Legal

Privacy Policy

Effective 26 September 2026 · Applies to the BUBU app and website

The short version

BUBU is an affective AI companion. It is not a therapist and not an emergency service.
Your camera video never leaves your phone, except one still photo when you ask BUBU what it can see.
What you say is turned into text. That text is sent to our AI provider to create BUBU's reply, and stored so BUBU can remember you.
We do not sell your data, show you ads, or use it to train AI models.
You can delete your account and everything in it from inside the app at any time.

Each section below starts with the exact wording, then an "In plain words" box that explains what it means for you. Words that might be unfamiliar are explained in section 19.

1. Who we are

BUBU is built and run by Amthuz Zafrin, an individual developer based in India ("we", "us"). We decide what data BUBU collects and why, so under India's Digital Personal Data Protection Act, 2023 we are the data fiduciary for your information.

This policy explains what BUBU collects, why, who else receives it, how long it is kept, the risks, and the choices and rights you have. Please also read our Terms of Use, which explain the agreement you make when you use BUBU.

One person, Amthuz Zafrin, makes BUBU and is responsible for looking after your information. If something goes wrong with your data, she is the person the law holds responsible, and the person you contact.

2. What BUBU is, and is not

BUBU is an affective AI companion. It listens, notices how you seem to be feeling, and talks with you. It uses general wellbeing approaches such as active listening, mindfulness and ideas from cognitive behavioural therapy.

BUBU is not a licensed therapist, doctor or medical device. It does not diagnose or treat any condition and does not prescribe anything. It is not an emergency service and cannot contact anyone for you.

BUBU can be a kind ear, but it is not a doctor or counsellor. It cannot tell you what is wrong, give you treatment, or get help for you. For those, talk to a professional, or in an emergency call 112.

3. What we collect

We collect only what BUBU needs in order to work:

Information	Why we need it
Email address	To create your account, sign you in and reset your password. We do not send marketing email.
Password	Handled by Google Firebase Authentication. We never see or store your password in readable form.
Your name, and the name you ask BUBU to call you	So BUBU can address you.
Country	So that if a conversation turns to your safety, BUBU shows helplines for where you are.
What you say, as text	To answer you, and so the conversation makes sense from one moment to the next. Each message is stored with a note of whether it triggered BUBU's safety response.
A memory summary	Short notes BUBU keeps about you, such as what matters to you and what you talked about, written from your recent conversations so BUBU remembers you between visits.
Mood history	One word per day for the mood BUBU noticed, such as "calm" or "sad", so it can notice how you have been lately.
Usage counts	How many messages you sent today, to apply your plan's daily allowance, and how many sessions you have had.
Subscription status (once subscriptions launch)	Whether you have an active plan, and until when. Payment itself happens in Google Play, and we never receive your card, UPI or bank details.

Signals worked out on your phone

Some things are worked out on your phone from the camera and microphone, and only a short text label is sent, never the picture or sound:

Your apparent mood, such as "stressed" or "happy". It is combined from your expression, your voice and your words, and sent with each message so BUBU can respond to how you feel.
Your estimated age, sent only if you ask BUBU to guess it, and only for that answer. It is an estimate and often wrong.
Whether the camera is on, so BUBU does not talk about seeing you when it cannot.

We do not collect your contacts, location, photos, files, advertising ID or any other apps' data.

Say you tell BUBU: "I'm Priya, work has been awful this week." We store your email and name from sign-up, and the words you said as text. We add a short note like "stressed about work" to BUBU's memory of you, and one mood word for today, like "stressed". Your face and your voice recording are not stored anywhere.

4. What stays on your phone

Some settings are stored only on your device. These include the voice you chose for BUBU, whether you have seen the welcome screen, and a local copy of your memory that BUBU uses if it cannot reach our servers. Clearing the app's data or uninstalling it removes them.

A few small settings live only on your phone, never on our servers. If you uninstall BUBU, they are gone; your account and anything stored on our side stay until you delete your account (section 15).

5. Your camera

BUBU uses the front camera to read your facial expression. This happens entirely on your phone. The video is never uploaded, stored, or seen by anyone, including us.

The one exception is something you have to ask for. If you ask BUBU what it can see, a single still photo is sent to our AI provider to be described. It is used for that answer and is not kept by us afterwards.

You can refuse camera access, or turn it off in your phone's settings, and still talk to BUBU. It just will not be able to see your expression.

BUBU watches your face only to guess your mood, and that happens inside your phone. Nobody sees you. The only time a picture leaves your phone is when you say something like "BUBU, what can you see?": then one photo is sent for that answer and not kept. You can also keep the camera off entirely.

