Gubify

1. Scope and introduction

This Privacy Policy explains how Gubify processes personal data when you use the Gubify mobile application, gubify.com and related pre-registration, support, feedback, public Community discovery, moderation and account-deletion services.

Gubify is operated from Italy. The EU General Data Protection Regulation (GDPR) and applicable Italian data-protection law provide the principal framework for the processing described here. Where other mandatory privacy laws apply, Gubify will respect those requirements to the extent applicable.

Gubify processes personal data according to the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

2. Data controller

The data controller is Sami Ben Hassen, operating Gubify as a personal initiative in Italy. Privacy enquiries and requests may be sent to privacy@gubify.com.

Where an infrastructure provider acts as an independent controller for a particular processing activity under its own terms and applicable law, that provider is responsible for that independent processing.

3. Account and profile data

Depending on the features and account method you use, Gubify may process a Firebase Authentication user identifier, chosen display name, email address, account creation/update timestamps, authentication status and profile information you choose to provide.

Gubify may initially create a technical anonymous Firebase identity. Users may secure or access an account through supported methods such as Google Sign-In or email and password.

4. Authentication data

When you use Google Sign-In, Gubify receives the account identity information made available through the Google authentication flow and needed to authenticate or link your account. When you use email and password, Firebase Authentication manages the authentication credentials and related security operations.

Gubify does not need or ask you to provide your Google password. Password handling for email/password authentication is performed through Firebase Authentication rather than being stored as plain text by Gubify.

5. Private Gubs and Communities

Gubify may process Gub and Community identifiers, names, descriptions, settings, ownership, roles, membership information, join requests, invitations, access mode, language, member count and timestamps needed to operate these spaces.

Private Gub content is intended for authorised members according to feature permissions. Public Communities have separate discovery characteristics described below.

6. Public Community pages, SEO and discovery

When a Community is public, selected Community information may be made available on gubify.com so that people can discover the Community. Public fields may include the Community name, slug, description, image, language, access mode, member count and other discovery information enabled by the Service.

Public Community pages may include metadata used by browsers, link-preview services and search engines. As a result, third-party search engines such as Google may crawl, cache or index public Community information. Search engines determine their own indexing and removal schedules.

Member-only chat and other member content are not made publicly available solely because the Community has a public discovery page, unless a feature clearly informs users otherwise.

7. User Content and activity data

Depending on the features you use, Gubify may store chat messages and related metadata, Board posts, tasks and assignments, completion information, calendar entries, organised events, proposals and votes, Shared Budget records, Ask posts and answers, in-app notifications, read/unread state, membership activity and other information needed to provide the selected feature.

Users should avoid placing unnecessary sensitive personal data in free-text fields. Gubify does not intentionally require special-category data for ordinary use of the Service.

8. Community images

Where the Community image feature is used, the selected image and technical upload information are processed so the image can be uploaded, stored, delivered, replaced or deleted. The current implementation uses a Gubify-controlled Cloudflare Worker for upload authorisation and Cloudinary for image storage and delivery.

Public Community images may be visible on the Community's public web page and may therefore be cached or indexed by third-party services in the same way as other public Community information.

9. Moderation, reports, blocks and restrictions

When a user submits a report, Gubify may process the reporter identifier, the reported user or content identifier, the relevant Gub or Community identifier, reason, optional details, timestamps, display-name snapshots and a snapshot of the reported content when necessary to understand the report.

Community reports may concern a Community, user, message, Ask post or answer. Private Gub reporting may include reported chat messages or users where the relevant reporting feature is available.

Gubify also processes data needed to remember user blocks and to apply platform or Community restrictions, including restrictions on Community chat, Community discovery or joining where those controls are used.

Moderation records may be used to investigate abuse, protect users, apply or review enforcement, detect repeated abuse, respond to legal requests and defend legal rights. They are not retained longer than reasonably necessary for those purposes, subject to legal or security requirements.

10. Website, pre-registration, support and deletion requests

When you pre-register, Gubify may process your email address, optional first name, device/platform interest, consent status and timestamp, accepted policy version, campaign/landing information and security information needed to protect the form from abuse.

When you contact support or submit feedback, Gubify processes the information you provide and limited technical context reasonably useful for diagnosis or response, such as app/site version, platform, operating system, device or browser information, language, timezone, page URL and report source when available.

If you use the public account-deletion request resource, Gubify processes the contact email, optional display name, optional notes, confirmation of the request, request status and timestamps needed to verify, manage and document the request.

11. Technical and security data

Gubify and its infrastructure providers may process network, request, device, browser, authentication, security, anti-abuse and diagnostic information generated when the Service is used. This information is used to deliver the Service, prevent abuse, diagnose failures and protect accounts and infrastructure.

The website may use Cloudflare Turnstile or equivalent anti-abuse technology to protect forms and services from automated misuse.

At the date of this Policy, Gubify does not state that it uses third-party behavioural advertising SDKs in the mobile app. If this changes, the Policy and any legally required consent mechanisms will be updated.

12. Purposes of processing

Gubify processes personal data to create and authenticate accounts; provide Private Gubs and Communities; deliver messaging, collaboration and organisational features; display content to intended recipients; operate public Community discovery and web pages; process Community images; manage membership and ownership; provide support and feedback channels; process account-deletion requests; receive and investigate reports; apply blocks and restrictions; secure the Service; prevent fraud and abuse; maintain reliability; comply with legal obligations; and establish, exercise or defend legal claims.

Gubify does not sell personal data. Gubify does not disclose personal data to third parties for their independent behavioural advertising purposes based on the current Service.

