraw in your device settings. Coordinates sent with a weather request are rounded to an approximate area (about 11 km) before our servers use, cache or log them; the exact coordinates of a weather request are not stored. Cached weather data is kept for up to 30 days. Earlier versions of the App save your last known location (coordinates, city and country) with your profile. The current version does not save it, and it deletes the saved value the next time you start it while signed in to your account. Until then the value is kept, at most until you delete your account. Location in the background (Android). Only if you turn on "Follow my location" on the App's widgets screen and then allow location access all the time, the App also reads your approximate position while it is closed, each time it refreshes your home-screen widgets and weather alerts (about every 30 to 60 minutes; your device may run it later), and only while the App shows the weather for your current location, never for a city you chose. That position, and the name of its town from your device's built-in location service, stay on your device; only the rounded area described above is sent with the weather request. To stop it, set the App's location permission back to "Allow only while using the app" or turn it off in your device settings.
• Purchases and subscriptions: performance of our contract (Art. 6(1)(b)) and our legal obligations, for example for tax and accounting (Art. 6(1)(c)). Kept for the life of the subscription and for as long as the law requires transaction records to be kept.
• Push notifications (device token): your consent (Art. 6(1)(a)). When you turn notifications off, the App unsubscribes your device from our news topics and no more of these messages are sent to it. The token itself is held by Firebase Cloud Messaging, not saved with your account. The App deletes it when you sign out, and once the App is uninstalled the token can no longer be used to reach your device.
• Newsletter: your consent (Art. 6(1)(a)). In most countries we also ask you to confirm the subscription through a link sent by email; Section 15 says where we do not. You can unsubscribe at any time in the App. When you unsubscribe or delete your account, we remove your address from the mailing list at Resend. The record of your subscription (email address, language, dates) stays with your account until you delete it. Resend states that it keeps email and delivery logs for 30 days.
• Help & feedback (activity suggestions and problem reports you send from the App): our legitimate interest in answering you and in fixing and improving the App (Art. 6(1)(f)). Your message is sent as an email to our support mailbox through Resend. A copy without any screenshot is kept on our servers for 180 days, to avoid handling the same message twice and to prevent abuse, and is erased earlier if you delete your account. To limit abuse, each account can send only a limited number of messages per hour and per day; the counters are kept for up to two days. The email in our support mailbox, with any screenshot, is kept as long as we need it to handle your message.
• Advertising in the free tier, App analytics, performance monitoring and crash reports: your consent where the law requires it (Art. 6(1)(a)); otherwise our legitimate interest in funding the free tier and keeping the App stable (Art. 6(1)(f)). Analytics events are kept for at most 14 months and crash reports for 90 days. Google keeps performance events linked to an IP address for 30 days and other performance data for 60 days, after which it starts removing them. Google keeps the installation identifier that Firebase gives your copy of the App (used by push notifications and remote configuration) under its own retention rules; deleting your account does not delete it, and it is no longer used once you uninstall the App.
• Rewarded ads (reward verification with Google AdMob, where this feature is available): performance of our contract, namely the reward you asked for (Art. 6(1)(b)). Reward sessions and Pro Passes are kept while your account exists and erased with it.
• Security and abuse prevention (request logs of our app backend, the list of signed-in devices, rate limits, and the abuse-prevention records for rewarded ads): our legitimate interest in protecting the Services and other users and in preventing reward fraud (Art. 6(1)(f)). Request logs of our app backend (Google Cloud Functions) include IP addresses, your account ID, the rounded area of a weather request and, for newsletter subscriptions, the email address concerned; Google Cloud Logging deletes them at the end of the log store's retention period, which is 30 days by default. Google Firebase Authentication keeps sign-in IP address logs for a few weeks. Abuse-prevention records linked to your account are erased with it. A salted hash of a device or network that was used may remain, without any link to your account. Where our administration tool keeps a log of administrator actions, that log can contain your account ID and the details of the action taken on your account, and is deleted after 12 months. Technical logs of our administration tool where it runs outside Google Cloud have no fixed period: the oldest entries are overwritten automatically when the log reaches a fixed size.
• Year of birth and the age answer from Google Play or Apple: our legitimate interest in keeping the App for adults and in showing venues centred on alcohol, tobacco or gambling only from the local legal age (Art. 6(1)(f)). Your year of birth and the age answer from Google Play or Apple stay on your device and we do not receive them. The year of birth is removed from your device when you delete your account or uninstall the App; the age answer stays on your device until you uninstall the App.
• Working out your country (from your IP address, SIM card or location, so that we can apply local rules): our legitimate interest in applying the privacy rules that fit your country (Art. 6(1)(f)). The result is stored with your account and consent records. The copies of these signals kept on your device expire after 7 days (location), 24 hours (IP address) or 30 days (SIM card).
• Smart Calendar (where this feature is available): your request and the device permission you grant (Art. 6(1)(b) and (a)). The activities you plan and your choice of calendars stay on your device until you delete them in the App or remove the App. Your calendar entries stay on your device.
• Nearby places and place search: performance of our contract when you use the feature (Art. 6(1)(b)) and, where your location is used, your consent to location access (Art. 6(1)(a)). For the OpenStreetMap services, our servers do not receive the search text or the rounded coordinates: your device sends them straight to the services named in Section 6, which keep them under their own policies. Where the App asks Google Places instead (see Section 6), our servers receive the activity, its search term, your coordinates rounded to about 100 metres and your language, use them only to answer that request and do not store them. They keep the place IDs and positions that Google returns, filed under the activity, its search term and the roughly 2-kilometre square you were in and not linked to you, for up to 30 days (a record that Google found nothing there, for up to 7 days), and a count of your Google Places lookups for the day, which is kept for about two days and erased earlier if you delete your account.
• Creator Bounty entries: performance of the Official Bounty Rules you accept when entering (Art. 6(1)(b)) and our tax and accounting obligations for prizes (Art. 6(1)(c)). The record of your entry is deleted with your account. The original files of a winning entry whose rights have passed to us, and the copies of it that we have published, are not deleted with your account. We keep and use them under Section 9 of the Official Bounty Rules (see also Section 13 of this Privacy Policy). We keep the records of prize payments, the signed confirmations of winners and the copies of releases for as long as tax and accounting law requires, and for as long as we rely on the rights in a winning entry. The proof of identity, age and country of residence that a winner sends us has no fixed deletion date at present: we keep it for as long as we need it to show that the winner met the Official Bounty Rules and to meet our tax and accounting obligations.
• Website request logs: our legitimate interest in operating and securing the Website (Art. 6(1)(f)). Our own request logs (Google Cloud Logging) are deleted after 30 days. The Firebase Hosting network that delivers the Website keeps IP data for a few months under Google's own retention rules.
• Emails and requests you send us, including data requests made in the App: performance of our contract or of steps you ask for (Art. 6(1)(b)), our legitimate interest in answering you (Art. 6(1)(f)), and our legal obligation to handle data protection requests (Art. 6(1)(c)). Kept for as long as needed to handle the request and to document how we handled it. The records of requests made in the App are erased with your account.
• Consent and deletion records: we keep the consent records because we must be able to show that consent was given (Art. 6(1)(c) with Art. 7(1)), and we keep the record of your deletion request so that we can show that it was carried out. After your account is deleted, we keep the consent records and the record of your deletion request in pseudonymised form: when the erasure is carried out, your account ID is replaced by a one-way value, and your region within your country and, on Apple devices, your answer to the tracking prompt are removed. The records keep your country and which kind of signal decided it, the privacy rules that applied and any change of them with its reason, the policy version, your privacy choices and any opt-out, what prompted each choice and whether you made it yourself or it was a starting value, your newsletter choice and whether you confirmed it by email, whether Google's consent message applied to you and whether ads could be requested, on Android whether ad tracking was limited, the app version and the times of your choices and requests. Where our automatic check of these records flagged one of them, the flag is kept in the same way. The record of an earlier deletion request that you cancelled is not changed by the erasure and can still contain your account ID. These records have no fixed deletion date at present: we keep them for as long as we may need to show how consent and deletion requests were handled.

