1. About TruthBubble
TruthBubble helps people examine factual claims, understand context and review evidence behind information shared online.
This review copy explains information handled by the TruthBubble Android app, website and associated services, how it is used, which service providers may process it, and how people can request access, correction or deletion.
TruthBubble uses automated systems, including AI-assisted analysis, to produce assessments. Results can contain errors or uncertainty and should not be assumed to have received independent human review.
2. Information we handle
Account information
The Android app and the website beta use Firebase Authentication. On the website, a visitor can continue with Google. Firebase processes account identifiers and email information needed to authenticate the account. Website beta access is limited by the analysis service to approved tester accounts. Website subscription management and paid entitlements are not currently enabled.
Content submitted for checking
When a person starts a check, TruthBubble processes the content they submit or share, which can include text, URLs, images, screenshots, videos and supported publicly accessible social-media posts. The current website beta checker accepts written claims or one JPEG, PNG or WebP image per account per day. The current staging backend accepts text, image and supported public Instagram URL submissions; video uploads are not available through the website. Where needed for a requested check, relevant public media, captions, audio, visual material or associated information may be retrieved and processed by TruthBubble and configured providers.
Results and history
The app keeps completed result history on the device in storage associated with the signed-in account. The backend also maintains persistent analysis-job and result records needed to submit work and retrieve results. The website sends an authenticated Firebase ID token to the staging backend for analysis and result retrieval; completed website results are displayed in the current session and are not added to the website's public fact-check-search history.
Problem reports
The in-app "Report a problem" flow can send a report category, optional explanation and related analysis or claim identifiers to an authenticated reporting service. It is intended to help review reported factual or content problems.
Technical and security information
Operating the service can involve request times, IP addresses, error information, usage records and technical diagnostics. The website's early-access limiter stores a keyed hash of the trusted client address in its own shared table rather than the raw address. The authenticated website checker also stores a keyed hash of the Firebase account identifier and a date-bound usage record to enforce its one-check daily limit; it does not store the Firebase ID token in that quota table. This does not establish what hosting or other service providers retain in their separate logs.
Website forms
When early-access signup is enabled, its form can collect name, email address, country, occupation, phone number, operating system, verification interests, social-media usage, platforms, referral source, intended use, plan and billing preference, an optional beta-feedback choice, consent records and campaign attribution such as UTM values, referrer, landing page and a broad user-agent category. Signup is paused by default in the current code; the production setting was not inspected.
The website contact form does not upload its fields to a TruthBubble server. Submitting it opens the visitor's email app with the entered name, email, selected platform and message prefilled for the visitor to send.
3. How information is used
Information is used to authenticate Android accounts, carry out checks requested by users, retrieve relevant evidence, generate and show results, maintain analysis access and history, prevent abuse, enforce usage restrictions, investigate errors, improve reliability, review reports, respond to support and privacy requests, manage testing access and send necessary service communications.
Optional feedback or promotional contact must remain separate from required account or beta-access processing. The current early-access form stores a separate optional feedback choice, but its required consent sentence also mentions feedback contact. Signups remain paused until that wording and the intended choice are approved.
4. When checks run
Checks are user-initiated. The Android app accepts content that a user submits or shares into it. The reviewed Android manifest requests internet access and notification permission and declares share intents; no screen-capture or accessibility-service permission was found. The current app does not continuously record or monitor the user's screen.
The public website checker receives text a visitor submits and searches for related public fact-check reviews; it does not produce an independent TruthBubble verdict. Separately, the authenticated private-beta checker sends text or a single image to the Unified V2.1 staging service when the signed-in user submits it. The current website does not upload video for analysis.
5. Service providers and data sharing
TruthBubble relies on external services to provide its features. Depending on the feature and live configuration, relevant information may be processed by:
- Google Firebase for Android and website authentication and associated account services.
- Railway for the Android backend hosting described for the service.
- OpenAI for AI-assisted automated analysis.
- Configured media-retrieval providers, which can include RapidAPI integrations, to retrieve supported public content submitted for checking.
- Website infrastructure and delivery services, which may include Vercel hosting, PostgreSQL storage, Resend email and a configured webhook when those options are enabled.
Relevant content, account or request information may be sent to these providers to deliver the requested service. TruthBubble does not promise that submitted content is never shared with external processors, and this review copy makes no claim about a provider's independent retention or model-training practices.
Provider names, exact production configuration, data locations, cross-border processing and any analytics or monitoring processors must be checked against the live Android release and deployment. Some provider infrastructure may process data outside India.
6. How we protect information
The Android app is configured to reject cleartext HTTP. Authenticated app requests use Firebase ID tokens, and app history is separated into a local store keyed by the signed-in account. These safeguards do not guarantee absolute security.
Hosting-provider protections, backend administrative access, encryption at rest, production database permissions and the complete operational security process have not been independently verified for this review copy. Avoid submitting passwords, confidential records or unnecessary sensitive personal information for checking.