14. Visibility and recipients

Gubify is a shared service. Personal data and User Content may therefore be visible to other users where that visibility is inherent in the feature chosen by the user. For example, a display name and message may be visible to members of the relevant Gub or Community.

Public Community information may be visible to any internet user and to search engines. Private Gub content is intended for authorised members, subject to the relevant permissions.

Personal data may also be disclosed to service providers acting for Gubify, to professional advisers where necessary, and to competent authorities or other recipients where disclosure is required or permitted by law.

15. Service providers

Gubify currently relies on the following categories of providers, which may process personal data only to the extent necessary for their services and subject to applicable contractual and legal safeguards:

  • Google Firebase - Firebase Authentication for account identity and Cloud Firestore for app data storage and synchronisation.
  • Cloudflare - website hosting and delivery, Cloudflare Workers, Cloudflare D1 where used, Turnstile, security and abuse prevention.
  • Cloudinary - storage, transformation and delivery of Community images.
  • Resend - where configured, delivery of internal notifications connected with account-deletion requests submitted through the website.

16. International data transfers

Some service providers may process data outside Italy or the European Economic Area. Where the GDPR requires safeguards for an international transfer, Gubify relies on the transfer mechanism applicable to the relevant provider and processing, such as an adequacy decision, Standard Contractual Clauses or another lawful mechanism.

Provider infrastructure and transfer mechanisms may change over time. Gubify will update this Policy where a change materially affects the information that must be provided to users.

17. Data retention

Gubify retains personal data only for as long as reasonably necessary for the purpose for which the data were collected, subject to applicable legal, security and dispute-resolution needs. Different categories have different retention criteria.

Account/profile and membership data are generally retained while the account or relevant membership remains active and are then deleted or anonymised through the applicable deletion process, subject to necessary exceptions. Shared collaborative content may remain in anonymised form where deleting the entire record would disrupt other users' shared history.

Moderation, fraud, security and legal records are retained according to their relevance, severity, risk of repeated abuse and any applicable limitation or legal-retention period. Deletion-request and support records are retained only as long as reasonably necessary to process and document the request or resolve the issue.

Pre-registration data are retained while reasonably necessary for the stated launch/beta purpose or until consent is withdrawn, unless another lawful reason requires limited continued retention.

18. Account deletion and anonymisation

Gubify provides an in-app account-deletion process and a web resource for deletion requests. The in-app process may require reauthentication. An account cannot complete deletion while it still owns a Private Gub or Community, because ownership must first be resolved to avoid leaving shared resources without a responsible owner.

When the implemented in-app deletion completes, Gubify removes the account/profile and membership data covered by the deletion workflow and deletes the authentication account. Shared collaborative records may be anonymised rather than removed. In the current implementation, certain messages and other shared records may remain but replace the user identity with "Deleted user" so that shared histories remain coherent.

Data may be retained after an account-deletion request where and for as long as there is a legitimate and lawful reason, including security, fraud or abuse prevention, compliance with law, or the establishment, exercise or defence of legal claims. Where retained, data remain subject to applicable data-protection requirements.

19. Your privacy rights

Where the GDPR applies, you may have rights including access, rectification, erasure, restriction, objection, data portability and withdrawal of consent where processing is based on consent. The availability and scope of each right depend on the circumstances and applicable law.

Requests may be sent to privacy@gubify.com. Gubify may need to verify identity before acting on a request. You also have the right to lodge a complaint with a competent supervisory authority, including the Italian Garante per la protezione dei dati personali where appropriate.

20. Users aged 16 and over

Gubify requires users to be at least 16 years old as a rule of the Service. The Service is not directed to children under 16 and Gubify does not knowingly intend to provide accounts to them.

If Gubify learns that an account belongs to a person who does not satisfy the age requirement, it may restrict or delete the account and take reasonable steps regarding the associated data, subject to applicable law.

21. Marketing, advertising and future paid features

Pre-registration or launch communications are sent only on the legal basis stated at collection, including consent where required. Users can withdraw consent to optional marketing communications at any time.

Gubify may introduce paid features, subscriptions, sponsorships or advertising in the future. This Policy does not state that payment information or behavioural advertising data are currently processed merely because the Terms reserve that possibility. Before introducing processing that materially changes how personal data are used, Gubify will update the relevant privacy information and obtain consent where required.

22. Automated decision-making

Gubify does not currently describe its ordinary moderation and account decisions as solely automated decisions producing legal or similarly significant effects. Moderation tools may use technical rules, filters or signals to assist safety and abuse prevention, but material decisions may be reviewed where appropriate.

If Gubify later introduces solely automated decision-making that requires specific GDPR information or safeguards, this Policy will be updated before or when that processing is introduced.

23. Security

Gubify uses technical and organisational measures intended to protect personal data against unauthorised access, alteration, disclosure or loss. Measures may include authentication controls, access rules, secure transport, provider security controls, anti-abuse services and limited administrative access.

No internet service can guarantee absolute security. Users should protect their devices and credentials and promptly report suspected account compromise.

24. Changes to this Policy

Gubify may update this Privacy Policy to reflect changes in the Service, data-processing practices, providers or applicable law. The current version and update date will be published with the Policy.

Where a change materially affects how personal data are processed, Gubify will provide additional notice or obtain consent where required by applicable law.

25. Contact

Privacy: privacy@gubify.com Support: support@gubify.com Legal: legal@gubify.com General information: hello@gubify.com Beta: beta@gubify.com

Data controller: Sami Ben Hassen. Contact: privacy@gubify.com.