boy bye (“bb,” the “App,” “we,” “us,” or “our”) is a gamified, mindful relationship diary. This policy explains what personal data we collect, why, how we protect it, and the rights you have over it. We’ve tried to keep it plain. We collect as little as possible and we never sell your data.
1. Who we are & how to reach us
The App and the website at boybye.tv are operated by the boy bye team — the data controller responsible for your personal data (full legal details in the Impressum). For any question — including privacy questions and exercising your rights — contact us at hello@boybye.tv.
2. Who can use bb
bb is intended for users aged 18 and over. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has given us their data, email us and we will delete it.
3. The data we collect
Account information
- Email address — used to create your account, sign you in, verify you with a one-time code, and send essential account emails (confirmation, password resets).
- Password — stored only as a salted cryptographic hash by our authentication provider. We never see or store your plain-text password.
Content you create in your diary
This is the heart of the App, and it stays yours. It includes:
- The name and photo you add for the person in your diary, plus any custom background you pick.
- Your logged actions(“LOVE” and “DEATH” entries), the categories you assign, point values, and any free-text notes you write.
- Your custom action presets, cycle history, in-app items, and related diary state.
- Letters to your future self — the titles and bodies you write.
Information stored only on your device
- Diary lock PIN— if you set one, it never leaves your device. We store a salted hash of it in your phone’s encrypted keychain; we cannot see or recover your PIN.
- Session tokens — kept in local app storage so you stay signed in.
Website & waitlist
If you join the pre-launch waitlist on boybye.tv, we store the email address you submit, the page/button it came from, and your browser’s user-agent string, so we can notify you at launch.
What we don’t collect
We do not use third-party advertising or analytics SDKs, we do not track you across other apps or websites, and we do not collect your location, contacts, or device identifiers for tracking. We request photo-library access only to let you pick a photo, and only when you tap to add one.
4. How & why we use your data (legal bases)
Under the GDPR, we rely on the following legal bases:
- To provide the App (performance of a contract): create and secure your account, store and sync your diary across your devices, and run core features.
- With your consent: accessing your photo library, running optional background-removal, and joining the waitlist. You can withdraw consent at any time.
- Legitimate interests: keeping the service secure, preventing abuse, debugging, and improving features — balanced against your rights.
- Legal obligation: where we must retain or disclose data to comply with the law.
We do not use your diary content for advertising, profiling, or automated decision-making, and we never sell it.
5. Information about other people
bb is a diary about a relationship, so it lets you write about another person — usually a partner — including a name or nickname and a photo. Please read this section carefully.
- It is your record, not a file on them. Everything you write is your own subjective account of your own experience. bb never contacts that person, never collects anything from their device, and never shows them anything.
- You are responsible for what you upload. Only upload a photo you have the right to use. We suggest using a first name or a nickname rather than a full name.
- It travels with your account. If you delete your account, everything you wrote about anybody else is deleted along with it.
- If you are that other person: you can contact us at hello@boybye.tv, but we cannot search or disclose the contents of someone else’s private diary without a valid legal basis.
6. Who we share data with
We don’t sell your data and we don’t share it for others’ marketing. We use a small number of trusted service providers (“processors”) who handle data only on our instructions:
- Supabase — our database, authentication, file storage, and backend hosting. Your data is hosted in the EU (Ireland).
- Resend — sends your essential account emails (verification codes, password resets). It receives only your email address and the message itself.
- remove.bg (Kaleido AI GmbH, Austria) — only if you use the optional background-removal feature. That single image is sent to be processed and returned; it is not used for anything else.
- Apple — distributes the App and handles App Store accounts.
We may also disclose data if required by law, to enforce our Terms, or to protect the rights, safety, and security of our users or the public.
7. International transfers
Our providers may process data on servers outside your country, including outside the European Economic Area. Where data is transferred internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.
8. How long we keep it
We keep your account and diary data for as long as your account is active. When you delete your account, we permanently delete your identity and all associated diary data (boyfriends, actions, cycles, items, letters, custom presets) and remove your uploaded photos. Backups and logs are purged on a rolling basis shortly afterwards. Waitlist emails are kept until launch or until you ask us to remove them.
9. How we protect your data
- Data is encrypted in transit (HTTPS/TLS).
- Each user’s rows are isolated at the database level (row-level security), so one account can only ever read and write its own data.
- Passwords are salted and hashed; your diary PIN is hashed and stored in the device keychain.
- Access to backend systems is limited to what’s necessary to operate the service.
No system is perfectly secure, but we work to protect your data and to respond promptly if anything goes wrong.
10. Your rights
If you are in the EEA, UK, or a similar jurisdiction, you have the right to: access your data; correct it; delete it; restrict or object to certain processing; receive a portable copy; and withdraw consent at any time. You can:
- Delete your account and data directly in the App (Menu → Delete my account), which removes your account and content for good — see exactly what gets deleted.
- Update your email or password under Menu → Account & security.
- Email us at hello@boybye.tv to exercise any right. We’ll respond within the time the law requires (generally one month).
You also have the right to lodge a complaint with your local data protection authority if you believe we’ve mishandled your data.
11. Children’s privacy
bb is not intended for anyone under 18 and we do not knowingly collect their data. If we learn we have, we will delete it promptly.
12. Changes to this policy
We may update this policy as the App evolves. We’ll change the “Last updated” date above and, for material changes, notify you in the App or by email. Continuing to use bb after an update means you accept the revised policy.
13. Contact us
Privacy questions, rights requests, and everything else: hello@boybye.tv. See also our Terms & Conditions and, if you are experiencing harmful or abusive behaviour, the resources at boybye.tv/help.