Ulbo Privacy Policy

Last updated: 3 August 2026

Who we are

Ulbo is operated by [LEGAL ENTITY NAME], [ADDRESS]. For privacy questions, contact [privacy@yourdomain].

For the purposes of the UK/EU GDPR, we are the data controller.

What we collect

What you write. Your mood selection, the things you list, the notes you type, and your answer to Ulbo's daily question.

An account identifier. When you first open Ulbo we create an anonymous account so we can apply fair usage limits. It is a random identifier, not linked to your name, email, or device advertising ID.

Your email address or Apple/Google account — only if you choose to sign in. Signing in is optional and exists so your entries survive a new phone. If you sign in with Apple you may use Apple's Hide My Email; we never receive your real address in that case. We do not receive your Apple or Google password.

Nothing else. We do not collect your name, email, contacts, location, photos, or advertising identifiers. We do not use third-party analytics, advertising, or tracking SDKs. We do not track you across other apps or websites.

Where your entries are stored

If you have not signed in: your entries are stored only on your device, in the app's private storage. They are not uploaded anywhere. Deleting the app deletes them.

If you sign in: your entries are also stored on our servers (Supabase, in [REGION]) so they can reach any device you sign in on. Each entry is readable only by your own account, enforced at the database level. We do not read them, and no human at Ulbo reviews them.

You can delete any single day, or your whole account and everything in it, from inside the app at any time. Account deletion is immediate and permanent.

Where your entries are sent

To write your reflections, the text you enter is sent over an encrypted connection to our server, which forwards it to Google's Gemini API and returns the generated reflection to your phone.

• We do not keep a copy of your text after the reflection is returned.
• Google processes it under the Google APIs Terms of Service and the terms applicable to our API tier. **[CONFIRM YOUR GEMINI TIER'S RETENTION AND TRAINING TERMS AND STATE THEM PLAINLY HERE — free-tier API data may be used for product improvement, which you must disclose if it applies to you.]**
• Our server runs on Supabase in [REGION]. Supabase is our data processor.

If you are in the UK, EU, or another region with data transfer rules, note that this means your entries are processed in [REGIONS].

Legal basis (UK/EU GDPR)

What you write in Ulbo can reveal information about your mental health, which is "special category" data under Article 9. We process it only on the basis of your explicit consent, which you give on the welcome screen before anything is sent anywhere.

You can withdraw consent at any time by deleting the app. Withdrawing consent does not affect processing that already happened.

Safety

If something you write suggests you may be at risk of harming yourself, Ulbo shows you crisis helpline information instead of a reflection. This check runs on our server before your text is sent to the AI.

Ulbo is not a medical device, a therapy service, or a crisis service. It does not monitor you, does not alert anyone on your behalf, and no human reviews your entries.

Your rights

Depending on where you live, you have the right to access, correct, delete, or export your data, to object to or restrict processing, and to withdraw consent.

If you have not signed in, your entries live only on your device and we hold no copy — clear them in the app, or delete the app.

If you have signed in, use Settings → Your account → Delete your account. That erases your account, every entry attached to it, and your usage records from our servers immediately, and clears them from the device. You do not need to contact us, though you can at [privacy@yourdomain] if you prefer.

Retention: entries are kept until you delete them or delete your account. We do not keep backups of deleted accounts beyond [BACKUP WINDOW — state your Supabase backup retention, typically 7 days].

You may complain to your local supervisory authority — in the UK, the ICO.

California residents

We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not use your information for cross-context behavioural advertising.

Children

Ulbo is not intended for children under [13 / 16 — pick one and match your store age rating], and we do not knowingly collect their data.

Changes

If we change this policy we will update the date above and show you a notice in the app before the change takes effect.