Privacy policy

TribuMama is the data controller for the information you share with us, and operates the service from Spain. For any question about this policy or your data, or to exercise your rights, contact us at hey@tribumama.app.

Account: when you sign up we collect your email address, which we use to send you a one time sign in code. We do not collect a password or social login. Profile: you may add your first name, a short bio, your children's age range, your parenting style, identity and interest tags, photos, and an optional Instagram handle. Location: we collect the approximate area you set, and your device location when you allow it, to find tribes near you, along with the city and region derived from the place you choose. Usage and device: to keep the app working and safe we collect a push notification token if you enable notifications, your language preference, basic app activity and crash diagnostics, and limited technical data such as your IP address. Messages: when you chat in a tribe, we collect the messages you send, including their text, who sent them, which tribe they belong to, and when they were sent. When you message another mother privately, we collect those messages in the same way: their text, who sent and received them, and when they were sent, along with reactions and read status. If you use "Reply privately", the text of the tribe message you quote is copied into the private chat.

We use your information to create and secure your account, match you with tribes and mothers near you, show your profile to members of tribes you join or consider joining, deliver the messages you send within your tribes and in private chats, send notifications you have turned on, keep the community safe and handle reports, understand how the app is used so we can improve it, and respond to you when you contact us. We do not sell your personal data. We only share data to measure our own ads if you allow it, as described in "Ad measurement" below.

We rely on the following legal bases under the GDPR. Performance of a contract, to create your account and provide the core service. Your consent, for optional processing such as accessing your device location, sending push notifications, product analytics and ad measurement, which you can withdraw at any time. Our legitimate interest, in keeping the community safe, preventing abuse, and improving the service. Compliance with legal obligations, where the law requires us to keep certain records.

When you allow it, we collect your device location to find tribes near you. Your exact coordinates are stored on our servers to calculate distances, and are never shown to other members or shared with them. On the map, tribes appear only at the level of a neighborhood area, not at any exact address. You can turn location access off at any time in your device settings.

Photos and profile details you add are visible to other members, and to mothers considering a tribe before they join. Please share only what you are comfortable making visible to the community, and avoid sharing images or details of other people, including children, without their agreement. You can edit or remove this information at any time from your profile. Chat photos: you can attach up to 5 photos to a message in a tribe chat or a private chat. You choose how long they stay: 24 hours, 3 days or 7 days. After that the photos are deleted from our servers and no longer shown, and the caption goes with them. The photos are visible only to the people who were in that chat when they were sent, and we do not read them unless they are reported. Members can download them to their phone, and anything someone downloaded or screenshotted stays on their device, where we cannot delete it.

To keep the community real and safe, you must complete a short face check before you can join or create a tribe. During the check, the app uses your front camera to take a few still photos while you follow simple instructions, such as closing your eyes, turning your head or smiling. Each photo is analysed only on your device by Google ML Kit face detection, which tells the app whether a single face is present and whether it makes the requested movement. The photos are deleted from your device immediately after each analysis, and they are never uploaded to our servers or shared with anyone, including Google. We do not create a face template, compare your face with your profile photos or any other image, or use the check to identify you. The only result we store is that your profile is verified and the date of the check, which other members see as a verified badge. We keep that verification status while your account exists and delete it with your account.

Tribes have a group chat. The messages you send are visible to every member of that tribe, and are stored on our servers so the conversation stays available to them. You can delete your own messages at any time, which erases their text for everyone and leaves a short note in its place showing the message was deleted. Messages cannot be edited once sent. Photos in a message expire after the time you chose (24 hours, 3 days or 7 days), and deleting the message hides them straight away and removes them shortly after. If you block a member, their messages are hidden from you. Please share only what you are comfortable posting to the whole group, and do not share other people's private information or images, including children, without their agreement. Private messages: you can also message a member privately when you share a tribe with her. A private chat is visible only to the two of you, and we do not read it unless it is reported. The messages are stored on our servers until either of you deletes her account, which removes the whole chat for both. You can delete your own messages, which erases their text for both of you, and you can clear a chat to remove it from your own view, which does not remove it for the other person. You can mute a private chat, or block the member so that neither of you can message the other privately and her messages are hidden from you. If you report a private message, the report includes that message and up to 10 earlier messages in the chat, so we can understand the context, and only our moderation team sees them.

