Privacy Policy
The short version
- You use Burvli under a codename. The only personal identifier we ask for is an email address, so you can recover your account. Nobody you talk to ever sees it.
- We store what you need for the app to work: your account, the chats you take part in, your journal and your safety reports. Journal entries and chat messages are encrypted in our database.
- We don't sell your data, show ads, use analytics or tracking tools, or collect your location, contacts, photos or real name.
- Your safety plan never leaves your phone.
- You can download all your data or permanently delete your account at any time from the app's Settings.
This Privacy Policy explains how the Burvli team (“Burvli”, “we”, “us”) collects, uses, shares and protects information when you use the Burvli mobile app and its related services (the “Service”). Burvli is an anonymous peer-support app: you can talk with other people under a codename, keep a private journal, and use calming exercises and support resources.
Because people often use Burvli during difficult moments, we try to collect as little as possible and to explain plainly what happens to it. Please read this policy together with our Terms and Conditions.
Contents
- Information we collect
- Information stored only on your device
- Information we do not collect
- How we use your information
- Legal bases for processing
- Sensitive information
- What other users can see
- Who we share information with
- Push notifications
- How long we keep information
- How we protect your information
- Your rights and choices
- Children and age requirements
- International data transfers
- Changes to this policy
- Contact us
1.Information we collect
We collect information when you create an account and use the Service. The table below lists everything our servers store about you.
1.1 Account information
| Information | Details | Why we collect it |
|---|---|---|
| Email address | Required to create an account. It is never shown to other users. | To sign you in, let you recover your account on a new device, and contact you about your account or important changes. |
| Password | Stored only as a one-way bcrypt hash. We never store or see your actual password. | To authenticate you and protect your account. |
| Codename (alias) and avatar colour | The anonymous name and colour shown to people you chat with. | To give you an identity in chats without revealing who you are. |
| Kindness (reputation) score | A score linked to your account (it starts at 100) that other users can see in the lobby. We may adjust it based on safety reviews. | To encourage respectful conversations and help people choose who to talk to. |
| Account status and dates | When your account was created, and whether it has been restricted for breaking our rules. | To run the Service and enforce our Terms and Conditions. |
1.2 Chats
| Information | Details | Why we collect it |
|---|---|---|
| Messages you send | The text of each message, the chat it belongs to and when it was sent. Message text is encrypted in our database (AES-256-GCM). | To deliver your messages, let you see a chat's history, and investigate reports of harmful behaviour. |
| Chat session records | Which two accounts took part in a chat, when it started and ended, and who ended it. | To connect you with your chat partner, show your chat history and support safety reviews. |
1.3 Finding someone to talk to (matchmaking)
| Information | Details | Why we collect it |
|---|---|---|
| Interests | Topics you choose to talk about, such as “Anxiety”, “Loneliness” or “Just venting”. | To match you with people who want to talk about similar things. |
| Lobby activity | Whether you are looking for a random match or browsing, when you joined the lobby and when you were last active there. | To show you only people who are available right now and to pair you with someone. |
| Match requests | Requests you send or receive, and whether they were accepted, declined, cancelled or expired. | To let people choose who they talk to. Requests are deleted automatically after 24 hours. |
1.4 Journal
| Information | Details | Why we collect it |
|---|---|---|
| Journal entries | What you write, the mood you choose (rough, low, okay, good or great) and when you wrote it. Entry text is encrypted in our database (AES-256-GCM). | To save your private journal so it is available on any device you sign in to. Only you can read your entries in the app. |
1.5 Safety and moderation
| Information | Details | Why we collect it |
|---|---|---|
| Reports you file | Who you reported, in which chat, the reason you chose (for example harassment or spam) and its review status. | To investigate harmful behaviour and keep the community safe. |
| Reports about you | If someone reports you, we keep that report. We never tell you who filed it. | To review possible breaches of our Terms and Conditions. |
| Blocked users | The list of accounts you have blocked. | So you are never matched with them again. |
1.6 Device and technical information
| Information | Details | Why we collect it |
|---|---|---|
| Push notification token | A token from Google Firebase Cloud Messaging that lets us send notifications to your device. We collect it only if push notifications are turned on. | To tell you about new messages and when a chat ends. See section 9. |
| Sign-in token | A secure token that keeps you signed in. It is stored in encrypted storage on your device. | To keep your session secure without asking for your password every time. |
| Server and connection logs | Our servers and hosting provider may automatically record technical details such as IP address, request times and errors. We do not log the content of your messages or journal. | To keep the Service running, fix problems and protect against abuse and attacks. |
2.Information stored only on your device
Some information is kept in the app's private storage on your phone and is never sent to our servers:
- Your safety plan: your warning signs, coping steps, trusted contacts and reasons to keep going. It is stored in your device's encrypted storage.