Where we rely on our legitimate interests, you can object at any time (see Section 9).

5. Our Website

This section applies when you visit the Website (idealvibe.app).

• Hosting: The Website runs on Google Cloud Run in the europe-west1 region (Belgium) and is delivered through the Firebase Hosting content delivery network. Google acts as our processor.
• Request logs: For every request, our hosting provider records your IP address, user agent (browser and device type), the requested URL, the referring page, and the time. We use these logs only to operate the Website, keep it secure, and investigate faults or abuse. Google Cloud Logging deletes our request logs after 30 days. The Firebase Hosting network that delivers the Website keeps IP data for a few months under Google's own retention rules.
• Fonts: All fonts are served from our own servers, so loading a page sends no request to a third-party font service.
• Browser storage: The Website stores your language preference (idealVibeLang) and, if you use the theme button, your light or dark theme choice (idealVibeTheme) in your browser's local storage. The password-reset page also keeps a short-lived item (ivResetForward) in your browser's session storage, which is removed when you close the tab. All of these are strictly necessary and are described in our Cookie Policy.
• Contacting us: The forms on the Website do not send anything themselves; they open your own email app with a message to us. When you email us, we receive your email address and your message and use them only to answer you.
• Links in our emails: The page that opens when you confirm a newsletter subscription sends the code from the link and your answer to our app backend (Google Cloud Functions, United States). The password-reset link passes you on to the Google Firebase Authentication page that completes the reset.
• Blog and bounty content: Blog pages are put together by the Website from articles and images supplied by our own content service. That service also runs on Google Cloud in the EU (Cloud Run, europe-west1 region, Belgium), where Google acts as our processor. The Website fetches this content server-to-server: your browser connects only to the Website, and your IP address is not passed on to the content service. Beyond the request logs described above, the blog collects no data about you. Bounty pages are put together in the same way from the bounty listings that service supplies. Entries are submitted in the App, not on the Website.

The Website contains no analytics, advertising, or social media plug-ins and sets no cookies.

Because the Website does not track visitors, it does not change its behaviour when a browser sends a "Do Not Track" signal.

6. Sharing Your Information

We do not sell your personal data for money. We do not attach your location to ad requests, and we do not use your location for advertising. We share information with the recipients below. Each recipient has one of these roles:

• Our processor acts only on our instructions under a data processing agreement.
• An independent controller decides for itself how it uses data and acts under its own privacy policy.
• An independent service is a service that the App or our servers contact when you use a feature. It acts under its own terms, and we have no data processing agreement with it.

