Privacy & Cookie Policy

deBub is a trading name of Appmetize LTD, a company registered in England and Wales (company number 12896378), registered office 112c High Street, Hadleigh, Suffolk IP7 5EL, United Kingdom (“deBub”, “we”, “us”).

We are the controller of the personal data about you, our customer, described in this policy. When we process personal data about your app's users on your behalf, we are your processor, and our Data Processing Agreement applies instead (see Your app's users).

Contact us about anything in this policy, including requests about your data, at hello@debub.io.

• Account data: your name, email address, optional company name and GitHub username, and your sign-in details, which are handled by our authentication provider, Clerk.
• Payment data: your Stripe customer ID and details of your purchases and subscription (amount, date, status, discount or promotion code used). You enter card details directly with Stripe; we never see or store card numbers.
• Partner applications: if you apply on /partners, your name, email, company or website, the size of your audience or client base and what you tell us about how you'd use deBub — used only to assess and answer your application.
• Project data: the .bubble export you upload (as soon as we receive it we remove your app's API keys, passwords and other secrets from it — we keep only their names, so your generated code can read them from environment variables), your app's address, scan results, screenshots of your app's public test-version pages taken during the full scan, your review choices, the generated code and its change history.
• Assistant data: your messages to the assistant, the screenshots and files you attach, its responses and changes, and your credit usage.
• Connections: access tokens for the Supabase and GitHub accounts you connect, the Bubble Data API token you give us, and your own email provider (Resend) API key and sender details, if you use the launch steps. We store these encrypted.
• Sign-up source: when you create an account, the campaign tags of the link that brought you to our site (for example “reddit / community / beta-oct26”), the name of the website that linked to us (only the site, such as “forum.bubble.io”, not the page) and the first page you opened on our site. See Sign-up source.
• Feedback: ratings and comments you give us when we ask about your experience.
• Emails and support: messages you send us, and a record of the emails we send you (recipient, subject, delivery status; not the content).
• Technical data: logs needed to run and secure the Service, such as IP address, browser details, times and errors. Our hosting providers record these when you use the site.

We do not ask for, and you should not give us, the login details for your Bubble account, the Bubble editor or your app. We do not use advertising or analytics trackers, we do not sell your data and we do not use your app, code or data to train AI models.

• to provide the quick scan, the conversion, the hosted preview, the assistant, the customer database and the launch steps (performance of our contract with you);
• to take payment, issue receipts and keep accounting and tax records (contract and legal obligation);
• to send you service emails about your account and projects, such as “your clone is ready” or “your payment is confirmed” (contract);
• to ask for feedback a few times after key steps, and to summarise feedback for our team with the help of an AI model (legitimate interest in improving the Service; you can ignore or ask us to stop these requests);
• to count how many new accounts, scans and purchases come from each place where we share links to deBub, such as a forum, a community group or a newsletter (legitimate interest in deciding where to spend our marketing effort; see Sign-up source);
• to keep the Service secure, prevent abuse and fraud, and fix problems (legitimate interest in running a safe service); and
• to answer your questions and handle complaints (contract and legitimate interest).

We share links to deBub in places such as the Bubble forum, Reddit, LinkedIn, Facebook groups, Upwork and newsletters. These links carry campaign tags that name the place (for example ?utm_source=reddit&utm_medium=community&utm_campaign=beta-oct26). To learn which places bring us customers, we keep, for the visit on which you create your account:

• the link's campaign tags (source, medium, campaign and, if present, content);
• the name of the website that linked to us, if your browser tells us (the site only, not the page); and
• the first page you opened on our site (without any search terms or identifiers).

The page you arrive on holds these details in its memory while you browse and passes them to the sign-up form. Nothing is stored on your device — no cookie and no browser storage — and nothing is sent to us unless you create an account. If you close or reload the page, they are gone. When you sign up, the sign-up form passes them through our sign-in provider, Clerk, to your account record with us; we then remove them from your user record at Clerk. We copy them onto the projects you create, so we can see which channels lead to purchases.

We do not record your IP address, device or browser details, or anything about other websites you visit for this, we do not use analytics or advertising tools, and we only look at the results as totals per channel. We do not use them to make decisions about you. Our legal basis is our legitimate interest in knowing which channels are worth our limited marketing time; we think the impact on you is minimal because the details describe the link, not you. You can object at any time at hello@debub.io and we will delete them from your account. We delete them automatically 24 months after you sign up, or when you close your account.

The assistant, automated build fixes and plugin suggestions use AI models from Anthropic. When you use them, we send the relevant content to Anthropic: your messages and attachments, the project files the assistant reads, and plugin names and notes. Anthropic processes this on our behalf to produce a response and does not use it to train its models under our agreement with it.

The AI does not make decisions about you that have legal or similarly significant effects. It works on your code at your request.

Some parts of the Service involve personal data about the people who use your app (“end users”):

• a .bubble export, screenshots and files you attach can contain end-user data you have put into the app;
• the customer database copies your Bubble records and user accounts into your own Supabase project, using the Bubble Data API token you give us. The data passes through our processing server in memory, and is stored in your Supabase project, not in our database;
• the hosted preview runs your app with your customer database once it is connected; and
• if you confirm it, we send invitation emails to your end users through your own email provider, and keep a list of who has been invited so nobody is emailed twice.

