Privacy Policy

Effective Date: October 27, 2026

Privacy and trust matter to how we build BoomBoom. Creators share their photos and posts here, and protecting them, and you, is part of the job.

Whether you’re a creator building an audience or someone unlocking premium posts, you deserve to know what we do with your data. This policy explains what we collect, why we collect it, and the security measures protecting it — written in clear, direct language.

By using BoomBoom, you agree to the practices outlined in this policy. If you have questions about our privacy practices, contact us at support@boomboom.email.

Accessing this policy:
In the app: Settings → Privacy Policy
On the web: boomboomhq.com/privacy-policy

A note on our website:
Our website (boomboomhq.com) shows information about BoomBoom and previews of public profiles and posts opened from share links. The one place it collects personal information is the intimate-image removal form: we keep what you enter there (your name, email, signature and description) and the IP address you send it from with your request, to handle it and to show we met our legal obligations (see Section 5). We do not deploy behavioral tracking cookies, cross-site telemetry, or advertising pixels. To ensure global availability and platform protection, our web traffic utilizes standard secure edge infrastructure that processes basic server requests. This Privacy Policy primarily details data processing within the BoomBoom application experience.

What Information We Collect
How We Use Your Information
Who We Share Your Information With
Advertising and Analytics
How Long We Keep Your Data
How We Protect Your Data
Kids and Teen Privacy
Your Rights and Choices
California Residents
Do Not Track
Third-Party Services
Updates to This Policy
Get in Touch

1. What Information We Collect

We only collect what we actually need to make BoomBoom work for you.

1.1 What You Give Us Directly

Account details: Your email address, username, date of birth, and the profile photos you add.
Your content: The posts you make: their photos, titles and descriptions, and settings such as price, blur, expiry date and copy limit.
Payment info: If you buy Lux (our in-app currency), Apple handles your payment — we never see your card details. If you’re a creator getting paid out, we collect your PayPal account info when you link your account through the Earnings Dashboard in the BoomBoom app, and any tax documentation required by law.
Support messages: If you contact us, we keep a record of that conversation so we can help you properly.
Ratings and feedback: Any ratings or reviews you leave on content.

1.2 What We Collect Automatically

When you use the app, some information is collected automatically to keep things running smoothly and securely:

How you use the app: The posts you unlock and rate, the accounts you follow or block, and the reports you send.
Your device: Device model, iOS version, and app version. We don’t collect advertising IDs or other device identifiers.
Technical info: The IP address you sign up from (used for fraud and abuse checks, and to understand your general region), and your device’s language/region setting and time zone.
Transaction history: Records of Lux purchases, content unlocks, and creator payouts.

1.3 What We Receive From Third Parties

Apple sends us basic information about your in-app purchases and app interactions. Please note that Apple collects certain device and usage data independently through iOS, governed by Apple’s own privacy policy. This data is collected by Apple, not BoomBoom, and is subject to Apple’s privacy practices.
Apple’s age range: on iOS 26.2 and later, where the law requires it, Apple may ask whether to share your age range with BoomBoom (for example 13–15, 16–17 or 18+, and how it was confirmed). If you or your parent share it, we keep that answer with your account and use it only to enforce age limits, such as the 18+ rule for paid features; if it is stricter than the date of birth you typed, the stricter one applies. You can decline to share. We delete it when your account is deleted.
PayPal confirms the status of your payout account and transaction results when you’re a creator receiving payments.

2. How We Use Your Information

Here’s exactly why we collect your data and what we do with it:

To run the app — process transactions, deliver payouts, show you content, and keep your account working.
To keep your account safe — verify who you are, enforce age limits, and catch any suspicious activity.
To stay in touch with you — send account notifications, payout confirmations, and replies to your support requests.
To keep the platform healthy — detect fraud, enforce our Terms and Community Guidelines, and stop bad actors.
To make BoomBoom better — look at aggregated numbers (like how many posts are unlocked) that don’t identify anyone.
To follow the law — respond to legal requests and meet tax reporting obligations.

We only process your information when we have a legitimate reason to — like fulfilling your requests, keeping the platform safe, or meeting our legal obligations.

We do not sell your personal information.