If you enter a Creator Bounty, the judges of the Programme see your entry. If you win a Creator Bounty, two more recipients can receive your data: the payment service used to pay your prize, and the provider of the AI voice tool if we dub your winning video. Section 13 says what each of them receives.

What "third-party sharing" means in the App. The App has one switch for it. It is called "Third-Party Services" on the privacy screen at set-up and "Data Sharing" in Privacy Controls. Together with your choice about personalised ads, it allows Google to receive user data for advertising: the App sends Google a signal that says whether this is allowed. It sends that signal as allowed only while both choices are on. Section 15 says where the switch starts as on.

The App also connects directly to the following independent services when you use the features concerned:

• OpenStreetMap (Nominatim): when you search for a place, the text you type is sent to the OpenStreetMap search service to find matching locations. That service also sees your IP address; we do not send it your identity.
• Unsplash: activity photos are loaded from Unsplash's servers, which receive your IP address when a photo is displayed.
• OpenStreetMap services (Photon by komoot, Overpass API by FOSSGIS, and Private.coffee's Overpass server in Austria as its backup): these services supply the venues of the Nearby Places list, up to five venues near you shown on the screen of a place activity, and, where this feature is switched on, of the "Near you" answer on the Home screen, the nearest venue for a recommended place activity. Both are part of a paid PRO subscription; a Pro Pass does not unlock them. The App contacts these services only while location permission is granted and the "Location for nearby places" choice is switched on: for the list when you open a place activity, and for the "Near you" answer when the Home screen shows its recommendations. It never contacts them for a few kinds of places that could reveal sensitive information about you, such as places of worship. The backup server is asked only when the main Overpass server fails or is paused. The App sends them your coordinates rounded to about 100 metres (about 1 kilometre for the step that tells which country you are in) and the type of venue or the search term for that activity, in your language, in English and, where the App includes the language, in the local language of the country you are in. For the "Near you" answer, the App also asks Overpass for the opening hours of the venue found, by its OpenStreetMap ID. They receive your IP address with the request. Distances are worked out on your device from your exact position, which is not sent, and our servers take no part in these lookups. Where these services find no venue, fail or are slow, the App of a paid PRO subscriber may ask Google Places instead (see the table above).
• Google Translate (off by default): to find venues by name in a country whose language the App does not include, the App can translate the search term of a place activity into the local language. This is off in the App unless we switch it on through its remote configuration, and while it is off nothing is sent to Google for this purpose. When it is on, the App sends the search term of the place activity you opened to Google's translation service. Your location is not sent; Google receives your IP address with the request. Google handles this data under its own privacy policy; we have no contract with Google for this lookup.
• Sign in with Google / Sign in with Apple: if you choose one of these sign-in options, Google or Apple confirms your identity to us and shares your name and email address (with Apple, you can choose to hide your email address). Google and Apple act as independent controllers for sign-in.
• Place names: to show the name of your town, the App asks your device's built-in location service (provided by Google or Apple) to turn your coordinates into a place name.
• Google Fonts: the App downloads its emoji font and, on the activity search screen, a text font from Google's font servers. Google receives your IP address with the request; no account data is sent.
• Language packs (where this feature is switched on): the App downloads the texts for your language from our storage on Google Cloud. Google, as our processor, sees your IP address with the request.
• Hand-offs you start: if you tap the map button of an activity or the maps link under the Nearby Places list, the search term and, where location access is granted, your current position (not rounded by the App) are passed to Google Maps in the link that opens it; if you tap a venue in that list or in the "Near you" answer, the venue's name, address and position (not yours) are passed to Google Maps in the same way, and for a venue from Google Places the App opens that venue's own Google Maps link; if you tap the YouTube button, the search link is handed to YouTube. Each service then acts under its own privacy policy.

We also disclose personal data: to authorities and courts where the law requires it or where we need to establish, exercise or defend legal claims; to our professional advisers, auditors and insurers, who are bound by confidentiality; to a buyer or successor if we sell or reorganise the business, in which case we will tell you if your data becomes subject to a different privacy policy; and, if you win a Creator Bounty, to the public, where we publish your first name, the first letter of your surname, your country and your entry (see Section 13).

7. Data Security

We implement reasonable security measures to protect your data from unauthorized access, loss, or breach. However, no system is completely secure, and we cannot guarantee absolute security. In the event of a data breach, we will notify affected users as required by law.

The measures in place include: encryption of data in transit (HTTPS); database rules that limit each account's data to its signed-in holder and to our administrators; one-way hashing of confirmation tokens and of the device and network identifiers used for abuse prevention; and keeping the sign-in token that the App itself stores in your device's secure storage.

Retention: The coordinates sent with a weather request are rounded to an area of about 11 km before the weather is looked up, are used only to answer that request, and are not stored with your account. Weather cache data used for offline functionality may be retained for up to 30 days and then purged. We retain account, consent, and support records as required by applicable law. Section 4 lists the retention period for each purpose.

8. International Data Transfers

Your data may be processed in countries outside your own, including the United States, where data protection laws may differ.

Where our systems run. The Website runs in Belgium (see Section 5). Our app backend (Google Cloud Functions) runs in the United States, so weather requests, Google Places lookups, account-deletion requests and the pages behind the links in our emails are processed there. Your account data is stored in Google's Cloud Firestore database, which our app backend in the United States reads and writes. Section 6 names the other recipients.

