Privacy Policy

01

What we collect and why

1.1 Account

When you sign in with Google or Apple we receive your name, email address, and the identifier provided by that sign-in service. We do not receive or store your password. Purpose: creating and securing your account. We use it to operate your session, prevent abuse, and contact you about your account.

1.2 Profile

The username, display name, and photo you choose to add. Purpose: showing your profile to other users — that is what a social app is for.

1.3 Vehicles and plate lookups

Vehicle information you add (registration plate, make, model, photos) and the plates you look up. Vehicle profiles and plates are visible to other users of the app. Purpose: the core feature — finding and connecting with drivers via their vehicles. Plate numbers identify vehicles, not persons; linking a vehicle to your account is your choice.

1.4 Vehicle ownership verification (registration certificates)

If you choose to verify ownership of a vehicle, you photograph your vehicle registration certificate. The certificate image is processed transiently and is never stored by us: it is sent in-memory to an AI document-analysis service (Google Vertex AI, processed in the EU multi-region under Google’s Cloud Data Processing Addendum, with caching disabled) which extracts only specific facts — the VIN, the registration date, and the owner name — and the image is then discarded. Only those extracted facts and the verification result are stored. Purpose: proving vehicle ownership while holding your identity document for the shortest possible time — zero.

1.5 Messages and media

Your 1:1 chat messages and the photos/GIFs you send in them. Private messages are visible only to you and the recipient; private media is stored in an access-controlled EU storage bucket and is never publicly accessible. Automated screening of public images: when you confirm a public JPEG or PNG for an avatar or a vehicle gallery, we classify it before publication with a machine-learning model that we run ourselves. The model file ships inside our own application and runs on our own servers in the European Union; the image is not sent to any third party, and no image bytes leave our EU infrastructure for this check. The model returns one of three labels — sexual content, graphic violence, or neither — and an image labelled sexual or graphic-violent at or above our configured confidence threshold is refused: it is never copied to the public bucket and never reaches the content-delivery network. The refused file itself is deleted from the private upload storage and is never copied to the public one. What remains is the upload’s own record: the classifier’s verdict against it, the account it belonged to, what it was for, and the file’s technical details — type, size, storage keys and timestamps — but no copy of the image. We keep that record for as long as your account exists, and it is deleted together with the account. Where it is this screening that refuses an image, we may also keep a separate record of the refusal itself: your account identifier, which surface the upload was for (avatar or vehicle photo), the label the model returned and its confidence score, and the time it was refused. That record contains no copy of the image and no reference to one — a refused upload cannot be retrieved from it. It is written only for refusals by the classifier: an upload refused for its size, or because its contents are not the file type it was declared to be, leaves no such record. Writing it is no part of the refusal — where it cannot be written, the image is refused just the same and that separate record is simply lost. We keep it for 90 days from the refusal; an automatic sweep then deletes it, within hours of that point, and it is deleted when you delete your account. We use it only to see repeated attempts to publish prohibited imagery. This screening runs only on public avatar and vehicle images, at the moment you confirm them; it does not run on media in private messages. What this screening is not: it is not matching against a database of known child sexual abuse images, and it cannot determine the age of any person shown in an image. It is an adult-content and graphic-violence filter, and we do not present it as more than that. How child sexual abuse material is acted on: through reports and human review. Anyone can report a profile, a vehicle, a vehicle photo, a message or a user from inside the app, choosing child safety as the reason. A person examines the report — never an automated system. Where a child-safety violation is confirmed, the content is removed and the responsible account is permanently terminated, and the case is reported to the competent authorities of the Republic of Moldova and to the national child-protection hotline. Reports to authorities and to child-protection organisations are made by a person and are never automated. See our Child Safety Standards at ibeep.app/child-safety/. Purpose: keeping sexual and graphic-violent imagery off the public surfaces of the app before publication, and acting on reports of illegal content.

1.6 Push notifications

A device push token, so we can deliver notifications (via the Expo push service). You can disable notifications in system settings at any time.

1.7 Subscriptions

If you purchase iBeep Pro, the purchase is processed by Apple/Google and our subscription processor (RevenueCat). We receive subscription status and store-scoped transaction identifiers — never your card details.

1.8 Technical data

Server logs (IP address, timestamps, request metadata) kept for security, abuse prevention, and diagnostics. We use no third-party analytics, advertising, or tracking SDKs in the app.

1.9 Date of birth and the age check

You give your date of birth when you set up your account. Purpose: checking that you meet the minimum age in §7, and nothing else. It is stored with your account, is visible only to you, and is never shown to other users. If the date you give shows you are under 16, the account is refused and we record that refusal — the sign-in identifiers Google or Apple gave us for your account, the date of birth you declared, and the time of the refusal. Purpose: enforcing the minimum age, as described in §7.

02

Legal bases

Performance of our contract with you (operating the app you signed up for); our legitimate interests (security, abuse prevention, the screening of public images described in §1.5 — assessed in a documented impact assessment); compliance with legal obligations (e.g. removing illegal content upon knowledge, responding to lawful authority requests); and your consent where we ask for it (e.g. optional features). The only automated decision we make about your content is whether a public image may be published; it never closes an account by itself, and every account action follows human review.

03

Where your data lives

Our core infrastructure is hosted in the European Union: application servers on Railway (EU region), media on Cloudflare R2 (EU jurisdiction), database in the EU. The screening of public images described in §1.5 runs on those same EU application servers, so no image is transferred outside the EU for it. On-device data is stored in an encrypted local database on your phone.

04

Who we share data with

We do not sell your data, and we do not share it with advertisers. We use these processors, each bound by data-processing terms:

No processor receives your images for child-safety screening: the classification described in §1.5 runs inside our own application, on our own EU servers. Reports to the competent authorities and to child-protection organisations follow human review and are never automated. We respond to lawful requests from competent authorities.

Cross-border transfers outside the EEA/adequacy area (push delivery, subscription management, child-safety reports) are limited to the minimum data needed and are made under the safeguards and derogations of Law 133/2011 art. 32 (from 23.08.2026, Law 195/2024).

05

How long we keep data

06

Your rights

Under Moldovan data-protection law you have the right of access, rectification, erasure, restriction, objection, and data portability, and the right not to be subject to solely automated decisions with significant effects. Exercise them at support@ibeep.app — we respond within the statutory deadlines. You can delete your account (and its data) at any time directly in the app.

You may lodge a complaint with the National Center for Personal Data Protection of the Republic of Moldova (CNPDCP) — datepersonale.md — and you have the right to a judicial remedy.

07

Age

iBeep is intended for users aged 16 or over. You give your date of birth when you set up your account and we check it before the account can be used: if it shows you are under 16, the account is refused and you cannot use iBeep. If we later learn that an account belongs to someone under 16, we close it.

We keep a record of every refusal. It holds only the sign-in identifiers Google or Apple gave us for your account, the date of birth you declared, and the time of the refusal — no name, no email address, nothing else. It has one purpose, enforcing the minimum age, and is used for no other. It is stored separately from your account and is deliberately not deleted when your account is deleted, so that deleting an account and registering again with the same Google or Apple sign-in cannot get past the check. The first date of birth you declare is the one that counts and is never overwritten; once it shows you have reached 16, you can use iBeep. We keep the record for as long as it serves that purpose, and we do not share it.

08

Changes

We will notify you in the app of material changes to this policy before they take effect. The current version is always at ibeep.app/privacy/.