BundleVue

Privacy Policy

Last updated: April 12, 2026

BundleVue is designed with privacy in mind. Your personal usage history stays on your device. We only store data strictly necessary for the app to function.

1. Who we are

BundleVue is operated by:

MJ Consultancy B.V.
Paganiniplantsoen 14
2151 GH Nieuw-Vennep
Netherlands

KvK (Chamber of Commerce): 28106352
Email: hello@bundlevue.app
Website: https://bundlevue.app

In this policy, "we", "us", and "our" refer to MJ Consultancy B.V. "BundleVue" refers to the BundleVue iOS and Android applications, the Apple Watch companion app, and the bundlevue.app website.

2. What this policy covers

This Privacy Policy explains what personal data we collect, why we collect it, how we process it, and what rights you have. It applies to:

The BundleVue iOS app (including the Apple Watch companion)
The BundleVue Android app
The bundlevue.app website
Any related services we provide

3. Data we collect

3.1 Account data (via Sign in with Apple or Google)

When you create an account, we use platform-native authentication:

On iOS and Apple Watch: Sign in with Apple. Apple provides us with a unique user identifier (Apple ID token), and — if you choose to share them — your email address and name. Apple allows you to hide your email address.
On Android: Sign in with Google. Google provides us with a unique user identifier, your email address, and your name from your Google account.

We store your user ID, display name, and account creation date in your profile. We do not receive or store your Apple ID password or Google password — authentication is handled entirely by Apple or Google via secure tokens.

3.2 Device identifiers and push tokens

To deliver push notifications (usage alerts, group notifications), we store a push notification token provided by the operating system:

iOS: Apple Push Notification service (APNs) device token
Android: Firebase Cloud Messaging (FCM) registration token

These tokens are rotated by the operating system and cannot be used to identify you outside of push notification delivery. They are linked to your account so we know where to deliver notifications you have configured.

3.3 Usage data

BundleVue tracks your mobile and Wi-Fi data usage on your device using system network interfaces. This data is stored locally on your device by default.

When cloud sync is enabled (opt-in), the following is synced to our servers:

Daily mobile data usage (bytes)
Daily Wi-Fi data usage (bytes)
Date of each usage record
Associated group ID (if you are in a group)

3.4 Group data

If you create or join a group, we store:

Group name, data limit, billing cycle, start date, and configuration
Your membership (user ID, group ID, role, join date)
Invitation tokens (group ID, token, creator, expiry date, usage status)

3.5 Subscription data

When you subscribe to BundleVue Premium, your purchase is processed by Apple (App Store) or Google (Play Store). We use RevenueCat to manage subscriptions across both platforms. RevenueCat receives:

An anonymous customer ID
Your email address (if provided)
Your display name
Your Supabase user ID (as a custom attribute)
Purchase receipts from Apple or Google

We do not have access to your payment details (credit card, bank account, etc.). These are handled entirely by Apple or Google.

3.6 Diagnostics and product analytics

We use TelemetryDeck, a privacy-focused analytics service based in Austria, to understand how BundleVue is used and to identify bugs. TelemetryDeck receives:

Anonymized event signals (e.g. "paywall opened", "group created") without personal content
A salted hash of your device identifier — this cannot be reversed to identify you
App version, operating system version, and device model
Basic diagnostic information about app performance

In addition, Apple and Google may provide us with aggregated, anonymized crash reports for iOS and Android respectively (via App Store Connect and Google Play Console). We do not operate separate third-party crash reporting SDKs such as Firebase Crashlytics or Sentry.

3.7 Data we do NOT collect

No advertising: We do not use any advertising SDKs or tracking
No location data: We do not access your GPS or location
No contacts or photos: We do not access your contacts, photos, or other personal files
No behavioral profiling: We do not build profiles of your behavior for marketing purposes
No data sales: We never sell your data to third parties

4. How we use your data

Purpose	Data used	Legal basis (GDPR Art. 6)
Provide the app and its core features	Account data, usage data, group data	Contract performance (Art. 6(1)(b))
Authenticate your identity	Apple ID / Google ID token, email	Contract performance (Art. 6(1)(b))
Manage your subscription	Customer ID, purchase receipts	Contract performance (Art. 6(1)(b))
Sync usage data to the cloud	Daily usage data	Consent (Art. 6(1)(a)) — opt-in via cloud sync toggle
Enable group features	Usage data, group data, memberships	Contract performance (Art. 6(1)(b))
Deliver push notifications	APNs / FCM push tokens	Contract performance (Art. 6(1)(b))
Ensure security and prevent abuse	Account data, access logs	Legitimate interest (Art. 6(1)(f))
Understand product usage and fix bugs	Anonymized event signals, diagnostics	Legitimate interest (Art. 6(1)(f))

Cloud sync and consent: Cloud sync is optional. You can enable or disable it at any time in the app settings. When cloud sync is off, your usage data stays on your device only. However, disabling cloud sync limits app functionality: your usage data will not appear in the group dashboard, group members will not be able to see your data usage, and usage history will not be preserved across device changes or reinstallations.

5. Where your data is stored

Your data is processed and stored using Supabase (Supabase Inc.), hosted on AWS infrastructure in the EU (Frankfurt) region.