We only share your data in the following specific situations:

3.1 Our Service Providers

A small number of trusted companies help us run BoomBoom. They can only use your data to do their job for us — nothing else:

Apple — Handles the App Store and in-app purchases. Apple’s Privacy Policy
- Refund requests (only if you opt in): if you turn on “Share purchase usage with Apple” and later ask Apple to refund a Lux purchase, we tell Apple whether the Lux were delivered and how much of that purchase you had already spent on unlocks, so Apple can decide the refund. Nothing else is shared, and you can turn it off at any time in the app. Requests to access or delete that data go to Apple at privacy.apple.com.
PayPal — Processes payouts for creators. PayPal’s Privacy Policy
Google Cloud and Firebase — Store your account, posts and photos, run our servers, and handle sign-in. Google’s Privacy Policy
Google Cloud Vision — Checks uploaded photos for nudity and violence (SafeSearch). Google’s Privacy Policy
Microsoft PhotoDNA — Checks uploaded photos against known child sexual abuse material. Microsoft’s Privacy Statement
Cloudflare — Runs our website, our photo-removal request form, and the tools our team uses to review reports. Cloudflare’s Privacy Policy
Zoho Mail — Sends our emails to you, such as payout and account notices. Zoho’s Privacy Policy
ipify — When you sign up, the app asks ipify (api.ipify.org) for your public IP address, so ipify sees that address. ipify
Slack — Sends internal alerts to our team when something needs attention (for example, a report nearing its deadline). Alerts contain IDs and counts, not your photos. Slack’s Privacy Policy

3.2 When the Law Requires It

Sometimes we may be legally required to share information — for example, in response to a court order, government request, or to prevent fraud or harm. We’ll only do this when we genuinely have to. This includes the reports federal law requires us to make to the National Center for Missing & Exploited Children (NCMEC) when we find apparent child sexual abuse material.

In cases where we are required by law to cooperate with law enforcement — including under the Fight Online Sex Trafficking Act (FOSTA) and Stop Enabling Sex Traffickers Act (SESTA) and applicable federal trafficking laws — we may be required to retain certain data beyond our standard retention periods.

3.3 If BoomBoom Is Ever Sold

If BoomBoom is ever acquired, merged with another company, or goes through a significant business change, your information may be transferred as part of that process. We’ll notify you if this happens and explain how it affects you.

3.4 What’s Public on Your Profile

Anything you choose to make public — like your username, profile picture and posts — can be seen by anyone: in the app, even without an account, and through share links on boomboomhq.com, which anyone with the link can open without an account. A share link shows your username, profile picture, rating, follower counts, and each post’s title, description, cover photo, price and rating (a blurred cover shows only its blurred copy, and a blurred description is never shown). Only share what you’re comfortable making publicly available.

3.5 With Your Permission

If we ever want to share your data in a way not covered above, we’ll ask you first.

4. Advertising and Analytics

4.1 No Ads Right Now

We do not show any ads in the app and we don’t share your personal data with advertisers.

4.2 Ads in the Future

We don’t run ads right now. If that ever changes, we’ll update this policy and let you know before anything goes live. Any future advertising will comply with applicable privacy laws, and we’ll provide opt-out options where required.

4.3 No Analytics or Tracking Tools

The app contains no advertising, analytics or crash-reporting tools, and we don’t track you across other companies’ apps or websites.

5. How Long We Keep Your Data

We don’t hold onto your data longer than we need to. Here’s a breakdown:

Your account information is kept for as long as your account is active, plus a reasonable period afterward to handle any legal, tax, or support needs.
Financial records (purchases, payouts, transaction history) are kept for a minimum of 7 years as required by tax and financial regulations.
Aggregated statistics (like total unlocks) may be kept indefinitely — they can’t be tied back to you. Truly anonymized or aggregated data that cannot reasonably be used to identify you is no longer considered personal information and is not subject to this Privacy Policy.
Creators who delete their account with earnings we still owe: we keep your PayPal account ID (not your PayPal email) so we can send that payout.
Support conversations are kept for up to 3 years.
Child-safety reports: when we report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC), we preserve the reported content and related account information for at least one year from the date of our report, as required by 18 U.S.C. § 2258A. It is stored securely with access limited to the staff who need it.
Intimate-image removal requests: we keep removal requests and records of how we handled them to show we met our legal obligations. Removed content is hidden from the app and kept with restricted access until it’s no longer needed for legal purposes.
Backups: we keep automatic backups so we can recover from mistakes or outages. Data you delete (or that we delete) may remain in these encrypted backups for up to 14 days before it is erased automatically. We don’t restore deleted accounts from backups.
Safety and fraud records: if you delete your account, we keep what we need for safety, fraud prevention and disputes, linked to an internal account ID: for example records of bans and strikes, reports, block lists, and purchase and unlock records.
Content you’ve posted that other users have unlocked may remain accessible to those users even after you delete your account, as outlined in our Terms of Service.