Safeguards. When we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to a country that is not recognised as providing an adequate level of protection, we rely on:

• for Google and RevenueCat, Inc. (our processors, United States): the EU-U.S. Data Privacy Framework and its UK and Swiss extensions for as long as the company is certified under it, and otherwise the safeguards in the company's data processing terms;
• for Resend (Plus Five Five, Inc., our processor, United States): the Standard Contractual Clauses in its data processing agreement;
• for Google AdMob, for Apple and Google as store operators, and for Google and Apple as sign-in providers (independent controllers): the safeguards each of them describes in its own terms and privacy policy;
• for the independent services in Section 6: we have no data processing agreement with them and do not rely on Standard Contractual Clauses. Except for OpenWeather, Apple Weather and Google Places, your device contacts the service itself when you use the feature, and the service acts under its own privacy policy. OpenWeather, Apple Weather and Google Places are contacted by our servers under their standard API terms and receive nothing that identifies you: OpenWeather and Apple Weather only approximate coordinates (Apple Weather also the country and time zone of that area), and Google Places only a search term, a language and an area of about 12 to 42 kilometres across, centred on the roughly 2-kilometre square you are in, or the ID of a venue;
• for the payment service and the voice-tool provider used for a Creator Bounty winner: each acts under its own terms and privacy policy. Ask us at privacy@idealvibe.app which provider is used and in which country.

Where a recipient is in a country covered by an adequacy decision, we rely on that decision. In some countries the set-up privacy screen of the App also asks whether your data may be transferred abroad to Google for analytics, crash reports, third-party sharing and personalised ads (see Section 15). The data needed to run the App is processed abroad whatever you answer.

The Website is hosted in the EU (Belgium); Google's content delivery network may serve pages from a location near you. For more information about these safeguards, contact us at privacy@idealvibe.app.

9. Your Rights and Choices

Depending on where you live, you may have rights under data protection laws, including the right to:

• Access your data and receive a copy of it.
• Correct inaccurate or incomplete data.
• Delete your data (see Account & Data Deletion).
• Restrict processing, object to processing based on our legitimate interests, and opt out of data sharing or marketing communications.
• Receive the data you provided to us in a structured, machine-readable format.
• Withdraw consent at any time, without affecting processing that took place before you withdrew it.

Right to object. Where we process your data on the basis of our legitimate interests, you can object at any time on grounds relating to your particular situation. We then stop, unless we can show compelling reasons that override your interests or we need the data for legal claims. You can object at any time, without giving a reason, to the use of your data for direct marketing, and we then stop.

How to exercise your rights. In the App, open Profile > Privacy & legal. There you can send us a data request (access, correction, deletion or a copy of your data), read the legal documents and withdraw all optional consents at once. Open Privacy Controls from that screen to change your privacy choices, as Section 11 describes, and to delete your account. You can also contact us at privacy@idealvibe.app. We respond within 30 days. Where the law of your country allows it, we may take longer for a complex request or for many requests, and we tell you so within the first 30 days. Where Section 15 gives another period for your country, that period applies.

Requests are free of charge. Where the law of your country allows it, we may charge a reasonable fee for, or refuse, a request that is manifestly unfounded or excessive, and we tell you why. We may ask you to confirm your identity, for example by writing from the email address of your account. If we refuse a request, you can ask us to review the decision by replying to our answer.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where you believe an infringement took place. Our lead supervisory authority is the Bulgarian Commission for Personal Data Protection (CPDP).

10. Adults Only

Ideal Vibe is for adults. You must be at least 18 years old to use the App, or the age of majority where you live if that is higher (20 in Thailand). Our Services are not intended for anyone younger.

• Year of birth. When you first use the App, we ask for your year of birth and ask you to confirm that you are an adult and that the year is correct. It is kept on your device (see Section 2).
• Below the minimum age. If the year of birth you enter shows that you are under 18 (under 20 in Thailand), you cannot continue. The App then does not start analytics, crash reporting or advertising. You can sign out or delete your account (see Account & Data Deletion).
• Age from your app store. If Google Play or Apple tells the App that your account belongs to a person under 18, you cannot continue, whatever year of birth you entered, and the App does not start analytics, crash reporting or advertising. The App keeps this answer on your device until you uninstall the App. If you do not share your age range, or the store gives no answer, the year of birth you enter decides.
• No data from children. We do not knowingly collect personal data from anyone under 18. If we learn that we hold personal data of a person under 18, we delete it.

If you think a person under 18 uses the App: email privacy@idealvibe.app and we will delete the account and the data.

11. Advertising

The free tier of the App is supported by advertising served by Google AdMob. AdMob receives your device's advertising identifier where you allow it, your IP address and the general area derived from it, device and app information, keywords for the kind of activity on screen, and information about how you interact with ads, to serve and measure ads. We do not attach your location to ad requests, and we do not use your location for advertising. Where required by law, ads are personalised only with your consent, and you can withdraw consent in the App or reset your advertising identifier in your device settings at any time. PRO subscribers receive an ad-free experience.

How your choices work.