7. Data retention
After a verified deletion request, the administrator-operated procedure includes Firebase account information, associated account-linked history and associated reports. Limited information may remain temporarily in backups or under a justified retention exception, such as a legal obligation, security requirement, abuse investigation or dispute.
A fixed completion target and fixed backup period are not published in this review copy. The applicable operational details require owner approval and a successful real disposable-account deletion test.
Some app history is stored locally on the device. The device copy is handled separately from the administrator-operated backend deletion procedure.
8. Account deletion and privacy requests
People can open the public account-deletion request page without signing in to the website. Requests are sent to truthbubbleapp@gmail.com and handled manually, not automatically.
TruthBubble must verify account ownership before processing a request. Verified requests are processed through TruthBubble's administrator-operated deletion procedure. The procedure includes Firebase account information, associated account-linked history and associated reports. It does not itself erase local device history, and public source pages or copies held by third parties remain outside TruthBubble's control.
Limited information may remain temporarily in backups or under a justified retention exception. No fixed completion target or backup period is published here while the real disposable-account deletion test and owner approval remain pending.
10. Communications
TruthBubble may send necessary account, security, testing-access and support messages. When configured, the website can send early-access confirmation, team-notification or approved APK emails through its email service. An optional webhook can also receive a submitted early-access record when configured.
Optional beta-feedback contact must be separately chosen and recorded. The present signup wording does not yet express that separation consistently, and no optional promotional subscription is described as active in this review copy.
11. Children's privacy
The minimum age and target-audience classification have not been confirmed for this review copy. The policy must be aligned with the owner's Google Play target-audience selection and the app's actual handling of children's information before publication.
12. External sources
TruthBubble may show links to original posts, public documents, news reports and other third-party websites. Those websites operate under their own privacy practices and terms. Review a source's own information before sharing data with it.
13. Access, correction and other requests
People may ask to access, correct or delete information, withdraw optional feedback consent, or raise a privacy concern by contacting TruthBubble. Account and data deletion requests can be sent to truthbubbleapp@gmail.com without signing in to the website.
Deletion requests are handled manually and require account-ownership verification before processing. Do not include passwords, Firebase identifiers or other credentials in a request. No fixed completion target is published in this review copy.
14. Updates to this policy
TruthBubble may revise its privacy information when the service, providers, data handling or legal requirements change. A final policy must show its effective date. Material changes should be communicated where required.
This page remains a review copy until the owner approves the responsible entity, practices, retention and deletion process, contact details and final wording.
15. Contact
TruthBubble
Website: https://truthbubble.in
General email: hello@truthbubble.in
Account and data deletion requests: truthbubbleapp@gmail.com
Not part of the policy
Owner decisions before approval
The table below identifies operational details that still require approval or verification. It does not publish a completion target or backup period.
| Data | What code/config shows | Decision to approve |
|---|---|---|
| Firebase account | Android sign-in uses Firebase Authentication. Account-deletion requests can be sent to truthbubbleapp@gmail.com without website sign-in and are handled manually after ownership verification. The administrator-operated procedure has passed synthetic tests; a real disposable-account deletion test is pending. | After ownership is verified, process Firebase account information through the administrator-operated deletion procedure. Record any limited backup or justified-retention exception. |
| Analyses and history | The Android app stores result history locally under an account-specific preference store. The backend also keeps persistent job and result records needed to submit work and retrieve results. | Include associated account-linked history and backend records in the verified deletion request. Local device history is handled separately on the device. |
| Problem reports | The app submits a category, optional details and analysis identifiers to an authenticated reporting API. | Include associated reports in the verified deletion request, subject to any justified retention exception that applies. |
| Operational and security logs | The service processes request and diagnostic information. Hosting-provider log settings and actual retention were not available for inspection. | Retain only what is needed for reliability, security and legal obligations, and verify each provider's handling. |
| Shared public-content cache | The product is described as caching eligible public-content analyses while keeping result access scoped to users. Cache expiry and removal behavior were not verified against the deployed backend. | Document cache fields, expiry and removal rules; distinguish public-source cache entries from account-linked records. |
| Backups | Persistent backend records and backups are part of the stated service setup. The production rotation schedule was not available for verification. | Limited information may remain temporarily in backups or under a justified retention exception. Do not publish a fixed backup period until it is approved and operationally verified. |
| Website early-access requests | When enabled, the site stores signup fields in PostgreSQL; development can use a local file. The form is paused by default in the current code, but the production flag was not inspected. | Remove records when the testing purpose ends or after a verified request, subject to justified retention exceptions. Confirm who performs deletion and how it is recorded. |
India's Digital Personal Data Protection Act and Rules have phased commencement dates. Have Indian counsel confirm which provisions and timelines apply to TruthBubble; this review copy makes no blanket compliance claim.