When we no longer need your data, we delete or anonymize it securely.

6. How We Protect Your Data

We take reasonable steps to protect your information, including:

Encrypting your data in transit using SSL/TLS
Securing your credentials with hashed storage
Limiting access to your personal data to only the people who need it
Using trusted infrastructure — Apple and PayPal maintain strong security practices of their own, and Google Cloud (Firebase), which hosts our data, encrypts it at rest

That said, no system is 100% secure. If you ever suspect your account has been compromised, please reach out to us immediately at support@boomboom.email. If we ever experience a data breach that affects your information, we’ll notify you as required by law.

Biometric Data: We do not collect biometric information. Any biometric authentication (such as Face ID) used to access the app is processed entirely by Apple and iOS — we never receive or store biometric data.

7. Kids and Teen Privacy

We care a lot about protecting younger users.

7.1 Under 13: Not Allowed

BoomBoom is not for children under 13, and we do not knowingly collect any personal information from them. If we find out a child under 13 has created an account, we’ll delete the account and associated data promptly (within 72 hours).

Our retention policy for children’s information. If we learn that a user is under 13, we terminate the account and delete the personal information we collected from them — their profile, photos and posts, username, email address, date of birth, any age range Apple shared, device information, and follows — within 72 hours (usually within a few hours). Copies in our automatic backups are erased within 14 days and are never restored. We collected that information only to provide the app, and we have no business need to keep it once we know the user is under 13. We keep a minimal record that a deletion took place (an internal account ID, the date, and the reason) so we can show we met our legal obligations. Records of Lux the child bought or spent, which we must keep for tax and accounting, and any reports the child sent (including what they wrote in them) stay linked only to that internal ID, not to the child’s name, email address, username or date of birth. If the account is also subject to a legal preservation requirement (for example, a report to the National Center for Missing & Exploited Children), the preserved information is kept securely, with restricted access, only for as long as the law requires.

If you believe a child under 13 has signed up, please report them through the in-app reporting tools, or let us know at support@boomboom.email and we’ll look into it promptly. When submitting a report, please include the suspected account username and your reasoning to help us review it efficiently. Reports submitted without this information may take longer to process.

7.2 Ages 13–17: Extra Protections

Teens between 13 and 17 are welcome on BoomBoom, but we apply additional protections:

No pricing their posts, or receiving real money earnings to their account
No linking any payout methods, or receiving real money payouts
We never use their data for behavioral advertising
We never share their information with third parties for advertising or marketing purposes.

We use the same service providers (Section 3.1) for all users, including minors, and only to run the app.

If you’re a parent or guardian and have questions about your teen’s account, email us at support@boomboom.email for assistance with access, corrections, or deletion requests.

8. Your Rights and Choices

You’re in control of your data. Here’s what you can do:

8.1 See Your Data

You can request a copy of the personal information we have about you at any time. Just email support@boomboom.email.

8.2 Correct Your Data

You can update most of your account information directly in the app’s settings. If you need help correcting something, contact us and we’ll assist you.

8.3 Delete Your Data

You can delete your account anytime from the app’s settings, or by emailing support@boomboom.email. We’ll remove your data, except what the law requires us to keep or what we need for safety, fraud prevention and disputes (for example purchase records, reports and ban history — see Section 5).

If you’ve given us consent for something specific and change your mind, you can withdraw it anytime through your in-app settings or by contacting us. This won’t affect anything we’ve already processed.