• Privacy choices. The App keeps a choice for analytics, crash reports, personalised ads, location, marketing emails and third-party sharing. Performance monitoring has no switch of its own: it follows your analytics choice. The App switches analytics, performance monitoring and crash reporting on only where your choices allow it. The location choice is called "Location for nearby places": it governs only the nearby-places lookups described in Section 6, while weather for where you are follows your device's location permission. When you switch a choice off in Privacy Controls, the App applies that at once; for personalised ads it applies to every ad the App requests from then on.
• Where the choices start. At set-up the App shows a privacy screen with these choices, and you confirm it before you continue. In most countries every choice starts as off. In a few countries some choices start as on, and you can switch them off on that screen or at any time later; Section 15 names these countries and choices. Marketing emails start as off everywhere.
• Google's consent message. In some regions (see Section 15) no ad is requested until Google's consent check has finished; where Google shows its consent message, which also lists Google's advertising partners, that means until you have answered it. Everywhere, ads are not personalised unless your personalised-ads choice is on.
• Apple devices. On iOS the system tracking prompt appears only after your personalised-ads choice is on.
• Changing your mind. You can change each choice at any time in the App under Profile > Privacy & legal > Privacy Controls. Where the App does not allow a choice for you, you cannot switch it on there, and the screen gives the reason, which can be a Do Not Sell or Share opt-out, ad tracking that is limited or not allowed in your device settings, a transfer of your data abroad that you did not allow, or the restricted mode of your region (Section 15). Where Google's consent message applies to you, you can reopen it there under "Manage ad consent". You can also reset your advertising identifier in your device settings. To stop the newsletter, switch off Marketing emails in Privacy Controls or unsubscribe in the App's notification settings (see Section 4). Withdrawing a choice does not affect earlier processing.

If you choose to watch rewarded ads to earn a temporary Pro Pass (where this feature is available), we pass your account ID and a one-time session ID to Google AdMob so that the reward can be verified. We keep a record of your reward sessions and passes, together with an abuse-prevention score that can include hashed device and network identifiers, to prevent misuse. These records are erased with your account.

Automated processing. Activity suggestions are rule-based rankings of activities against the weather and your preferences; they have no legal or similarly significant effect on you. The "Surprise me!" games normally leave out your last few picks; that short list is kept on your device and is not sent to us. Ad personalisation by Google is profiling, and it happens only when your personalised-ads choice is on. For rewarded ads (where this feature is available), an automated abuse check looks at the timing of ad views, the number of sessions, failed reward verifications, the number of accounts seen on the same hashed device or network, the age of the account, and whether the account uses the weather features. Based on this check, a reward can be refused, reduced or withheld without a person being involved. Our basis is our legitimate interest in preventing reward fraud. You can object and ask a person to review the outcome by writing to privacy@idealvibe.app.

12. Purchases and Subscriptions

PRO subscriptions and lifetime purchases are processed by the Apple App Store or Google Play; billing details stay with Apple or Google. We validate purchases through RevenueCat on Apple devices and directly with Google Play on Android, and we store your subscription status with your account to keep it in sync across devices. You can manage or cancel a subscription at any time in your App Store or Google Play account settings.

13. User Content, Camera, and Creator Bounties

The Share Studio feature uses your camera only while you actively use it; photos and videos you capture or pick from your gallery stay on your device unless you choose to share them. If you enter a Creator Bounty, the photos and videos you submit (or the links to them) — together with your name, email address, shooting location, preferred payout method and the other entry details needed to run the contest and pay rewards — are processed to administer the Programme. The judges of the Programme see the entries in order to score them. The rights you grant us in your entry are described in the Official Bounty Rules shown before you enter. You can request deletion of a non-winning submission at any time via privacy@idealvibe.app.

If you win, we may publish your first name, the first letter of your surname, your country and your entry, as Sections 9 and 11 of the Official Bounty Rules describe. We tell you by email first, and you can object to the publication of your name or ask us to use a pseudonym. We may edit a winning video and dub it with an AI voice tool; the provider of that tool then receives the video and handles it under its own terms. We may ask a winner for tax documents before we pay a prize. We pay the prize by the payment method agreed with the winner, and the payment service used receives the payout details. The record of your entry is deleted with your account; a winning photo or video whose rights you assigned to us, and the copies of it that we have already published, are not (see Section 4).

14. Changes to This Policy

We may update this Privacy Policy. We post the new version here with the date of the update, and you can ask us for earlier versions. For material changes we tell you in the App or by email before they take effect. Where a change needs your consent, we ask for it in the App and do not rely on your continued use. If you disagree with a change, you can change your privacy choices or delete your account.

15. Additional Information for Specific Regions

This section adds information for specific countries and regions. It applies together with the rest of this Privacy Policy. Where the law of your country gives you more protection, that law applies. The App shows which privacy rules it applies to you. From the set-up privacy screen and the Legal Agreements screen it opens this page at your region. Each subsection says which privacy choices start as on in that region; where it says nothing, they all start as off. Section 15.13 covers countries without a subsection of their own.

15.1 European Economic Area

The GDPR applies. The legal bases in Section 4 and your rights in Section 9 apply as written, and you can complain to a supervisory authority as described in Section 9. All privacy choices start as off, and no ad is requested until Google's consent check has finished; where Google shows its consent message, that means until you have answered it (see Section 11).

