Privacy Policy

Last updated: 10 September 2026

Booniverse is a peer-support app for teens and young adults. This policy explains what we collect, why, who we share it with, and what you can do about it. We've tried to write it so you can actually read it. If anything here is unclear, email us at [email protected] and we'll explain it properly.

Booniverse is operated by Booniverse Inc., 115 West 27th Street, New York, NY 10001, USA.

The short version

• You must be 13 or older to use Booniverse.
• We collect your email, username, birthday, and whatever you choose to write or upload — journals, chats, forum posts, your profile photo.
• Everything you write in chats, forums, journals and reflections is sent to automated safety systems run by OpenAI and Google before or shortly after it appears. This is how we keep the app safe. It is not a person reading over your shoulder, but it is a real thing we do and you should know about it.
• We do not sell your data, we do not show you ads, and we do not use your content to train AI models.
• You can delete your account from Profile → About → Delete Account.

1. Who this applies to and how old you have to be

You must be at least 13 to create a Booniverse account. We ask for your birthday during setup and we block accounts that don't meet the minimum age.

If we find out someone under 13 has an account, we delete it and the data associated with it.

Booniverse is available in the United States only. Our App Store and Google Play listings are limited to US territories, and this policy is written for users in the US. We'll open other countries when we can support them properly, and this policy will change first.

Under-13 is a hard floor, not a territory question: we block those accounts wherever they're created, and delete them and their data if one gets through.

2. What we collect

Things you give us

Things we collect automatically

• Device and app information — device model, operating system, app version.
• Login sessions — so you can see where your account is signed in. Deleted after 30 days of inactivity.
• Push notification token — so we can send you notifications.
• Country — worked out from your IP address using a service called ipapi.co, and only while your Location Access setting is on. Turning it off clears it.
• Crash reports — if the app crashes, Firebase Crashlytics sends us the technical details. These are linked to your account ID so we can tell whether a crash is affecting one person or everyone.
• Purchase records — if you buy BOO or subscribe to Boo+.

Things we don't collect

We don't collect your precise location, your contacts list, your browsing history outside the app, or anything from your camera or photo library other than the image you deliberately pick as a profile photo.

3. Why we collect it

What we never do with it. We don't sell your information, we don't share it for anyone else's advertising, and we don't use it to target ads at you. There are no advertising or ad-attribution SDKs in the app at all.

4. Automated safety checks — please read this one

Booniverse is a mental-health app used by teenagers. To keep it safe we check content automatically:

• Text you write — chat messages, forum posts, comments and your bio are sent to OpenAI's moderation service to check for abuse, harassment, sexual content, threats and grooming patterns. We also run our own keyword checks.
• Images you upload — profile photos and forum images are scanned by Google Cloud Vision before they are visible to anyone else. A profile photo is held in a private area where nobody can see it, including you, until it passes.
• Moon reflections and journal entries you submit for a reflection are sent to OpenAI (GPT-4o-mini) to generate the reflection you get back.
• Messages that look like they're about self-harm or a crisis are logged for our safety team to review, so we can check you're okay and show you crisis resources.

What this means in plain terms: if you write something in Booniverse, assume a computer has read it, and that a human on our safety team may read it if the computer flags it or if someone reports you.

We do not use your content to train AI models, and our providers are contractually restricted from doing so.

5. What other people can see

These are enforced by our database rules, so the limits below are real limits, not just what the app chooses to display.

About anonymous posts

Mail-Bun posts are anonymous to the person who receives them — their content does not carry your name, and the recipient cannot find out who sent it.

They are not anonymous to us. We keep a separate, locked record linking each anonymous post to the account that sent it, so that we can investigate abuse, harassment and safety incidents. If you use an anonymous post to hurt someone, we can identify you, and we will.

About your birthday

Your contacts see the day and month only — never the year.

Your full date of birth, your email address, your country, your push token and your notification and privacy settings are stored in a private area of your account that only you can read. Other users can't retrieve them, and that's enforced by our database rules — not just by what the app chooses to display.

We use your full date of birth to check you're old enough to be here, and to enforce the 18+ requirement for becoming a listener.

6. Who we share it with

We don't sell your personal information. We share it with service providers who help us run Booniverse:

We may also disclose information where we're legally required to, or where we believe in good faith that it's necessary to prevent serious harm to you or someone else.

Where your information lives. Booniverse Inc. is a US company, the app is offered in the US only, and your information is stored and processed in the United States on Google Cloud and Firebase.

7. How long we keep things

Anything kept "while your account is open" is removed when you delete your account, except the safety and purchase records described above.

8. Your rights and choices

You can:

• See and edit most of your information in the app (Profile → settings).
• Change your username or email once every 90 days.
• Control who sees your journals with the friend-feed and public toggles.
• Turn off push notifications, login alerts, and QR/ID discoverability.
• Block any user, and report any user or piece of content.
• Delete your account — Profile → About → Delete Account.

Depending on where you live you may also have the right to request a copy of your data, correct it, ask us to delete it, object to how we use it, or complain to your data protection regulator. Email [email protected] and we'll respond within 30 days.

What deleting your account actually removes. Your profile, journals and dream logs, moon reflections, notes and anonymous posts you received, your contacts and friend connections, your forum notifications and activity, your listener/speaker records, your profile photo and any images you uploaded, and your sign-in itself.

What we redact rather than delete. Forum posts, comments and BooFriend chat messages are removed from you — your name and the content come off them — but the entry itself stays in place, because deleting it outright would tear a hole in someone else's conversation or a live forum thread.

What we keep. Safety records (reports, moderation flags, crisis logs) and purchase records, for the reasons and periods described in section 7. If your account was suspended or banned when you deleted it, we keep a one-way scrambled version of your email address so the ban can't be shed by deleting and signing up again.

9. Security

We use Firebase Authentication, App Check, and default-deny database rules. Your password is hashed and we never see it. Sensitive actions — your BOO balance, purchases, moderation, reports — are enforced on our servers, not in the app, so they can't be faked by a modified client.

No service is perfectly secure. If we discover a breach affecting your personal data we'll notify you and the relevant regulator as required by law.

10. Changes to this policy

If we make a significant change we'll tell you in the app and ask you to accept the updated version before you continue.

11. Contact

Booniverse Inc. 115 West 27th Street, New York, NY 10001, USA [email protected]

We reply to privacy requests within 30 days.