legal

privacy & cookies

Effective: draft for release 3.1 — date set at legal sign-off Controller: Hitaya Kollektiv ApS CVR: 45890899 Contact: support@beboredapp.com

Quick summary (non-binding)

  • bebored is for users 16+, is not medical advice, not therapy, and not for emergencies.
  • You start as a guest with a random identifier and a random pal. Saving an account with an email code is optional and only for restoring on another device.
  • Other people see your pal, its name and, when available, an approximate country flag. Never your email or precise location. Sit unseen keeps you out of rooms.
  • Rooms hold at most three people. You can wave, send a few fixed reactions, and leave one of thirty preset notes. No free-text chat, no feed, no followers. You can sit unseen, block and report.
  • No third-party ads or cross-app tracking in the app. The marketing website may use analytics or marketing cookies with your consent.
  • You can delete your account in the app or ask for help by email. Infrastructure backups and logs follow provider retention settings.
  • The Boredom Pass is a one-time purchase handled by Apple or Google, or in the web app by the payment provider shown at checkout (saved account required). No subscription.
  • For anything else: support@beboredapp.com.

Earlier notices remain available: privacy and terms.

Privacy Policy

1. Who is the controller?

Hitaya Kollektiv ApS is the controller for personal data processed via the bebored apps and web app.

2. Scope

This Privacy Policy applies to the bebored apps for iOS and Android and to the bebored web app at beboredapp.com/app. The marketing pages of our website are covered by the Cookie Policy below. The marketing pages do not create an account or identifier for you.

3. What data we collect

We collect the following categories of personal data:

Guest identifier

Examples: a random identifier created when you first use the app, stored on your device or in your browser

Source: Generated by the app. It is not your name and is not shared with other users.

Account data (optional)

Examples: your email address and the one-time codes used to verify it, if you choose to save your account

Source: Provided by you

Pal and public profile

Examples: your pal’s shape, colour and name; your approximate country, derived from your network (IP) address; sit unseen hides your presence from rooms

Source: Chosen or randomised by you in the app; country inferred from your connection. We never request precise location or GPS.

Presence and sessions

Examples: that you are in the app, which room you are in, whether you are sitting, your chosen goal and length, when sessions start and end, whether your session overlapped with someone else’s, waves and reactions sent and received

Source: Generated during your use of the app

Notes

Examples: the identifier of the preset note you chose to leave, together with your pal, name and time. There is no free text.

Source: Chosen by you in the app

Progress

Examples: sessions completed, minutes, streaks, days with company

Source: Generated during your use of the app

Purchases

Examples: whether your account has the Boredom Pass and a store transaction reference. We never see your card details.

Source: Apple App Store, Google Play, or the web payment provider named at checkout

Safety

Examples: people you have blocked, reports you make and reports made about you

Source: Provided by you or other users

Device & app data

Examples: installation identifier, platform, app version, language, and browser push endpoint if you enable browser reminders; founder devices also register a push token

Source: Your device, browser or app

Diagnostics

Examples: filtered software error stacks, app release and environment. We do not attach your email, pal name, practice history, screenshots, session recordings or performance traces.

Source: App or OS, via crash reporting tools

We do not collect precise location, do not access your contacts, photos or microphone, and do not use third-party advertising SDKs or cross-app tracking in the Service.

4. Who can see what

  • People in your room (at most two at a time) see your pal, its name, whether you are sitting, and, when available, your approximate country as a small flag. They do not see your email, identifier or device.
  • People who come later may see a note you left, shown with your pal, its name and roughly how long ago you left it.
  • People you overlapped with may receive your reactions, and you theirs, for a limited time after a session.
  • Sit unseen hides you from rooms. You still see notes. Your sessions still count for you.
  • The founder of bebored may be notified that someone is practising alone and may open the app to join. He then appears as an ordinary participant and sees exactly what any other person in your room sees.

We do not invent live participants. If someone locks their phone or loses connection during a session, their seat can remain until the session’s expected end; seated presence is not proof of a continuous network connection.