15.2 United Kingdom

• The UK GDPR and the Data Protection Act 2018 apply. The legal bases in Section 4 apply in the same way.
• Complaints to us. You can complain about how we handle your personal data by writing to privacy@idealvibe.app. We acknowledge a complaint within 30 days and answer it without undue delay.
• Complaints to the regulator. You can complain to the Information Commissioner's Office (ico.org.uk).
• Transfers. The safeguards for each recipient are in Section 8. For UK data they apply in the form that UK law recognises.
• Choices. All privacy choices start as off, and no ad is requested until Google's consent check has finished; where Google shows its consent message, that means until you have answered it (see Section 11).

15.3 Switzerland

• This subsection applies where the Swiss Federal Act on Data Protection applies to you. The recipients of your data, the countries they are in and the safeguards are in Sections 6 and 8.
• All privacy choices start as off, and no ad is requested until Google's consent check has finished; where Google shows its consent message, that means until you have answered it (see Section 11). On the set-up privacy screen the App asks whether your data may be transferred abroad to Google for analytics, crash reports, third-party sharing and personalised ads. If you decline, the App keeps these switched off and locks their switches in Privacy Controls. The data needed to run the App is processed abroad as described in Section 8 whatever you answer.
• The supervisory authority is the Federal Data Protection and Information Commissioner.

15.4 United States

This subsection applies to users in the United States. Some choices differ between the 50 states and the District of Columbia on the one hand and the US territories on the other (Puerto Rico, Guam, the US Virgin Islands, American Samoa, the Northern Mariana Islands and the US Minor Outlying Islands).

What we collect, why, and who receives it.

Retention for each category is in Section 4. We do not collect health or biometric data.

Sale and sharing. We do not sell personal data for money. Personalised ads through Google AdMob can count as "sharing" for cross-context behavioural advertising (California) or as "targeted advertising" (other states). Where your personalised-ads choice is on and you have not opted out, your advertising identifier, IP address and ad interactions go to Google for this purpose. The Website does not sell or share personal data.

Precise geolocation. Your precise location is used to provide weather and nearby places and to work out which country's or state's privacy rules apply to you (see Sections 2 and 4). We do not sell it, we do not attach it to ad requests, and we do not use it for advertising. You can switch it off at any time in your device settings, by withdrawing the App's location permission. For nearby places you can also switch off "Location for nearby places" in Privacy Controls. The nearby-places services that receive a rounded position are listed in Section 6. The rounding we apply for nearby places (about 100 metres) can still count as precise geolocation under some state laws, so we treat it as sensitive.

Your rights. You can ask to know and access your data, to correct it, to delete it, to receive a copy, and to opt out of sale, sharing, targeted advertising and profiling. Use the tools in the App or write to privacy@idealvibe.app (see Section 9). We respond within 45 days and may extend this once where the law allows; we tell you if we do. A deletion request sent by email is completed within the 30 days stated on the Account & Data Deletion page. Requests are free of charge as described in Section 9.

How to opt out. In the 50 states and the District of Columbia, open Profile > Privacy & legal and tap "Do Not Sell My Data", or switch on "Universal opt-out (Do Not Sell or Share)" in Privacy Controls. Your choice is saved and is not asked again. It applies at once to every ad the App requests from then on: those requests are not personalised and tell Google to apply restricted data processing, and Personalized Ads and Data Sharing are switched off and locked in Privacy Controls. Opting out does not change a newsletter subscription; to stop marketing emails, unsubscribe from the newsletter in the App (see Section 4). In the US territories the App does not show this control. There you can switch off Personalized Ads and Data Sharing in Privacy Controls, which stops personalised ads and the advertising user-data signal described in Section 6.

Opt-out preference signals. The App does not receive a browser signal such as Global Privacy Control. To opt out in the App, use the Universal opt-out switch described above. The Website does not sell or share personal data, so a browser signal changes nothing there.

Appeals, agents and non-retaliation. If we refuse a request, you can appeal by replying to our answer. We answer the appeal in writing with our reasons, and where the law of your state allows it, you can then contact your state attorney general. You can use an authorised agent: write to privacy@idealvibe.app with proof of the authorisation, and we may check it with you directly. We do not deny you the Services, charge a different price or give you a different quality of service because you use these rights.

California. In the App, Google (AdMob and Firebase) may collect device identifiers and information about your activity over time and across other apps when your privacy choices allow it; you can switch this off in Privacy Controls. The Website does not track visitors (see Section 5). Section 9 explains how to review your information and ask for changes, and Section 14 explains how we tell you about changes to this Privacy Policy.

Children. The App is for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18, and we do not sell or share the personal information of anyone under 18 (see Section 10).

Choices that start as on. In the 50 states and the District of Columbia: analytics, crash reports, personalised ads and third-party sharing. In the US territories: the same four and location (your device still asks for its own location permission; the location choice in the App governs only the nearby-places lookups, see Section 11). Marketing emails start as off, and a newsletter subscription normally starts without a confirmation link.

