BandUp
Privacy policy
Updated 8 October 2026
What we collect
Account identifiers from Apple or Google; the profile you type (name, age, gender, country, city, exam, scores, practice goals); an optional avatar; messages; call metadata (who, when, how long — never audio); device push tokens if you allow notifications; your city name and the country your device is in if you allow when-in-use location (we do not store coordinates); and purchase status from the store / RevenueCat when Premium is live.
How we use it
To run matching, messaging, moderation, account deletion, and (optional) push. We do not sell your messages. We do not record calls. We do not scrape your contacts. If you allow location, we reverse-geocode once during sign-up to pre-select your country and once later to fill your city, then stop; we do not use always-on or background location. The country your device was in is visible only to our moderation team, who may review it when it differs from the nationality on your profile. It is never shown to other users.
AI practice partners
Some profiles show an AI label on the photo. Those are BandUp practice partners, not real students. When you message an AI partner, that chat is sent to OpenAI so the partner can reply. We do not use those chats to train a public model. You can report or block an AI partner the same way as anyone else. AI partners are text chat only and do not take voice calls.
Who sees what
Other students see your name, exam, scores, nationality, and — unless you hide them — city and online status. Band and nationality stay visible. Avatars are shown only after they are marked clean. Staff may review reports, flagged content, and direct messages when they look into a safety concern. We do not sell your messages. Voice calls are never recorded.
How to delete your account
In the app: Profile → Delete account. That is the primary deletion path. This page also explains deletion for Google Play: Delete your account.
Storage
Data is stored with Supabase (region configured for the BandUp project). Push uses Firebase Cloud Messaging only. We do not run a separate custom backend.
Your rights
Depending on where you live (including GDPR and KVKK), you may ask to access or delete personal data. Start with in-app deletion or the public deletion page on this site.
Children
BandUp is not directed at children under 13. If we learn an account is under 13, we delete it.
Contact
Privacy requests and child-safety reports: isaduvan.dev@gmail.com