Provide and operate the Service

  • Creating your guest identity and, optionally, your saved account
  • Running sessions, rooms, waves, reactions and notes; recording who shared a session
  • Syncing your pal, settings and progress; managing your Boredom Pass

Legal basis: Contract (Art. 6(1)(b) GDPR).

Approximate country

  • Deriving a country from your IP address to show a small flag beside your pal’s name

Legal basis: Legitimate interests (Art. 6(1)(f)) in a light sense of place in rooms; you can sit unseen in settings to stay out of rooms and contact us about other objections.

Safety and abuse prevention

  • Validating names, rate-limiting reactions, handling blocks and reports, protecting accounts and the Service

Legal basis: Legitimate interests (Art. 6(1)(f)).

Operational monitoring & product improvement

  • Checking aggregate room occupancy, arrival rates and service health to maintain the Service

Legal basis: Legitimate interests (Art. 6(1)(f)); analytics is not used for third-party ads or cross-app tracking.

Crash reporting & diagnostics

Legal basis: Legitimate interests (Art. 6(1)(f)) in stability and security.

Notifications & communications

  • Requested account codes and optional reminders, subject to your notification choices — Legal basis: Contract and legitimate interests (Art. 6(1)(b) and (f)); consent where applicable.

Legal compliance

Legal basis: Legal obligation (Art. 6(1)(c)).

Where we rely on legitimate interests, we balance our interests against your rights and expectations. You can object to processing based on our legitimate interests (see “Your rights”).

6. Service providers & international transfers

We use providers to process data on our behalf. By category:

  • App distribution and in-app purchases: Apple Inc. and Google LLC. Apple and Google act as independent controllers for their store accounts and payments.
  • Hosting, database and real-time infrastructure for accounts, rooms, notes, progress and audio delivery: Supabase and Vercel. Native apps request public recordings from Vercel Blob over HTTPS without sending an account identifier, email or sign-in token. The provider receives normal network information, including your IP address and the requested file path, to deliver the recording and operate the service. Downloaded recordings are cached on your device and may be removed automatically to manage storage.
  • Purchase verification: RevenueCat for native purchases; Stripe for web checkout. We do not receive full payment card details.
  • Push delivery: Expo and platform push services for founder alerts; your browser’s push service for opted-in web reminders. Native practice reminders are scheduled on the device.
  • Filtered error reporting: Sentry. Native crash collection, session replay and performance tracing are disabled in this release.
  • Email delivery for one-time account codes.

We aim to store personal data in the EU. Where data is transferred internationally (for example to the US for provider operations), we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) or equivalent mechanisms where required by law. Current provider names are available on request at support@beboredapp.com.

7. Data retention

We keep data only as long as necessary for the purposes above:

Guest identity, account, pal, progress, Pass status

Retention: Kept while your account is active; deleted upon account deletion (subject to the backup period below).

Presence and room data

Retention: Current presence expires when it is no longer needed. Terminal social session records and closed room records are cleaned after 90 days; your personal practice history is separate.

Reactions

Retention: Delivered after the recipient finishes or on their next visit, and expire after 24 hours if undelivered.

Notes

Retention: Eligible for delivery for seven days; stored notes are cleaned after 30 days. There is no permanent note-history inbox.

Blocks and reports

Retention: Kept while needed to enforce the block and to handle the report.

Filtered error reports

Retention: Kept according to the error-reporting provider’s configured retention. The exact launch setting must be confirmed before this draft is published.

Backups & system logs

Retention: Subject to each infrastructure provider’s backup and log retention. The exact launch settings must be confirmed before this draft is published; deleting app data does not instantly remove every backup copy.

If we need to keep specific data longer (for example to comply with legal obligations or to resolve disputes), we will keep it only for that limited purpose.

8. Account deletion & data export

You can delete your account and data at any time from the app’s settings, or by emailing support@beboredapp.com from the email you used to save your account (for guests, from the device in question). When you delete:

  • Your guest identity or account, pal, settings, progress, Pass record, blocks and reactions are removed from our production systems.
  • Notes you left are removed or detached from your pal and name.
  • Backup copies and infrastructure logs expire according to the applicable provider retention settings.