15.5 Canada

• Person in charge. The person responsible for the protection of personal information is the operator, named in Section 1. Contact: privacy@idealvibe.app.
• Access, correction and complaints. You can ask for access to your personal information, ask us to correct it, and challenge how we comply, by writing to privacy@idealvibe.app. You can also complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.
• Processing outside Canada. Your personal information is processed in the United States, in the European Union (where we are established and the Website runs) and, for the independent services in Section 6, in other countries (see Section 8). For users in Quebec, this means your information leaves Quebec.
• Quebec. Where the App recognises that you are in Quebec (from your location or your network), all privacy choices start as off, so analytics, personalised ads and third-party sharing stay off until you switch them on, and you can switch them off again in Privacy Controls. Location-based weather and nearby places work only after you allow location access for the App on your device, which the App asks for on its location screen; you can withdraw that permission in your device settings at any time. Nearby places also need the "Location for nearby places" choice to be switched on. On the set-up privacy screen the App asks whether your data may be transferred abroad to Google for analytics, crash reports, third-party sharing and personalised ads. If you decline, the App keeps these switched off and locks their switches in Privacy Controls. The data needed to run the App is processed abroad as described in Section 8 whatever you answer. Where the App has not recognised that you are in Quebec, the values for the rest of Canada apply until it does.
• Rest of Canada. Analytics and crash reports start as on; the other choices start as off.
• Marketing. We send the newsletter only with your consent. In most cases you confirm the subscription through a link sent by email; for an account that still carries an older country setting (see Section 15.13), the newsletter may start without that link.
• Language. This Privacy Policy is available in French.

15.6 Brazil

• Controller and contact. The controller is Rumen Radev, Varna, Bulgaria. The contact for data protection matters (encarregado) is the operator, named in Section 1: privacy@idealvibe.app.
• Legal bases. Where the Brazilian General Data Protection Law (LGPD) applies, we rely on the legal bases described in Section 4.
• Your rights. You can ask us to confirm that we process your data, to give you access, to correct it, to anonymise, block or delete it, to hand it over in a portable form, to tell you who we share it with, and to tell you what happens if you refuse consent. You can withdraw consent at any time and ask for a review of automated decisions. We answer within 15 days.
• Complaints. You can complain to the Brazilian data protection authority (ANPD).
• Transfers. Section 8 describes where your data goes and the safeguards.
• Children and adolescents. The App is for people aged 18 and over (see Section 10).
• Choices that start as on. Analytics and crash reports.

15.7 Other Latin America

• Mexico, Argentina, Chile and Colombia. All privacy choices start as off. In Mexico, Argentina and Chile the following applies as well. On the set-up privacy screen the App asks whether your data may be transferred abroad to Google for analytics, crash reports, third-party sharing and personalised ads. If you decline, the App keeps these switched off and locks their switches in Privacy Controls. The data needed to run the App is processed abroad as described in Section 8 whatever you answer.
• What we tell you. The data we collect and whether you must provide it are in Section 2, the purposes and legal bases in Sections 3 and 4, the recipients in Section 6 and transfers in Section 8. The use of your data for personalised advertising, analytics and the newsletter is optional. You can switch personalised ads, analytics and marketing emails off at any time in Privacy Controls, and you can also unsubscribe from the newsletter in the App's notification settings (see Section 4), without losing the core features.
• Your rights. You can ask for access, correction and deletion (cancellation) and object to processing at privacy@idealvibe.app. We respond as described in Section 9, or sooner where the law of your country requires it. You can also complain to the data protection authority of your country.
• Other countries in Latin America are covered by Section 15.13.

15.8 Japan

• Operator. Rumen Radev, Varna, Bulgaria. The purposes of use are the purposes in Sections 3 and 4.
• Information sent to other parties. The table in Section 6 shows what the App sends from your device or from our servers, to whom, why, and how you can stop it. The list below that table names the other services the App contacts and says when. Section 4 gives the retention periods.
• Recipients outside Japan. Google, RevenueCat and Resend receive data in the United States (see Sections 6 and 8). The independent services listed in Section 6 are operated outside Japan under their own privacy policies. Section 8 describes the safeguards. If you win a Creator Bounty, the payment service and the voice-tool provider described in Sections 8 and 13 can also receive your data outside Japan; ask us at privacy@idealvibe.app which provider is used and in which country. On the set-up privacy screen the App asks whether your data may be transferred abroad to Google for analytics, crash reports, third-party sharing and personalised ads. If you decline, the App keeps these switched off and locks their switches in Privacy Controls. The data needed to run the App is processed abroad as described in Section 8 whatever you answer.
• Requests and complaints. You can ask us to disclose, correct, stop using or delete your personal data at privacy@idealvibe.app. You can also contact Japan's Personal Information Protection Commission.
• Choices. All privacy choices start as off.

15.9 Republic of Korea

• Items and purposes. The items we collect are in Section 2 and the purposes in Sections 3 and 4.
• Retention and destruction. Retention periods are in Section 4. We destroy data by deleting it from our databases. Data kept in the App's own storage on your device is removed when you uninstall the App. On an iPhone or iPad, a small amount of sign-in data (your account ID and a sign-in token) can remain in the system keychain after you uninstall.
• Processors. Google (infrastructure, analytics, crash reports), RevenueCat (purchase validation on Apple devices) and Resend (email delivery). Their tasks are in Section 6.
• Transfer abroad. The table below names the recipient, the items, the country, when and how the data goes, the purpose, how long the recipient keeps it, and how to refuse. On the set-up privacy screen the App asks whether your data may be transferred abroad to Google for analytics, crash reports, third-party sharing and personalised ads. If you decline, the App keeps these switched off and locks their switches in Privacy Controls. The data needed to run the App is processed abroad as described in Section 8 whatever you answer.

