Privacy Policy
Version 1.2 · MVP / Proof of Concept
Effective Date: July 2026
Updated: October 2026
Privacy Commitment
At ChatBomb, we believe trust is earned. Protecting your privacy is fundamental to creating a platform where people can confidently connect with others in their local community. This Privacy Policy explains what information we collect, why we collect it, how we use it, and the choices you have regarding your personal information.
1. Who We Are
ChatBomb is a location-based social platform that enables users to connect with nearby people through time-limited location-based posts known as ChatBombs.
2. Information We Collect
We may collect account information, profile details, email address, encrypted password, date of birth (used to verify you are 18 or over), profile photo, biography, approximate location information, content you create, messages, device information, IP address, browser details and crash reports.If you verify a mobile number, we also collect information about that number (see section 2A). For security and fraud prevention, we also collect a device identifier stored in a security cookie, and records of sign-up and phone verification attempts (see section 2B).
2A. Phone Verification and One Account Per Person
ChatBomb is designed for one account per person. To help with this, we may ask you to verify an Australian mobile number by entering a code we send to it by SMS. Verification is required for some accounts, and is always required to receive any promotion or reward. If verification is required for your account and you choose not to verify, you won't be able to use some features, such as posting, responding to ChatBombs and chatting. Without a verified number, you also can't receive promotions or rewards.When you verify, your number is sent to our SMS provider, Twilio Inc. (United States), so it can send you the code and check the type of line (mobile, landline or virtual) and the mobile network it belongs to. Only mobile numbers can be used; landline and virtual numbers are declined. To help prevent abuse, Twilio may also receive the IP address you are using and an internal ID for your ChatBomb account. Twilio handles this information under its own privacy policy.We do not store your full mobile number. Instead, we store a keyed cryptographic fingerprint of it (known as an HMAC), the last 4 digits, the country, the line type, the mobile network (carrier name and network code), the time you verified, and the IP address and device identifier you used when verifying. The fingerprint lets us detect when the same number is used on another account. A number that is already linked to one ChatBomb account can't be verified on another.
2B. Fraud Prevention and Security Checks
To keep ChatBomb safe and fair, and to stop fake and duplicate accounts, we carry out the security checks described below.Sign-up checks. When someone signs up, we check the email domain against public lists of disposable or temporary email providers, and the connecting IP address against the public list of Tor exit nodes. Sign-ups that match are refused. We may also limit how many accounts can be created from one network in a short time. We keep a log of sign-up attempts, including the IP address, the email domain, a scrambled (hashed) version of the email address, the sign-up method and the outcome.Device identifier. We set a first-party security cookie named cb_did on your device. It contains a random, signed identifier and is kept for up to 400 days. We use it only for security and fraud prevention, for example to notice when several accounts verify a phone number from the same device. It is not used for advertising.Verification logs. We keep a log of each attempt to send or check a phone verification code, including the fingerprint and last 4 digits of the number, the IP address, the device identifier, the line type and network, and the result.Bot checks. We may use Cloudflare Turnstile, provided by Cloudflare, Inc. (United States), on the sign-up, log-in, password reset and phone verification screens to tell people apart from automated bots. Cloudflare processes your IP address and signals from your device and browser for this purpose.Human review. Automated signals, such as several accounts sharing a device, a network or an email inbox, are flagged for review by a person. While a review is open, a promotion or reward may be put on hold. A review may lead to an account being restricted, suspended or closed, or a promotion or reward being withheld. These signals never lead to an account being deleted automatically.
3. How We Collect Information
Information is collected when you create an account, complete your profile, create or respond to a ChatBomb, send messages, upload content, contact support or enable location services.We also collect information when you verify a mobile number or take part in a promotion, and automatically when you use ChatBomb, for example through cookies, bot checks and security logs. Some information comes from other organisations: Twilio tells us the line type and network of a number you verify, Cloudflare (where used) tells us whether a bot check was passed, and Google shares basic account details with us if you choose Sign in with Google.
4. Why We Collect Information
We collect information to operate ChatBomb, authenticate users, display nearby ChatBombs, enable messaging, improve security, investigate abuse, improve our services and comply with Australian law.We also use information to prevent fraud and fake or duplicate accounts, to keep ChatBomb to one account per person, and to check whether you are eligible for any promotion or reward we run.
5. Location Information
Location is fundamental to ChatBomb. Exact GPS coordinates are never intentionally displayed to other users. Nearby distances may be rounded and approximate areas shown instead of precise locations.
6. How We Use Your Information
Your information may be used to operate your account, personalise your experience, deliver notifications, investigate reports, improve the platform and communicate with you.