Purchase records held by Apple, Google or the web payment provider are governed by their policies.

Data export: Use “export my data” in Settings to download your available account, pal and practice data, or request assistance by emailing support@beboredapp.com. We will respond in line with applicable law.

9. Your rights (EEA/UK)

Subject to conditions and limitations under GDPR, you have the right to:

  • Access your personal data;
  • Rectify inaccurate data;
  • Erase data (“right to be forgotten”);
  • Restrict processing;
  • Data portability (for data you provided to us); and
  • Object to certain processing based on legitimate interests (including the country flag, some analytics and communications).

You also have the right to lodge a complaint with your local supervisory authority. In Denmark, this is Datatilsynet.

To exercise your rights, contact support@beboredapp.com. We may need to verify your identity.

10. Children’s privacy

bebored is not for children under 16. If you believe a minor under 16 is using the Service, contact us and we will take appropriate steps to delete the account and associated data.

11. Security

We use administrative, technical, and organizational measures appropriate to the risk, including:

  • Encrypted transport (HTTPS) and access rules so that users only read what they are allowed to see;
  • One-time codes for account access, no passwords to leak;
  • Access controls and least-privilege practices;
  • Limiting access to personal data to a small internal team that needs it for their job, under confidentiality obligations.

No method is 100% secure, but we work to protect your data in line with industry practices.

12. No advertising & tracking in the Service

We do not serve third-party ads or use third-party advertising SDKs in the apps or the web app, and we do not engage in cross-app tracking.

Our marketing website may use analytics or marketing cookies with your consent; see the Cookie Policy below.

13. Changes to this Privacy Policy

We may update this Policy as we evolve the Service. We will notify you of material changes where required (e.g., in-app notice or website banner). This notice explains our processing; it is not consent to unrelated processing.

14. Contact

For privacy questions or requests: support@beboredapp.com

Cookie Policy (website)

This Cookie Policy explains how we use cookies and similar storage on our website beboredapp.com (the “Website”), including the web app at beboredapp.com/app. For what the app itself collects, see the Privacy Policy.

1. What are cookies?

Cookies are small text files placed on your device to make the site work, keep it secure, and help us understand how it’s used. Similar technologies (like local storage or pixels) may be used for the same purposes.

2. How we use cookies and storage

We aim to be minimal and privacy-friendly.

Strictly necessary

  • The marketing pages remember, for the current browser session only, whether you are on a phone or a desktop, so we can send phones to the web app. Nothing is sent to us.
  • The web app at beboredapp.com/app stores your guest identifier, pal and settings in your browser’s local storage so that you stay you between visits. Clearing site data removes them.
  • Remembering your cookie choices, if a banner is shown.

Analytics cookies (optional)

  • Used to understand visits and improve the Website (e.g., page views, navigation patterns).
  • If used, these will run only with your consent (via a banner) and will not be used to build cross-site advertising profiles.

Marketing / performance cookies (optional)

  • Used to measure the performance of our marketing campaigns (for example, pixels from platforms like Meta or TikTok).
  • These will only run with your consent via the banner and can be turned off at any time.

At the time of writing, no analytics or marketing cookies are set on the Website.

3. Your choices

If we introduce optional cookies, you will see a banner on your first visit where you can accept or reject analytics and marketing cookies, and change your choice later. Blocking strictly necessary storage may stop the web app from remembering you between visits.

4. Cookies and storage we use

  • Necessary: session storage for the phone/desktop choice (deleted when you close the tab); local storage in the web app for your guest identity and settings (kept until you clear site data or delete your account).
  • Analytics (if enabled): a first-party analytics cookie with a randomized identifier (e.g., ~6–12 months expiry).
  • Marketing (if enabled): third-party cookies or pixels from advertising platforms with lifetimes as described in their respective policies.

We will keep this section updated with exact names and lifetimes if analytics or marketing tools are enabled.

5. Updates

We may update this Cookie Policy from time to time, for example if we change analytics or marketing providers. Material changes will be communicated via the banner or on this page.

6. Contact

Questions about cookies: support@beboredapp.com