Privacy information for CUBLEY

As of: October 8, 2026

Data controller

My Cubley – Elke Nalbach, sole proprietorship
Schletterstrasse 64
66809 Nalbach, Germany
Email: kontakt@mycubley.com

What data we process

• Account and sign-in: Name, email address, Firebase user ID, sign-in details, and confirmation that you are at least 16 years old. Firebase Authentication processes, in particular, your email address, IP address, and technical information for sign-in and security. We do not store a password in your CUBLEY profile.
• Profile and trip posts: Profile and post texts entered by you, places and coordinates entered by you, and photos that you select and upload. Map views may show posts and places to other CUBLEY users according to their visibility settings.
• Chat and translation: Chat messages, public nicknames, technical conversation identifiers, and translations of chat messages or travel stories requested by you. For a translation, the text selected by you is transmitted to OpenAI, and the result is displayed or saved in the app.
• Reports and security: Information about reported posts or users, the reason for the report, technical identifiers, and blocked users. This information is used to process security reports and enforce the Community Rules.
• Orders and payments: For a CUBLEY merchandise order: name, email address, delivery address, product/order details, and payment and delivery status. For digital Android memberships, Google Play processes the purchase. CUBLEY processes the purchase receipt or purchase token, subscription status, and assignment to the CUBLEY account. CUBLEY does not process complete card details; payment data is processed by the respective payment provider.
• Technical operational data: IP address, device and app version, Firebase installation ID, App Check/Play Integrity information, Maps SDK ID, and error and function data, insofar as they arise for sign-in, map display, protection against misuse, and operation of the services.

Location, maps, and photos

CUBLEY does not request GPS or device location in the current Android code. You can enter place names and coordinates yourself in trip posts. This information is stored and may be transmitted to Google Maps for map display; visibility depends on the respective post. Photos are processed only when you select and upload them. Do not publish private residential addresses or other people’s personal data.

Services, recipients, and storage locations

• Google Firebase/Google Cloud: Firebase Authentication for sign-ins, Cloud Firestore for app data, Cloud Functions for server functions, and Cloud Storage for images. For this project, the console shows the Firestore location eur3 (Europe, multi-region), Storage bucket us-central1 (USA) and Cloud Functions europe-west1. Firebase Authentication processes data in the USA, as stated by Google.
• Google Maps Platform: Map display. According to Google, the Maps SDK transmits, among other things, the IP address, device/SDK metadata, crash metrics, and a pseudonymous Maps SDK identifier; depending on map usage, it may also transmit map interactions.
• Google Play: Purchase, billing, subscription management, and cancellation of the digital Android subscription.
• OpenAI: Processing of chat text when you request a translation. CUBLEY disables additional storage of the API response for later retrieval. This does not mean complete zero retention: OpenAI may generally retain content and technical information for abuse prevention for up to 30 days, and longer in justified exceptional cases. Technically necessary interim storage may also take place. Further information is available in the OpenAI Data Controls.
• Stripe: Payment processing for designated CUBLEY merchandise and checkout transactions.
• Cloudflare and Firebase Hosting: Provision and technical delivery of the My-Cubley website. Connection data such as the IP address and time of access may be processed for this purpose.
• IONOS: Provision of the contact email inbox.

Data may be processed in or transferred to the USA when using Firebase services and the translation function. Google describes the applicable data processing terms and transfer mechanisms in the Firebase Privacy Notice and in the Google Cloud Data Processing Addendum. For OpenAI, depending on the agreement governing access to the API, the OpenAI Data Processing Addendum and the adequacy decisions or standard contractual clauses described therein apply. Further information about the providers and their sub-processors can be found in the respective linked provider information.

Purposes and Legal Bases

• We provide accounts, posts, chat, maps, translations, orders, and memberships to perform the user relationship (Art. 6 para. 1 lit. b GDPR).
• We store invoices and required accounting records to fulfill legal obligations (Art. 6 para. 1 lit. c GDPR).
• We process security logs, reports, abuse prevention measures, and complaints on the basis of our legitimate interest in providing a secure service and protecting users (Art. 6 para. 1 lit. f GDPR).
• We obtain separate consent where it is legally required for a specific optional function. You can withdraw it at any time with effect for the future.

Storage Period and Deletion

Account and profile data, as well as associated posts, images, and messages, are removed after successful account deletion; any identified ongoing memberships are canceled. You can delete your account in the app or via the web deletion process Order and delivery data are retained for 90 days from confirmed delivery; for canceled, unpaid orders, the period begins upon cancellation. After the period expires, the delivery address, contact and account association, and other operational order data are removed. In a specific open contractual case, the responsible person may postpone deletion by no more than 90 days at a time, with a documented reason, and reviews the need again. A separate, minimized payment/accounting record remains for 10 years from the end of the calendar year in which it was created. Other contractual records are limited to the data required in each case and are stored only for as long as they are needed for the contract, its processing, or a specific claim. Required accounting records are not automatically removed with the user account when the account is deleted.

Security and moderation reports are reviewed by the responsible account holder and deleted 180 days after documented completion; for reports that are still open, the period begins only after they have been processed. An optional analysis of travel habits is not currently set up as active processing. If it is introduced, the data is intended to be pseudonymized only after separate voluntary consent and stored for no more than 30 days. Pseudonymized data may still be personal data as long as attribution remains possible.

The cleanup of expired order, accounting, and moderation data runs daily. The app does not generate a formal invoice; invoices created outside the app are retained in the accounting system used for this purpose.

Technical logs are processed in accordance with the storage and deletion periods of the respective providers. For Authentication, Firebase states that IP addresses and User-Agent information are security data; according to Google, Cloud Functions stores IP addresses only temporarily for service operation.

Your Data Protection Rights

Subject to the statutory requirements, you may request access, rectification, erasure, restriction of processing, and data portability, and object to processing based on legitimate interests. You may withdraw consent you have given at any time with effect for the future. To do so, contact kontakt@mycubley.com.

You also have the right to lodge a complaint with the competent data protection supervisory authority: Independent Data Protection Centre Saarland – State Commissioner for Data Protection and Freedom of Information.

Age Limit

CUBLEY is intended for people aged 16 and over. During registration, users confirm that they are at least 16 years old. We do not collect a date of birth in the current process.