- App preferences: theme, notification setting, disappearing-chat timer and interest-matching options.
- A local copy of your recent chats, so they load quickly.
- Your email address and codename, so the app can show them while you are signed in.
If you delete the app or sign out, this on-device information may be removed. Because we never receive your safety plan, we cannot recover it for you.
3.Information we do not collect
- Your real name, phone number, date of birth, address or photos
- Your precise or approximate location
- Your contacts, camera, microphone or files
- Advertising identifiers or cross-app tracking data
- Analytics, crash-reporting or advertising SDK data. Burvli has no third-party analytics or ads.
- Payment information. Burvli is currently free.
Please don't share identifying details such as your full name, address, school or workplace in chats. Keeping Burvli anonymous protects you and the people you talk to.
4.How we use your information
- To provide the Service: create and secure your account, match you with others, deliver messages, store your journal and show your chat history.
- To keep people safe: review reports, enforce our Terms and Conditions, maintain kindness scores, prevent spam and bots, and restrict accounts that cause harm.
- To send notifications you have allowed, about new messages, match requests and ended chats.
- To protect the Service: detect and prevent fraud, abuse, security incidents and technical problems.
- To communicate with you about your account, security, or important changes to the Service or these policies.
- To meet legal obligations and respond to lawful requests.
We do not sell or rent your information, use it for advertising, build marketing profiles, or use your journal or chats to train artificial-intelligence models.
5.Legal bases for processing
Where data-protection laws such as Canada's PIPEDA, the EU and UK GDPR, or similar laws apply, we rely on these bases:
- Contract: to provide the Service you signed up for (account, chats, journal, matching).
- Consent: for push notifications and for the sensitive information you choose to share (see section 6). You can withdraw consent at any time.
- Legitimate interests: to keep the community safe, prevent abuse and secure our systems, in ways that don't override your rights.
- Legal obligation: where the law requires us to keep or disclose information.
6.Sensitive information
What you write in chats and in your journal may reveal information about your mental or physical health, relationships, beliefs or other sensitive matters. You choose what to share. By writing it in Burvli, you consent to us storing and processing it only to provide the Service as described in this policy. We protect this information with encryption and strict access limits. You can delete your journal entries at any time, and you can delete all your data by deleting your account.
7.What other users can see
- In the lobby: your codename, avatar colour, kindness score and chosen interests, while you are looking for someone to talk to.
- In a chat: your codename, avatar colour and the messages you send.
- Other users never see your email address, your journal, your safety plan, who you have blocked or reports you have filed.
Once you send a message, the person you are chatting with has received it, and they could copy or screenshot it. Please share with care.
8.Who we share information with
We share information only in these situations:
- Service providers who process data for us under contracts that require them to protect it and use it only for our instructions:
- MongoDB Atlas (MongoDB, Inc.): database hosting
- Our cloud hosting provider: server hosting
- Google Firebase Cloud Messaging (Google LLC) and Apple Push Notification service: delivering push notifications
- Legal and safety reasons: if we believe in good faith that disclosure is required by law, court order or government request, or is necessary to prevent imminent harm to someone's life or safety. Because Burvli doesn't collect names or locations, the information we hold is limited.
