Privacy Policy

Effective and last updated: 21 August 2026

This Policy explains how Bibbi Entertainment ApS processes personal data when you use Bibbi Appverse. The service is designed to keep ordinary app use and Free AI lightweight while supporting accounts, social features, Rooms, payments, Advanced AI creation and safety.

1. Data controller

Bibbi Entertainment ApS, CVR 41806621, Denmark, is the controller for the processing described here. Contact: legal@bibbi.io or the contact form.

2. Information we process

Account information

Username, email address, password hash, verification status, account creation time, accepted legal-policy versions, private Credit balance, generation count, subscription status and session tokens.

User content and social activity

Prompts where they are sent to Bibbi or an Advanced AI provider, app titles, descriptions, keywords, app manifests, visibility settings, invitations, remix relationships, comments, likes, saves, follows, Room membership and Room messages, reports and contact messages. A Free Local AI prompt that is successfully processed entirely on your device is not sent to Bibbi.

Usage, rankings and technical data

App play counts and compact daily usage aggregates used for discovery and rankings, together with IP address, request times, browser request information, error data and limited security logs used to operate the service, prevent abuse and investigate incidents. Bibbi may record a small aggregate counter indicating whether a Free generation used browser-local AI or the deterministic fallback; this counter does not include the Free Local AI prompt. Bibbi does not need to retain a detailed raw event row for every ordinary app interaction.

Payment and subscription information

Where you buy Credits or Bibbi Plus, we may process the product purchased, amount, currency, payment status, transaction or checkout identifiers, payment-provider customer and subscription identifiers, refund or chargeback status and timestamps. Full card details are handled by the payment provider presented at checkout rather than stored in Bibbi’s application database.

Communications

Messages you send to support or legal contacts, including the email address needed to respond.

3. Why we process data

to create and secure accounts, verify email and reset passwords;
to publish, display, share, search, invite users to and remix apps;
to provide likes, comments, saves, follows, Rooms and creator attribution;
to calculate public play counts and discovery rankings;
to operate Credits, subscriptions, checkout reconciliation, billing records, refunds and fraud prevention;
to provide Free Local AI, deterministic Free generation and Advanced AI generation;
to prevent fraud, spam, attacks and unauthorised use;
to receive and assess reports, legal notices and appeals;
to communicate service, security, billing and policy information;
to comply with legal obligations and establish or defend legal claims;
to improve reliability and understand aggregate platform use.

4. Legal bases

Depending on the activity, we process data because it is necessary to perform our agreement with you, take steps requested before entering an agreement, comply with legal obligations, pursue legitimate interests in operating and securing the platform, or because you have given consent. Where processing is based on consent, you may withdraw it without affecting earlier lawful processing.

5. Public, link-only, invite-only and private content

Public apps, usernames, creator attribution, comments, follower counts, app counts, play counts and related engagement may be visible worldwide. Link-only apps are accessible to people who possess the link but are excluded from normal public discovery. Invite-only apps are intended for selected authorised Bibbi users. Private apps are intended to be visible only to the creator, subject to authorised security, moderation and legal access.

Room membership and Room messages are shared with the users participating in that Room. Do not publish or send personal data you do not want the relevant audience to receive.

6. AI processing

Free Local AI. On a capable device, Bibbi can run a small AI model directly inside your browser. The Free Local AI prompt and generated draft stay on your device during that inference and are not sent to Bibbi or to a paid AI provider. Your browser may download the model runtime and model files from third-party content-distribution or model-hosting infrastructure selected by Bibbi. Those providers can receive ordinary network information required to deliver the files, such as IP address and request metadata, but the Free Local AI prompt is not included in the model-file request. The browser may cache the model files so they do not need to be downloaded for every generation.

Free fallback. If your device or browser cannot comfortably run Free Local AI, Bibbi may use its deterministic zero-paid-inference generator. In that fallback case, the prompt is sent to Bibbi’s backend solely to construct the requested app manifest; it is not forwarded to a paid external AI model.

Advanced AI. When you deliberately choose Boost, Max or another Advanced AI feature, your prompt and the context required to create the requested app may be transmitted to the external AI provider configured for that generation. We aim to send only what is needed for the request and do not intentionally include your password, payment credentials or unrelated private account data.

Advanced AI providers may process data under their own infrastructure and may be located outside Denmark or the EEA. Where required, Bibbi will use an applicable data-processing agreement and international-transfer safeguard. The configured provider may change as Bibbi optimises quality, cost, safety and resilience.

7. Payment processors and other recipients

Data may be processed by hosting, email-delivery, payment, AI, model-file/content-distribution, security and backup providers acting as processors or independent controllers depending on their role. Payment checkout may occur on the payment provider’s hosted pages. We may also disclose information to advisers, authorities, courts, rights holders or affected parties where required or reasonably necessary for law, safety, fraud prevention, content disputes or legal claims.

We do not sell personal data.

8. International transfers

We aim to use European or self-hosted infrastructure where practical. If personal data is transferred outside the EEA, we will use an applicable legal transfer mechanism and supplementary safeguards where required.

9. Retention

Account and entitlement data is kept while the account is active and for a limited period afterward where needed for security, accounting, legal obligations or disputes.
Payment and accounting records may be retained for periods required by tax, bookkeeping, anti-fraud and consumer law even after account deletion.
Unverified accounts and expired verification/reset tokens may be deleted automatically.
Deleted public content or Room messages may remain temporarily in backups or records required for enforcement and legal claims.
Compact aggregate play and Free-generation-engine metrics may be retained to understand platform performance without retaining Free Local AI prompts.
Security logs are retained only as long as reasonably necessary for abuse prevention and incident investigation.
Reports and legal correspondence may be retained longer where necessary to document decisions or meet legal duties.

10. Security

We use measures such as password hashing, email verification, expiring reset tokens, HTTPS, access controls, request limits, database constraints, restricted app manifests, browser isolation for Free Local AI, server-side payment confirmation, signed payment webhooks and an idempotent Credit ledger. No internet service is completely secure, so users should use a unique strong password and protect their devices.

11. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent. Account data can be exported or deleted from Profile. You can also contact us. We may need to verify identity before fulfilling a request.

You may lodge a complaint with the Danish Data Protection Agency or another competent supervisory authority in your country.

12. Children

The account service is intended for people aged 15 or older. We do not knowingly allow younger users to register. If you believe a child below the minimum age has created an account, contact us so we can investigate.

13. Cookies, browser storage and local model cache

Bibbi uses essential browser storage to keep you signed in, remember SUN/MOON mode, avoid counting repeated app opens within the same session as separate plays, preserve ordinary product state and, where Free Local AI is supported, cache the local model/runtime files. The local model cache can be significantly larger than ordinary website assets because it contains the model needed for on-device generation. A hosted payment provider may use its own necessary checkout and fraud-prevention technologies under its privacy information. If optional analytics or behavioural advertising technologies requiring consent are introduced, an appropriate consent mechanism will be added before they are activated.

14. Automated decisions

Automated systems may assist with rate limiting, security, rankings, device-capability selection for Free Local AI, payment fraud signals and content detection. The platform does not intentionally make solely automated decisions that produce legal or similarly significant effects without the protections required by applicable law. Material moderation decisions may be reviewed on request where applicable.

15. Changes

We may update this Policy as the platform develops. Material changes will be communicated in the service or by email and the current version date will be shown here.