Privacy policy

1. Data controller

The data controller is the publisher of Bushiline (full legal information to be published on this page). For any question about your data: support@bushiline.com.

2. The data we process

We only collect what Bushiline needs to work:

• Account: email address, password (stored only as an irreversible hash), Apple identifier if you use “Sign in with Apple”, passkeys, two-factor settings, language, versions of the terms you accepted.
• Profile: name, @handle, photo, bio, job, country and city, and any information you choose to add.
• Content: posts, comments, listings, messages, photos, videos and voice notes. Photos are re-encoded by our servers, which removes their metadata, including GPS coordinates.
• Connections: follows, blocks, likes, saves, message requests.
• Globe (only if you turn it on): an approximate location at the precision you chose, and the matching place name. Your exact location is never stored.
• Technical data: signed-in devices (model, last activity), sessions, IP address and approximate city of sign-ins, notification tokens, security logs.
• Your exchanges with us: reports, appeals, messages to support.

3. Why, and on what legal basis

• Providing the service (account, profile, posts, Marketplace, messaging): performance of our contract, i.e. the terms of use.
• Showing your location on the Globe and sending you notifications: your consent, which you can withdraw at any time in the app or your phone's settings.
• Protecting members and the service (fighting fraud, bots and abuse, account security, moderation): our legitimate interest.
• Complying with our legal obligations (retention of connection data, responding to authorities, handling illegal content).

4. What others can see

Your profile, posts and listings are public in the app and can be viewed through a share link on bushiline.com. Your email address is never shown to other members. Your messages are only visible to the people in the conversation. Your location only appears on the Globe if you turned it on, to the people you chose and at the precision you chose.

We do not sell your data and do not show targeted advertising.

5. Our processors

We use service providers that process some data on our behalf, on our instructions and under contract:

• Cloudflare: hosting of the app and website, database, media storage, sending emails, protection against attacks.
• Apple: “Sign in with Apple” and notifications on iPhone.
• Google and Expo: delivery of notifications on Android and iPhone.
• Mapbox: displaying the Globe map and turning an approximate location into a place name (country, city, neighbourhood).

6. Transfers outside the European Union

Some of these providers may process data outside the European Union, in particular in the United States. These transfers are covered by safeguards recognised by the GDPR: an adequacy decision (Data Privacy Framework) or the European Commission's standard contractual clauses.

7. Retention periods

• Account, profile and content: as long as your account is active. Content you delete is removed immediately.
• After an account deletion request: 30 days of deactivation (so you can change your mind), then permanent erasure.
• Globe location: replaced at each update, no longer shown after 30 days without an update and erased after 90 days; erased immediately if you turn off sharing or delete your account.
• Codes sent by email: 15 minutes. Media uploaded but never published: 24 hours.
• Connection data (IP address, date and time): 1 year, as required by law.
• Reports, moderation decisions and appeals: as long as needed to handle them, then at most 1 year after the account concerned is closed, to prevent repeat abuse and respond to authorities.
• Security backups: encrypted, deleted on rotation no later than 90 days after creation.

8. Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, the right to withdraw your consent at any time, and the right to set instructions for what happens to your data after your death.

Most of these rights can be exercised directly in the app: edit your profile, export your data (archive sent by email), turn off the Globe or notifications, delete your account. You can also delete your account at bushiline.com/supprimer-mon-compte, or write to us at support@bushiline.com; we reply within one month.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority, or with the authority of your country.

9. Security

Exchanges are encrypted (HTTPS). Passwords are protected by strong hashing and never stored in plain text. You can turn on passkeys and two-factor authentication. Chat media is stored in a private space, readable only by the people in the conversation. Our team's access to data is limited to what is necessary and logged.

10. Minors

Bushiline is for people aged 15 and over. If you think a younger child is using Bushiline, write to us: we will delete their account.

11. Cookies

The bushiline.com website uses no analytics and no advertising. It only sets two strictly necessary cookies: one remembers the language you chose, the other protects the account deletion form. The app uses no advertising trackers.

12. Changes

We may update this policy. For important changes, we will tell you in the app. Each version is dated and numbered.