8.5 How to Reach Us About Your Rights

Email us at support@boomboom.email or write to us at BoomBoom LLC, P.O. Box 4413, Blue Jay, CA 92317, United States. To ensure we can respond to your request, please include a valid email address in any written correspondence — we respond to all privacy requests electronically. We’ll get back to you within 45 days. We may ask you to verify your identity before we process certain requests — this is just to make sure we’re protecting your data from unauthorized access. We’ll never penalize you for exercising your rights.

9. California Residents

If you live in California, you have additional rights under the CCPA, CPRA, and CalOPPA.

9.1 What We’ve Collected in the Last 12 Months

Identifiers: Email address, username, account ID, IP address
Personal records: Date of birth, Apple age range (if shared), PayPal account info (creators only)
Commercial info: Purchase history, transaction records, payout history
App activity: Unlocks, ratings, follows, blocks and reports
Your content: Photos, post titles, and the reports and appeals you write
Inferences: None. We don’t build profiles of your interests.

9.2 Your California Rights

You have the right to:

Know what personal information we collect and how we use it
Delete your personal information (with some legal exceptions)
Correct inaccurate information we have about you
Opt out of the sale or sharing of your data — we don’t do either, but you can still request this formally
Limit use of sensitive personal information to only what’s needed to run the Service
Not be discriminated against for exercising any of these rights

Sensitive Personal Information: Under the CPRA, “sensitive personal information” includes your account login credentials, precise geolocation data, and financial information. We use sensitive personal information only as necessary to provide the Service and do not use it for inferring characteristics about you beyond what is necessary to operate the platform.

9.3 We Don’t Sell Your Data

We do not sell your personal information and we do not share it for cross-context behavioral advertising. If you’d still like to submit a formal “Do Not Sell or Share” request, email us at support@boomboom.email.

9.4 Shine the Light

Under California Civil Code Section 1798.83, you can ask us whether we share personal information with third parties for their direct marketing. We don’t do this without your consent, but feel free to ask at support@boomboom.email.

9.5 Teen Erasure Rights (Under 18 in California)

If you’re under 18 and a registered BoomBoom user, California law gives you the right to request removal of content you’ve publicly posted. Email support@boomboom.email to make a request. Note that we can remove it from BoomBoom but can’t guarantee removal from every corner of the internet.

9.6 How to Submit a California Privacy Request

Email us at support@boomboom.email or write to BoomBoom LLC, P.O. Box 4413, Blue Jay, CA 92317, United States. We’ll respond to verified requests within 45 days. If we need additional time (up to 90 days total), we will notify you within the initial 45-day period and explain the reason for the extension.

Mail requests MUST include your registered BoomBoom email and account username so we can locate and verify your account.

10. Do Not Track

Some browsers and devices send “Do Not Track” (DNT) signals. Our app doesn’t currently respond to DNT signals because there’s no agreed-upon standard for how to handle them. BoomBoom doesn’t track you across other companies’ apps or websites (see Section 4.3).

11. Third-Party Services

BoomBoom may link to or integrate with third-party services. Once you leave our app or interact with a third-party service, their privacy policy governs — not ours. Here are the third-party services we currently use:

Apple (App Store & In-App Purchases): Privacy Policy
PayPal (Payout Processing): Privacy Policy
Google Cloud and Firebase (hosting, sign-in, Cloud Vision photo checks): Privacy Policy
Microsoft PhotoDNA (photo safety checks): Privacy Statement
Cloudflare (website and internal tools): Privacy Policy
Zoho Mail (email): Privacy Policy
ipify (IP address lookup at sign-up): Website
Slack (internal team alerts): Privacy Policy

12. Updates to This Policy

We may update this Privacy Policy as our app evolves. When we make meaningful changes, we’ll let you know — either through a notification in the app or an email to your registered address. The “Effective Date” at the top will always show when it was last updated.

If a change significantly affects how we handle your data, we’ll give you advance notice and, where required, ask for your consent. Continuing to use BoomBoom after an update means you’re okay with the new policy. If you’re not, you can always delete your account.

13. Get in Touch

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

BoomBoom Support
Email: support@boomboom.email
Legal: legal@boomboom.email
Mailing Address: BoomBoom LLC, P.O. Box 4413, Blue Jay, CA 92317, United States

We aim to respond to every inquiry, though response times may vary. For formal privacy requests, we will respond within 45 days as required by law.

Last updated: October 27, 2026