BubbleJournal

Privacy policy

Last updated: October 4, 2026

BubbleJournal keeps your dive history. This page explains what we collect, why, who helps us run the service, and what you can do about it. In short: your data is used to run BubbleJournal for you, never sold, never used for ads, and you can delete it at any time.

Who we are

BubbleJournal is run by Dmitry Shalimov, Pennsylvania, USA. Questions, requests or complaints: hello@bubblejournal.com.

What we collect

  • Your account: your name and email address. If you sign in with a password, we store only a salted, slow hash of it, never the password itself. If you sign in with Google, we receive your name, email address, whether Google has verified it, your Google account ID and the address of your Google profile photo. If you sign in with Apple, we receive your name (the first time only), your email address (or the private relay address Apple gives you if you hide it), whether Apple has verified it and your Apple ID for BubbleJournal.
  • Your picture: a photo you upload (shrunk to 256 × 256 pixels in your browser, which also removes hidden camera data such as location), or the avatar you pick.
  • Your dives: the dive files you upload, kept exactly as uploaded, and what we read from them: times, depths, temperatures, gas, positions, and the notes and corrections you add. Positions show where you dived.
  • Sign-in codes: when we email you a code, we keep only a hash of it, for up to an hour.
  • Technical records: our servers log requests (including your IP address and browser type) to keep the service secure and working. Logs are kept for up to 30 days.

Cookies: one cookie keeps you signed in. It is needed for the service to work. We use no advertising, analytics or tracking cookies, and no third-party trackers.

Why we use it

  • To run your account and show you your dives (needed to provide the service you signed up for).
  • To keep accounts safe: checking passwords, limiting repeated attempts, sending sign-in codes (our legitimate interest in security).
  • To send you emails about your account, such as sign-in codes. We send no marketing email unless you ask for it.

If BubbleJournal later offers features such as anonymous community statistics, they will be opt-in, and we will ask before using your data for them.

Who helps us run BubbleJournal

These companies process data on our behalf, only to provide the service:

  • Microsoft Azure hosts the application, the database and stored files, in the United States.
  • Resend sends our emails (your email address and the message).
  • Google, only if you choose to sign in with Google. Your browser also loads your Google profile photo straight from Google.
  • Apple, only if you choose to sign in with Apple.
  • Have I Been Pwned: when you choose a password, we send the first five characters of its SHA-1 hash to check it against known data breaches. Neither your password nor your email address leaves our servers.
  • OpenDiveMap, Photon (an OpenStreetMap search run by Komoot) and GeoNames: when you search for a dive site to add, our server looks it up there using only the words you typed. Nothing about you or your account is sent.
  • Photos and videos you link to stay where they are: your browser loads them, and the YouTube or Vimeo player, straight from where they are hosted. For a Google Photos share link, our server opens the shared page once to find its preview picture, so Google sees a request from BubbleJournal rather than from you.

We do not sell or rent your personal data, and we do not share it for advertising.

Where your data is stored

In Microsoft Azure data centers in the United States. If you live elsewhere, your data is transferred to and stored in the United States.

How long we keep it

  • Your account, picture and dives: until you delete your account.
  • Unfinished sign-ups and sign-in codes: deleted within hours.
  • Signed-in sessions: end after 30 days without use, or when you sign out.
  • Server logs: up to 30 days.
  • Database backups: copies of deleted data disappear from backups within 7 days.

Your choices and rights

  • Delete: delete your account and everything in it yourself, under Your account. It happens immediately.
  • See and correct: your account details are on Your account. Ask us for anything else we hold about you.
  • Take your data with you: download all your dives, dive sites, trips and links, with every file you imported, under Your account.
  • Object or complain: write to us. If you live in the EU, UK or another place with data protection law, you may also complain to your local data protection authority.

We give everyone these rights, wherever they live, and answer requests within 30 days. California residents: we do not sell or share personal information as those terms are defined in California law.

Security

All connections use HTTPS. Passwords, session tokens and codes are stored only as hashes. The database accepts no password logins. Repeated wrong passwords lock sign-in for a while.

Children

BubbleJournal is for people aged 16 and over. We do not knowingly collect data from anyone younger; if we learn of it, we delete the account.

Changes

If we change this policy, we update the date at the top. For important changes, we email you before they take effect.