1. Controller and scope
This policy covers tebblo.com and the Tebblo application. Tebblo Ltd is a company being formed in Malta: the legal identity and full contact details of the current data controller still need to be provided. This notice is provisional and is not a claim of completed legal compliance.
For a data request, use support@tebblo.com or Support in settings. Never send passwords, private keys or recovery codes.
2. Opening announcement signup
The form stores the email address provided, selected language, signup date and associated information version. Its purpose is the opening announcement you requested, based on your consent; it does not include a promotional newsletter.
Your email is not verified through a confirmation email and no email is sent at signup. You can request removal from the list at support@tebblo.com. Delivery of the opening announcement still needs to be arranged.
The website receives technical connection information. The infrastructure derives a country from the IP address to choose an initial language, without requesting GPS location. Abuse prevention uses an IP-derived identifier for a fifteen-minute window, without storing the plain IP in the waiting list.
3. Data used in the application
Depending on the features you use, Tebblo processes:
- Account and security information: identifiers, recovery details provided, authentication verifiers, public keys, sessions, IP address, device or browser type and connection dates.
- Profiles and identities: handles, avatars, banners, descriptions, preferences and optional information you choose to provide.
- Interactions: communities, memberships, contacts, blocks, messages, media, reactions, stories, reports and support requests.
- Subscription features: allocation of benefits, gifts and operations recorded in the application. A demonstration screen does not mean that a real payment occurred.
- On your device: settings, drafts, outgoing queues, caches, keys and information needed to reconnect and read history.
4. Purposes and legal grounds
Account operation, requested communications and features are based on providing the service. Account protection, abuse prevention and incident handling serve legitimate security and operational interests, subject to your rights.
Optional uses requiring consent must involve a specific choice, such as signing up for the opening announcement. Compliance with a legal obligation is a separate ground where such an obligation applies. These grounds must be attributed to the identified operator when this notice is finalised.
Camera, microphone and notification permissions support the feature you choose to use. They are not permission for advertising tracking.
5. Encryption and multiple identities
One-to-one private messages use end-to-end encryption: sending is blocked when the required key is unavailable. Do not assume this protection applies to community messages or every group feature. Operational information, such as participants, dates and sessions, is not all concealed by encryption.
Multiple identities let you separate your activities from other members' perspective. They remain linked to your account within the service; this is not a promise of anonymity towards the operator.
No protection guarantees confidentiality on a compromised device or against a recipient who records content. Protect your keys and consult the application's security information.
6. Recipients and external services
Your recipients and authorised members of a space can access content intended for them. Community administrators have access according to their permissions. Support and authorised personnel may process information needed for a request or service security.
The waiting page uses Sites and Cloudflare infrastructure. Application hosting is separate. The full legal list of providers, their contact details, processing countries and safeguards for any transfers outside the European Economic Area still need to be added. The planned establishment in Malta does not mean that all data is hosted there.
External previews load only at your request. Opening or playing third-party content may then contact its provider, which applies its own rules. GIFs and integrations may depend on services enabled on the instance. This policy does not authorise data resale or advertising tracking.
7. Retention and deletion
Account information and content maintain your account and conversations while retained in the service. Options include message erasure, expiring content where available and account deletion. Account deletion covers its identities and their data and may delete owned communities; review the confirmations before proceeding.
Support exchanges, security records and documents subject to an applicable legal duty require retention periods appropriate to their purpose. The detailed retention schedule for the waiting list, logs, reports and backups still needs to be confirmed and published. Deletion does not guarantee immediate erasure of every backup copy.
Local caches and preferences persist according to device settings and logout or clearing mechanisms. Deletion from the service cannot remove a copy exported by another user.
8. Your rights
Depending on your circumstances and the legal ground, you can request access, correction, erasure, restriction or portability of your data, or object to certain processing. Consent can be withdrawn for the future without affecting lawful processing already performed.
Write to support@tebblo.com with your request and the relevant account or address. Proportionate verification may be needed to avoid giving your data to another person. Access and portability requests go through support.
You may complain to the competent data protection authority, including the authority in your EU country of residence. In France this is the CNIL; in Malta it is the Information and Data Protection Commissioner (IDPC).