- Business transfers: if Burvli is involved in a merger, acquisition or sale of assets, your information may be transferred, and it would remain covered by the commitments in this policy.
- With your direction: for example, when you export your data and choose to share the file.
Links to helplines and other resources in the app open outside Burvli. We don't send them any of your information, but their own privacy policies apply once you contact them.
9.Push notifications
If you turn on push notifications, we send your device's notification token to our servers and use Google Firebase Cloud Messaging (and, on iPhone, Apple's notification service) to deliver notifications.
10.How long we keep information
| Information | How long we keep it |
|---|---|
| Account information | Until you delete your account. |
| Messages you send | On our servers until you delete your account. The in-app “disappearing chats” timer hides past chats in the app, but it does not delete them from our servers. |
| Journal entries | Until you delete the entry or your account. |
| Match requests | Deleted automatically after 24 hours. |
| Lobby activity | Until you delete your account. |
| Reports you filed | Until you delete your account. |
| Reports about you | Kept after your account is deleted, for safety and legal purposes, but no longer linked to any account. |
| Chat session records | Kept as part of the other person's chat history, but no longer linked to your account once you delete it. |
| Backups and logs | Removed from backups and logs within 30 days of deletion. |
When you delete your account, we permanently delete your account, your journal, every message you sent, your match requests, your lobby activity and the reports you filed, and we remove you from other people's block lists. Any active chat is ended and the other person is told that you left. This cannot be undone.
11.How we protect your information
- Journal entries and chat messages are encrypted at rest with AES-256-GCM before they are stored, so a copy of our database alone does not reveal their content.
- Passwords are stored only as salted bcrypt hashes.
- Data travels between the app and our servers over encrypted HTTPS/TLS connections.
- Sign-in tokens and your safety plan are kept in your device's secure, encrypted storage.
- Access to production systems is limited to authorised people who need it.
No method of storage or transmission is completely secure. If a data breach affects your information, we will notify you and the relevant authorities as the law requires.
12.Your rights and choices
Depending on where you live, you may have the right to access, correct, download, restrict or delete your personal information, to object to certain processing, and to withdraw consent. Burvli makes the main ones available in the app:
- Download your data: Settings → Download my data gives you a copy of everything we store about you: account details, journal, the messages you sent, chat records, match requests, lobby activity and reports you filed.
- Delete your account: Settings → Delete account permanently erases your data as described in section 10.
- Delete journal entries individually at any time.
- Turn notifications off in Settings or in your phone's settings.
- Block users so you are never matched with them again.
For any other request, or if you can no longer sign in, contact us at hellowhispa@gmail.com. We will respond within 30 days, or tell you within that time if we need up to 30 more days. We may need to verify that the account is yours. You may also complain to your data-protection authority. In Canada, that is the Office of the Privacy Commissioner of Canada (priv.gc.ca). In the EU or UK, it is your local supervisory authority.
13.Children and age requirements
Burvli is not intended for children. You must be at least 18 years old to use the Service, or older if your country requires it. We do not knowingly collect information from anyone under that age. If we learn that we have, we will delete the account. If you believe a child is using Burvli, contact us at hellowhispa@gmail.com.
If you are young and need someone to talk to right now, Kids Help Phone is free and available 24/7 in Canada: call 1-800-668-6868 or text CONNECT to 686868.
14.International data transfers
Our servers and service providers are located in Canada and/or the United States. If you use Burvli from another country, your information will be transferred to and processed there. Where required, we use appropriate safeguards, such as standard contractual clauses, to protect information transferred across borders.
15.Changes to this policy
We may update this policy as Burvli changes or the law requires. If we make significant changes, we will tell you in the app or by email before they take effect, and update the “Last updated” date above. If you keep using Burvli after changes take effect, you accept the updated policy.
16.Contact us
Questions or requests about your privacy:
- Email: hellowhispa@gmail.com