• Your rights. You can ask to see, correct, delete or stop the processing of your data, and withdraw consent, at privacy@idealvibe.app.
• Privacy officer. The operator, named in Section 1. Contact: privacy@idealvibe.app.
• Identifiers and measurement tools. The advertising identifier, analytics, crash reporting and performance monitoring are described in Sections 2, 6 and 11. You can refuse them in Privacy Controls and in your device settings.
• Location. Your location is used to provide weather and nearby places and is kept as stated in Section 4. You can withdraw your consent by turning off location access for the App in your device settings.
• Choices. All privacy choices start as off.

15.10 Australia and New Zealand

• The recipients of your data and their countries are in Sections 6 and 8. Most are in the United States, where privacy protection may differ from the law of your country.
• You can complain to us at privacy@idealvibe.app. If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner or to the Privacy Commissioner of New Zealand.
• All privacy choices start as off. On the set-up privacy screen the App asks whether your data may be transferred abroad to Google for analytics, crash reports, third-party sharing and personalised ads. If you decline, the App keeps these switched off and locks their switches in Privacy Controls. The data needed to run the App is processed abroad as described in Section 8 whatever you answer.

15.11 Other Asia-Pacific

• All countries in this subsection. The data we collect and whether you must provide it are in Section 2, the purposes and legal bases in Sections 3 and 4, the recipients in Section 6 and transfers in Section 8. You can use your rights at privacy@idealvibe.app and complain to the data protection authority of your country. Unless stated below, all privacy choices start as off.
• Mainland China. In mainland China the App runs in a restricted mode: it shows no ads, does not use analytics or crash reports, and the privacy choices are switched off and cannot be switched on in Privacy Controls. We send the newsletter only if you subscribe to it in the App's notification settings. Your data is stored on the systems described in Section 8.
• Hong Kong and Taiwan. On the set-up privacy screen the App asks whether your data may be transferred abroad to Google for analytics, crash reports, third-party sharing and personalised ads. If you decline, the App keeps these switched off and locks their switches in Privacy Controls. The data needed to run the App is processed abroad as described in Section 8 whatever you answer.
• Singapore. Analytics and crash reports start as on, and you can switch them off at any time in Privacy Controls. The contact for data protection matters is the operator, named in Section 1 (privacy@idealvibe.app).
• Thailand. The App is for people aged 20 and over in Thailand, the age of majority there (see Section 10).
• Vietnam. On the set-up privacy screen the App asks whether your data may be transferred abroad to Google for analytics, crash reports, third-party sharing and personalised ads. If you decline, the App keeps these switched off and locks their switches in Privacy Controls. The data needed to run the App is processed abroad as described in Section 8 whatever you answer.
• India and Indonesia. You can switch off analytics, crash reports, personalised ads and data sharing at any time in Privacy Controls. To stop the newsletter, switch off Marketing emails in Privacy Controls or unsubscribe in the App's notification settings. To stop location use, turn off location access for the App in your device settings.
• Philippines. Analytics and crash reports start as on.
• Other countries in the region are covered by Section 15.13.

15.12 Middle East, Africa and Türkiye

• Saudi Arabia, the United Arab Emirates, Israel, Türkiye, Egypt, Nigeria and Kenya. All privacy choices start as off, and we send marketing emails only if you switch them on. On the set-up privacy screen the App asks whether your data may be transferred abroad to Google for analytics, crash reports, third-party sharing and personalised ads. If you decline, the App keeps these switched off and locks their switches in Privacy Controls. The data needed to run the App is processed abroad as described in Section 8 whatever you answer.
• South Africa. The responsible party is Rumen Radev, Varna, Bulgaria. Analytics and crash reports start as on; the other choices start as off.
• What we tell you. The data we collect, where it comes from and whether you must provide it are in Section 2, the purposes and legal bases in Sections 3 and 4, the recipients in Section 6 and transfers in Section 8. You can use your rights at privacy@idealvibe.app and complain to the data protection authority of your country (in South Africa, the Information Regulator).
• Other countries in the region are covered by Section 15.13.

15.13 Other countries

• Russia. In Russia the App runs in a restricted mode: it shows no ads, does not use analytics or crash reports, and the privacy choices are switched off and cannot be switched on in Privacy Controls. We send the newsletter only if you subscribe to it in the App's notification settings. Your data is stored on the systems described in Section 8.
• Countries without a subsection. If your country is not named in this Section 15, the App applies its strict default settings. All privacy choices start as off. On the set-up privacy screen the App asks whether your data may be transferred abroad to Google for analytics, crash reports, third-party sharing and personalised ads. If you decline, the App keeps these switched off and locks their switches in Privacy Controls. The data needed to run the App is processed abroad as described in Section 8 whatever you answer.
• If the App cannot work out your country. The same strict settings apply, and no ad is requested until Google's consent check has finished. Where Google shows its consent message, no ad is requested until you have answered it (see Section 11). The App replaces these settings once it can work out your country.
• Accounts with an older country setting. An account created with an early version of the App can still carry a general "other country" setting until the App works out its country. For such an account the choices you made at set-up stay as they are; where the privacy screen is shown again, analytics, crash reports, personalised ads, third-party sharing and location start as on. The newsletter may start without a confirmation link.

16. Contact Us