Your data, plainly explained
HabiBubble helps you find cities that fit your life. Here's exactly what we collect, why, and what we don't.
The short version
- No cookies. No persistent identifiers. No cross-session tracking.
- We collect anonymous usage data to improve the product. Your IP is never stored in full.
- We don't sell your data, run ads, or share analytics with third parties.
What we collect
We use Umami, a self-hosted analytics tool, to understand how people use HabiBubble. For each page view or interaction, Umami records:
Page URL and referrer
Which page you visited and where you came from.
Browser type and OS
General browser family and operating system, not a version fingerprint.
Country
Derived from your truncated IP address. The full IP is never stored.
Daily session hash
A non-reversible hash that groups your page views within a single calendar day. It is discarded after 24 hours and cannot link visits across days.
That's it. No email address, no user ID, no cookies, no localStorage, no fingerprint that survives beyond one day.
Legal basis
We process analytics data under legitimate interests (Article 6(1)(f) GDPR). Our purpose is first-party product analytics: understanding which features are used, where flows break, and how to prioritise improvements.
We use the minimum data necessary for this purpose. There is no profiling, no ad targeting, and no sharing of analytics data with third parties. A full Legitimate Interests Assessment is on file.
IP anonymization
Your IP address is truncated before any storage: to /24 for IPv4 addresses and /48 for IPv6 addresses. The full IP is never written to disk or database.
Session privacy
Sessions are identified by a hash derived from anonymized data and a daily-rotating salt. The hash changes every calendar day, so sessions are not linkable across days.
There are no cookies, no localStorage values, and no fingerprinting techniques involved. Nothing persists in your browser.
Retention
Raw analytics events are retained for 14 months, then deleted. Aggregate statistics (total page views, top pages) may be retained indefinitely because they contain no individual-level data.
Do Not Track
We respect the Do Not Track browser setting. If your browser sends a DNT: 1 header, no analytics data is collected for your visit. The beacon is dropped before any data reaches our database.
Your rights and data requests
Because sessions are identified by a daily-rotating hash derived from anonymized data, re-identifying analytics records as belonging to a specific person is not feasible. There is no data to return or delete in response to a subject access request.
If you believe we hold identifiable data about you, contact privacy@habibubble.com and we'll investigate.
Where data is stored
Analytics data is stored in a Neon PostgreSQL database located in the EU (Frankfurt region). We do not transfer analytics data outside the EU or share it with third parties.
Last updated April 2026. If we change this policy, we'll update the date above. For questions, reach privacy@habibubble.com.