6. Your microphone

Your speech is turned into text, and only the text reaches our servers. We never receive or store the audio.

Worth knowing: the speech-to-text step is done by your phone, not by BUBU. On most Android phones, that means your audio is sent to Google's speech service to be transcribed, under Google's privacy policy. That step is outside our control. We mention it because you would otherwise not know it happens.

The microphone and camera are released when you leave the app or switch away from it, and nothing turns them back on until you tap.

We never get a recording of your voice, only the words. But to turn your voice into words, your phone usually uses Google's speech service, so Google hears the audio, the same way it does when you use voice typing on your keyboard.

7. How we use your information

We use your information only to:

run your account and sign you in;
have conversations with you, and remember you between them;
check messages for signs that you may be in danger, and show you helplines;
apply your plan's daily message allowance and, once subscriptions launch, manage your subscription;
keep BUBU secure and working, and fix problems; and
meet our legal obligations.

We process your information because you give your consent when you create your account and use BUBU. You can withdraw that consent at any time by deleting your account (see section 15). We never use your information for advertising, and we never sell it.

Your information is used to make BUBU work for you and keep you safe, nothing else. You said yes to this when you signed up. If you change your mind, delete your account: that is how you take your "yes" back.

8. Who we share it with

We share information only with the services BUBU needs in order to run. Each receives only what it needs:

Service	What it receives, and why
Our AI model provider	The text of your message, recent conversation, your memory summary and your mood signal. It uses these to write BUBU's reply and to run BUBU's safety check. It also receives the still photo if you ask BUBU what it can see.
Google Firebase	Your account and the stored data described above. Firebase provides BUBU's sign-in, database and hosting.
Your phone's speech service	Your audio, as described in section 6.
Google Play (once subscriptions launch)	Your purchase. Google handles payment under its own terms, and we receive only a confirmation that you have paid.

We do not sell your data, share it with advertisers, or use it to train AI models. We will disclose information only if the law requires us to, for example under a valid order from an Indian court or authority.

These companies are service providers: they do a job for BUBU, such as writing replies or storing data, and are not allowed to use your information for their own purposes. That is different from selling data, which we never do.

9. Where it is stored

The services above run on servers that may be located outside India, including in the United States. By using BUBU you agree that your information may be transferred to and processed in those countries, as permitted by Indian law.

The computers that store your data and write BUBU's replies may be in other countries, such as the USA, not in India. Indian law allows this, and the same protections in this policy still apply.

10. How long we keep it

Information	Kept for
Conversation text	12 months, then deleted automatically
Mood history	30 days, on a rolling basis
Account details, memory summary, usage counts	Until you delete your account
A still photo you asked about	Not kept after BUBU answers
Camera video and your audio	Never received, so never kept

When you delete your account, everything in the first three rows is deleted straight away.

Something you said on 1 March 2027 is deleted around 1 March 2028. Today's mood word is gone after 30 days, so BUBU only ever sees your last month of moods. Everything else stays until you delete your account, and then it all goes at once.

11. How we protect it

Everything travels between your phone and our servers over encrypted connections (HTTPS).
Your stored data is encrypted by Google's infrastructure.
Database rules mean your records can be read only by your own signed-in account and by BUBU's server, never by other users.
Settings that control your plan and allowance can only be changed by our server, not by the app.
Access to the systems holding your data is limited to the developer.

No system is perfectly secure, and we cannot promise that your information will never be accessed without permission. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires.

Your data is scrambled while it travels and while it is stored, so it is unreadable to anyone who intercepts it. Other BUBU users can never see it. If something ever goes wrong and your data is exposed, we will tell you.

12. Risks you should know about

We want you to decide what to share with your eyes open. Using BUBU carries these risks:

You may share very personal things. What you say is stored as text for up to 12 months and sent to our AI provider. Only share what you are comfortable with being stored this way. Avoid sharing other people's private details, or passwords and financial information.
AI can be wrong. BUBU can misunderstand you, misread your mood, or say something unhelpful or inaccurate. Do not rely on it for medical, legal, financial or safety decisions.
The safety check is not perfect. It can miss a sign of danger or react when there is none. It is never a replacement for emergency help.
Mood and age readings are guesses. They come from an automated model and are often inaccurate.
Someone else with your phone could talk to BUBU as you. If your phone is unlocked and signed in, they could talk to BUBU, and BUBU would remember things you told it. Lock your phone, and sign out on shared devices.
Speech is transcribed by a third party, as described in section 6.
Data security. Like any online service, BUBU could be affected by a security breach despite the protections above.
Processing outside India, as described in section 9.