All data stored in Supabase resides within the European Union.

Data that is only stored locally on your device (when cloud sync is off) includes: bundle configuration, usage samples, daily usage records, and notification thresholds.

6. Third-party services (sub-processors)

We use the following third-party services to operate BundleVue:

6.1 Supabase

Provider: Supabase Inc. (USA)
Purpose: Database, user authentication, realtime data sync
Data stored: Account data, usage data, group data, memberships, invitations
Data location: EU (Frankfurt), hosted on AWS
Transfer mechanism: Supabase is certified under the EU-US Data Privacy Framework
Privacy policy: https://supabase.com/privacy

6.2 RevenueCat

Provider: RevenueCat Inc. (USA)
Purpose: Subscription and in-app purchase management
Data received: Anonymous customer ID, email (if provided), display name, Supabase user ID, Apple purchase receipts
Transfer mechanism: EU-US Data Privacy Framework / Standard Contractual Clauses
Privacy policy: https://www.revenuecat.com/privacy

6.3 Apple

Provider: Apple Inc. (USA)
Purpose: Authentication (Sign in with Apple), App Store payments, push notifications (APNs), aggregated crash reports
Data received: Apple manages authentication tokens, payment processing, push notification delivery, and provides us with aggregated anonymized crash reports via App Store Connect
Privacy policy: https://www.apple.com/legal/privacy/

6.4 Google

Provider: Google LLC (USA)
Purpose (Android only): Authentication (Sign in with Google), Play Store payments, push notifications (Firebase Cloud Messaging), aggregated crash reports
Data received: Google manages authentication tokens, payment processing, FCM push notification delivery, and provides us with aggregated anonymized crash reports via Google Play Console
Transfer mechanism: EU-US Data Privacy Framework
Privacy policy: https://policies.google.com/privacy

6.5 TelemetryDeck

Provider: TelemetryDeck UG (Austria, EU)
Purpose: Privacy-focused product analytics — understanding how features are used and identifying bugs
Data received: Anonymized event signals, salted hash of device identifier (cannot be reversed), app version, OS version, device model
Data location: EU (Germany)
Transfer mechanism: Not required — EU-based provider
Privacy policy: https://telemetrydeck.com/privacy/

We do not share your data with any other third parties. We do not sell your data.

7. Data retention

Data	Retention
Account and profile data	Kept while your account exists
Usage data	Kept while your account exists
Group data	Kept while the group exists
Invitation tokens	Expire after 7 days; expired tokens are cleaned up periodically
Subscription data (at RevenueCat)	Subject to RevenueCat's retention policy

7.1 How to delete your account

You can delete your account directly from within the app:

Settings → scroll down → Delete Account

This immediately deletes your account and your usage data from our servers. If you are a group member, you will automatically leave the group. If you are the group owner and the only member, the group will also be deleted.

For full deletion of all associated data (including your profile, memberships, and authentication account at Supabase and RevenueCat), contact us at hello@bundlevue.app. We will process your request within 30 days.

When you delete your account:

Your usage data is deleted from our servers
Your account and profile are removed
Your group memberships are ended
Data stored locally on your device is not automatically removed — you can clear it by uninstalling the app

8. Your rights under GDPR

As a data subject under the General Data Protection Regulation (GDPR / AVG), you have the following rights:

Right	Description
Access	Request a copy of the personal data we hold about you
Rectification	Request correction of inaccurate data
Erasure	Request deletion of your data ("right to be forgotten")
Portability	Request your data in a structured, machine-readable format
Restriction	Request that we limit how we process your data
Objection	Object to processing based on legitimate interest
Withdraw consent	Withdraw consent for cloud sync at any time by disabling it in the app

To exercise any of these rights, email us at hello@bundlevue.app. We will respond within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): https://autoriteitpersoonsgegevens.nl

9. Data security

We take appropriate technical and organizational measures to protect your data, including:

All data in transit is encrypted via TLS/HTTPS
Database access is restricted through Row Level Security (RLS) policies in Supabase
Authentication is handled through Sign in with Apple (iOS) or Sign in with Google (Android), which does not expose your Apple ID or Google password to us
We do not store passwords — authentication is token-based
Access to backend systems is restricted to authorized personnel only

10. Children's privacy

BundleVue is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us at hello@bundlevue.app and we will delete it promptly.

BundleVue does offer parental control features within group bundles, which are managed by the group owner (parent/guardian).

11. International data transfers

Our primary data storage is in the EU (Frankfurt and, for TelemetryDeck, Germany). Where data is processed by sub-processors in the United States (Supabase, RevenueCat, Apple, Google), appropriate safeguards are in place:

EU-US Data Privacy Framework certification
Standard Contractual Clauses (SCCs) where applicable

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

Update the "Last updated" date at the top of this page
Notify you through the app or via email (if we have your email address)

We encourage you to review this policy periodically.

13. Cookie policy

Our cookie policy is a separate document. You can find it at: https://bundlevue.app/cookie-policy/

14. Contact

If you have any questions about this Privacy Policy or your personal data, contact us at:

MJ Consultancy B.V.
Paganiniplantsoen 14
2151 GH Nieuw-Vennep
Netherlands

Email: hello@bundlevue.app