7. Sharing Information
We do not sell your personal information. Information may only be shared where required by law, to protect users, investigate criminal activity or with trusted service providers including hosting, authentication, mapping and cloud storage providers.Our service providers, what they do for us and where they process information are listed in section 12.
8. Data Security
We use encrypted connections, secure authentication, restricted access and modern cloud security practices to protect your information. No online service can guarantee absolute security.
9. Account Security
You are responsible for choosing a strong password, keeping it confidential and protecting access to your devices.
10. Messages
Private messages are intended only for the participants involved. Users should never assume any electronic communication is completely immune from unauthorised access.Our moderators may access messages when investigating a report or enforcing our Terms.
11. Cookies & Analytics
ChatBomb may use cookies and similar technologies to keep you signed in, remember preferences, improve performance and understand platform usage.This includes a security cookie named cb_did, which holds a random, signed device identifier for up to 400 days. It is used only for security and fraud prevention, not for advertising (see section 2B). We also use Vercel's website analytics to understand how ChatBomb is used.
12. Third-Party Services
ChatBomb may integrate services such as Supabase, Mapbox, Vercel and Google services. Each provider has its own privacy practices.The service providers we currently use, what they do for us and where they process information are:• Supabase (database, authentication and file storage) — Sydney, Australia• Vercel (website hosting and website analytics) — United States• Twilio (SMS verification codes and mobile number checks) — United States• Sentry (crash and error reports; phone numbers are removed before reports are sent) — United States• Mapbox (maps and place search, including finding the area name for a location you choose when posting) — United States• Resend (account emails, such as email confirmation and password reset) — United States• Google (Sign in with Google, if you choose to use it) — United States• Cloudflare (bot checks) — United States and other countries where Cloudflare operates its global network
13. Data Retention
We retain information only as long as reasonably necessary to operate the platform, comply with legal obligations, investigate abuse and resolve disputes.In particular:• Logs of phone verification attempts (including IP address, device identifier and line type) and logs of sign-up attempts (including IP address and email domain) are deleted after 90 days.• The fingerprint and last 4 digits of a verified mobile number, and the other verification details listed in section 2A, are kept while your account exists. The fingerprint and last 4 digits are also kept after your account is deleted, so the number can't be used to verify another account (see section 14).• When an account is deleted, the IP address, device identifier and carrier details stored with its phone fingerprint are cleared within 31 days.• The cb_did security cookie expires after no more than 400 days.• A ChatBomb's exact drop location is replaced with an approximate location about a day after it expires.
14. Deleting Your Account
You may request deletion of your account. Some information may be retained where required by law or for fraud prevention and security.If you verified a mobile number, we keep its fingerprint and last 4 digits (together with its country, line type, verification date and an internal reference to the deleted account) after your account is deleted. This stops the same number being used to verify another account. The IP address, device identifier and carrier details stored with it are cleared within 31 days of deletion.If you have changed your mobile number, or have another reason for wanting your number released from your account, you can ask us to release it by emailing drop@chatbomb.com. We will review your request and, if we agree, delete the number's verification record, including its fingerprint, so the number can be verified again. Your account will then no longer have a verified number, so you may need to verify your new one.
15. Children's Privacy
ChatBomb is intended for users aged 18 years or older. Accounts believed to belong to under-age users may be removed.
16. Australian Privacy Law
ChatBomb is committed to complying with the Privacy Act 1988 (Cth) and the Australian Privacy Principles where applicable.
16A. Access, Correction and Complaints
You can ask for access to the personal information we hold about you, or ask us to correct it, by emailing drop@chatbomb.com. We may need to confirm your identity before we respond.If you have a concern or complaint about how we have handled your personal information, please contact us first at drop@chatbomb.com and tell us what happened. We will look into it and respond within a reasonable time, usually within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
17. Overseas Disclosure
Our main database is hosted in Sydney, Australia. However, some of our service providers process personal information outside Australia, so some of your personal information is disclosed overseas when you use ChatBomb. These providers are located mainly in the United States, and Cloudflare's bot check may also process information in other countries where Cloudflare operates its global network. Section 12 lists each provider, what it does and where it processes information. We use established providers and take reasonable steps to ensure they handle personal information consistently with the Australian Privacy Principles.
18. Changes
This Privacy Policy may be updated from time to time. Continued use of ChatBomb constitutes acceptance of the latest version.
19. Contact
Email: drop@chatbomb.com
Website: www.chatbomb.com
Our Privacy Promise
We believe privacy is fundamental to building trust. Our goal is simple: to help people connect locally without compromising their privacy.