For this data you are the controller and we act only on your instructions as your processor, under the Data Processing Agreement. End users who want to exercise their rights should contact the owner of the app; we will help the owner respond.

We use these service providers to run deBub. They process data on our instructions:

• Contabo GmbH — our processing server: quick scan and full scan, code generation, the assistant's sandboxed workspace, hosted preview, customer-database setup, data copy and launch steps (Germany (EU)).
• Supabase, Inc. — our application database and private file storage (Ireland (EU, region eu-west-1)).
• Vercel Inc. — hosting of the debub.io website and its API (United States, with a global edge network).
• Anthropic, PBC — aI models (Claude) that power the assistant, automated build fixes and plugin suggestions (United States).
• Clerk, Inc. — sign-in, account management and session security (United States).
• Stripe — payments, subscriptions, invoices and fraud prevention (United States, Ireland and the UK).
• Resend (Plus Five Five, Inc.) — transactional email from deBub (for example, “your clone is ready”) and operational alerts (United States and the EU).
• Google LLC (Google Workspace) — our email inbox at hello@debub.io (Global (United States and other countries)).
• GitHub, Inc. — only if you connect GitHub: our GitHub App creates a private repository in your account and pushes your code to it (United States).

The full list, with what each provider receives, is on our sub-processors page. When you connect your own Supabase, GitHub, Vercel or Resend account, the data you send there is governed by your agreement with that provider.

We may also disclose data if the law requires it, to protect our rights or others' safety, or to a buyer as part of a sale or reorganisation of our business, who would have to respect this policy.

Our processing server is in Germany and our database is in Ireland. Some providers, such as Vercel, Clerk, Stripe, Anthropic, Resend and Google, are based in or process data in the United States or other countries outside the UK and the European Economic Area. Where that happens, we rely on an adequacy decision (including the EU–US Data Privacy Framework and its UK extension, where the provider is certified) or on the European Commission's standard contractual clauses together with the UK addendum. You can ask us for a copy of the relevant safeguards.

• Partner applications: up to 12 months after we've answered, or for as long as you're a partner; tell us at hello@debub.io and we delete it sooner.
• Project data (.bubble export, scan results, screenshots, generated code, change history, assistant conversations): for as long as your account is open, so you can download your code again, use your free regeneration, the preview and the assistant. If you ask us to delete a project, we delete it within 30 days. The file you uploaded is deleted from our storage once code generation has started; we keep only the copy without secrets on our processing server.
• Assistant attachments: up to 30 days after you send them, on our processing server and in our private storage.
• Connection tokens and keys: until you disconnect the account or database, or delete the project. We recommend deleting the Bubble Data API token in Bubble once you have gone live.
• Account data: while your account is open. When you close it, we delete your account and projects within 30 days, except what we must keep by law.
• Sign-up source: 24 months after you create your account, then deleted automatically; sooner if you close your account or object.
• Payment and tax records: 6 years after the end of the financial year they relate to, as UK law requires.
• Server logs: kept for up to 14 days on our processing server, and for our hosting providers' standard log periods.
• Backups: where we keep encrypted backups, copies are deleted on a rolling schedule within 12 months.

All connections to debub.io, our processing server and the preview use TLS encryption. Access tokens and keys you give us are encrypted in our database with AES-256-GCM. Code generated for you and the assistant's work run in isolated sandboxes. Access to our systems is limited to the people who need it, and our server can only be reached with SSH keys. The Data Processing Agreement describes our measures in more detail. No system is completely secure. If a personal data breach puts your rights at risk, we will tell you and the relevant authority as the law requires.

Under the UK GDPR, and the EU GDPR if you are in the EU, you can ask us to access, correct, delete or export your personal data, and to restrict or object to how we use it, including objecting to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time.

Email hello@debub.io to make a request. We may need to confirm your identity. We will reply within one month. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or the data protection authority where you live, but please contact us first so we can try to help.

We only use cookies and browser storage that are strictly necessary to provide the Service you ask for, or that remember a choice you make. We do not use analytics, advertising or tracking cookies, and we do not load third-party trackers. Because of this, we do not show a cookie consent banner. If that ever changes, we will ask for your consent first. Recording your sign-up source uses no cookie or browser storage: the details stay in the open page's memory until you sign up or leave.

Payment happens on Stripe's own checkout and billing pages, where Stripe sets its own cookies for payment and fraud prevention under its privacy policy. Our fonts are served from our own site. Your browser connects directly to our storage provider, Supabase, to upload your export and to receive live progress updates.

The hosted preview runs your generated app. Any cookies or storage that your app uses in the preview are set by your app's code. Some of our emails load a font from Google Fonts when your email program displays them.

You can block or delete cookies in your browser settings. If you block the sign-in cookies, you will not be able to sign in.

We will update this policy when our practices change and tell you about material changes by email or in the app before they take effect. See also our Terms of Service.

Questions: hello@debub.io, or write to Appmetize LTD, 112c High Street, Hadleigh, Suffolk IP7 5EL, United Kingdom.