Treat BUBU like a diary that is kept safe but not locked in a vault. Tell it what you are comfortable writing down. Never tell it passwords, bank details or other people's secrets, and keep your phone locked.

13. If you are in danger

Every message is checked for signs that you might be at risk before BUBU's AI is allowed to reply, whether or not you have a subscription. If it looks like you are in danger, BUBU shows you helpline numbers for your country.

BUBU cannot call anyone for you, and it does not contact emergency services, your family or anyone else on your behalf. If you are in immediate danger, call your local emergency number (112 in India) or go to the nearest hospital.

If you tell BUBU you are thinking of hurting yourself, it gives you real phone numbers to call, even if you have not paid. But it cannot ring anyone for you, so the call has to come from you. Our Safety & helplines page lists the numbers.

14. Your rights, and how to use them

Under India's Digital Personal Data Protection Act, 2023, you have the rights below. To use any of them, email us from the address on your BUBU account (see section 18). You can copy the example message.

Your right	What it means	Example message you can send
Access	Get a summary of the personal data we hold about you and what we do with it.	"Please send me a summary of the personal data BUBU holds about me."
Correction	Fix anything wrong, incomplete or out of date.	"My name on BUBU is spelled wrong. Please correct it to …"
Erasure	Have your data deleted. You can also do this yourself in the app (section 15).	"Please delete my BUBU account and all my data."
Withdraw consent	Take back your permission for us to use your data. BUBU cannot work without it, so this ends your account.	"I withdraw my consent. Please delete my account."
Complain	Tell us if you are unhappy with how your data is handled, and get an answer.	"I have a complaint about how my data was handled: …"
Nominate	Choose someone who can use these rights for you if you die or cannot act yourself.	"I nominate [name, email] to act for me on my BUBU data."

If you are not satisfied with our answer to a complaint, you can complain to the Data Protection Board of India.

It is your data. You can see it, fix it, delete it, or stop us using it, just by emailing us. You do not need a lawyer or a special form. If we do not sort it out, there is a government body you can go to.

15. Deleting your account

You can delete your account from inside the app at any time. Deletion removes your account and sign-in, profile, memory summary, mood history, usage counts and stored conversations. It is immediate and cannot be undone.

How to do it

Open BUBU and say "delete my account".
BUBU opens a confirmation screen that explains what will be removed.
Confirm. Your account and everything in it are deleted straight away, and you are signed out.

If you can no longer open the app, email us from the address on your account and we will delete it for you.

Have a subscription? Deleting your account does not cancel a Google Play subscription. Cancel that in Google Play first, so you are not charged again. See our Refund & Cancellation Policy for the steps.

16. Age requirement

To use BUBU you must be able to form a binding contract under Indian law (see section 2 of our Terms of Use). We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

If you are a parent and find your child using BUBU, email us and we will remove their account and data.

17. Changes to this policy

We will update this policy when BUBU changes what it collects or how it uses information. The date at the top shows when it last changed. If a change is significant, we will tell you in the app before it takes effect.

If we ever start using your information in a new way, BUBU will tell you before it happens, so you can decide whether to carry on. Small fixes, like typos, just update the date at the top.

18. Contact and complaints

For questions, requests to use your rights, or complaints, contact our Grievance Officer:

Amthuz Zafrin, Grievance Officer, BUBU
Email: amthuzzafrin@gmail.com

We aim to respond within 30 days.

The "Grievance Officer" is simply the person who handles privacy questions and complaints. For BUBU, that is the developer herself, and you email her directly. Please write from the email address on your BUBU account, so we can confirm it is really you.

19. Words used on this page

AI model provider: The company whose artificial-intelligence system writes BUBU's replies. It receives the text needed to do that, and nothing more.
Data fiduciary: The legal term, under India's data protection law, for whoever decides how your personal data is used, and is responsible for protecting it. For BUBU, that is Amthuz Zafrin.
Consent: Your permission for us to use your information for the purposes in this policy. You give it by signing up, and you can take it back at any time.
Service provider: A company that does a specific job for BUBU, such as storing data or writing replies, and may only use your data to do that job.
Encryption: Scrambling data so that only the intended systems can read it. To anyone else it looks like random characters.
Grievance Officer: The person named to answer privacy questions and complaints. The law requires every service like BUBU to have one.
Data Protection Board of India: The government body that enforces India's data protection law. You can complain to it if we do not resolve your complaint.