When you send a link in a chat, your device contacts that website directly to show a small preview, such as its title, description and image. This means the website you link to may see your device's IP address, just as it would if you opened the link in a browser. We do not send your message or your identity to that website; your device only makes the request needed to load the preview.

TribuMama is for adults and is intended for mothers and caregivers aged 18 and over. We do not knowingly collect data from anyone under 18. Any age information relates to your own children and is used only to match you with mothers at a similar stage. We do not create profiles for children. If you believe a minor has given us personal data, contact us at hey@tribumama.app and we will delete it.

We share data only with trusted providers that process it on our behalf under data processing agreements, and that may not use it for their own purposes. Supabase (European Union) hosts our database, authentication and photo storage. PostHog (European Union) provides product analytics. Sentry provides crash and error diagnostics. Expo delivers push notifications, which are routed through Apple and Google notification services. hCaptcha helps us block automated sign ups. Resend sends transactional emails, such as notifying us when someone files a report. For maps, address search uses Photon (Komoot), map tiles are served by OpenStreetMap (or MapTiler where enabled), and the map view uses Apple Maps on iOS and Google Maps on Android. Our website is hosted on Vercel, and email to us is handled by our email provider.

We advertise the app on Instagram. If you allow ad measurement in the app, the Meta SDK in the app sends Meta Platforms Ireland Limited a signal when the app is installed and opened and when you finish signing up, together with your device's advertising identifier, basic device information and your IP address. This lets us see which of our ads bring mothers to TribuMama and stop paying for the ones that do not. We never send Meta your name, email, profile, your children's information, your location or your messages. On iPhone, Apple also asks for your permission before any of this is sent. Ad measurement is off until you allow it, and you can turn it off at any time in Settings, Ad measurement, or in your device settings. Meta processes this data under its own terms and privacy policy (facebook.com/privacy/policy), and may transfer it outside the European Economic Area under the EU US Data Privacy Framework.

We aim to keep your data within the European Union. Where a provider processes data outside the European Economic Area, that transfer is covered by appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision like the EU US Data Privacy Framework.

We keep your information while your account is active. Chat messages are kept while their tribe exists so members can follow the conversation, and you can delete your own messages at any time. Private messages are kept until either participant deletes her account. If you delete your account, we permanently delete your personal data, including your profile, location, photos, tribe memberships and the messages you have sent, within 30 days, except where we must keep limited records to meet a legal obligation. Chat photos are deleted from our servers when they expire (24 hours, 3 days or 7 days after sending, as chosen by the sender), when the sender deletes the message, or when the account is deleted. When a message with photos is reported, we keep those photos for the moderation review for at most 30 days from the report, and then delete them. The photos themselves are not kept in backups; database records about them, such as the caption, can remain in our backups for up to 7 days before they are overwritten. When a message is reported, we keep a copy of its text as moderation evidence (for a private message, together with up to 10 earlier messages from the chat), and we may keep this copy even after the message or the account is deleted, for as long as needed to keep the community safe. We may also keep other safety and moderation records, such as reports. Diagnostic and aggregated data that no longer identifies you may be kept longer.

Under the GDPR you can access your data, correct it, delete it, receive a portable copy, and object to or restrict certain processing. You can withdraw consent at any time, and you can delete your account directly from Settings. To exercise any right, email hey@tribumama.app. You also have the right to lodge a complaint with the Spanish Data Protection Agency (aepd.es).

We use reasonable technical and organizational measures to protect your data, including encryption in transit and access controls. No service can guarantee absolute security, so we encourage you to use a strong, unique sign in and to share thoughtfully.

The TribuMama website does not use advertising or cross site tracking cookies. We use only strictly necessary technical storage and privacy friendly, cookieless analytics that do not require a consent banner. The mobile app stores only the data needed to keep you signed in and to remember your preferences on your device, and, only if you allow ad measurement, lets the Meta SDK read your device's advertising identifier.

If you turn on notifications, we store a device token so we can send you updates about your tribes, including new chat messages and private messages. A message notification may show the sender's name and a short preview of the message, which passes through Expo, Apple and Google notification services to reach your device. You can hide these previews or turn notifications off at any time in your device settings, which does not affect the rest of your account.

We may update this policy as the app evolves. When we make material changes, we will let you know in the app or by email, and the current version will always be available here.

For any privacy question or request, contact us at hey@tribumama.app.