Privacy Policy

Overview

Boba Globe helps users create animated travel map videos. This policy explains what information we collect, how we use it, the service providers involved, and the privacy choices available to you. For privacy requests, Boba Globe can be reached at support@bobaglobe.com.

Who We Are

Boba Globe is built by the team behind Only eSIM. Boba Globe is responsible for the personal information described in this policy unless another provider acts as an independent controller under its own terms. For account, project, support, billing-related, and privacy requests, Boba Globe is the contact point for the service and can be reached at support@bobaglobe.com.

Boba Globe has not named a separate Data Protection Officer, UK representative, or EU representative in this policy. If we appoint one or applicable law requires us to name one, we will update this policy with the required contact details.

Information We Collect

• Account information such as your email address, display name, and authentication provider profile data.
• Project data such as trip names, destinations, routes, imported flight data, visualization settings, thumbnails, and saved exports metadata.
• Route lookup information such as flight numbers, dates, selected flight identifiers, origins, destinations, selected place IDs, route request details, route geometry, and flight track points when you ask for flight, place autocomplete, or directions-route features.
• Commercial and billing information such as Stripe customer and subscription identifiers, plan, status, billing interval, invoices, receipts, renewal state, and cancellation state. We do not store full card numbers.
• Browser storage and preference information such as authentication and session storage, Supabase browser storage, checkout or billing return state, local UI state, and optional editor preference storage if you enable preference storage.
• Technical data such as IP address, browser type, device capabilities, request metadata, rate-limit data, error details, security logs, and limited internal account, project, subscription, or provider event identifiers needed to operate and protect the service.

We collect information directly from you, from your authentication or billing provider when you sign in or pay, and from route providers when you request flight, address, or directions-route features.

A summary of categories, purposes, retention criteria, and California-style notice-at-collection details is available in our Privacy Notice At Collection.

Cookies And Local Storage

We use essential cookies and browser storage to provide authentication, Supabase session handling, security, checkout and billing access, and saved UI state. Optional editor preference storage is off by default and can be enabled, disabled, or cleared and disabled from our Cookie Policy. We do not currently use third-party advertising cookies or behavioral advertising trackers.

How We Use Information

• Provide the editor, saved projects, exports, authentication, and subscription features.
• Process upgrades, manage billing access, and enforce Free and Pro feature limits.
• Protect the service against abuse, troubleshoot errors, and improve performance.
• Communicate account, security, billing, and product updates.

Communications

We send service, transactional, billing, security, privacy, accessibility, and support emails when needed to provide Boba Globe, authenticate accounts, process subscriptions, send invoices or receipts, deliver renewal reminders or price-change notices where required by law, respond to requests, and protect the service.

Boba Globe does not currently send marketing newsletters or third-party promotional email campaigns. We may operate invitation-only creator or affiliate programs that use one-time invite links, creator promo codes, Stripe checkout attribution, and payout records to administer program access, audience discounts, and creator commissions. Before adding unrelated marketing emails, newsletters, or broad promotional messaging, we will update our public notices where needed and provide consent, opt-out, unsubscribe, or other controls required by applicable law.

Purposes And Legal Bases

If the GDPR, UK GDPR, or similar privacy laws apply, our legal bases include providing and performing the service contract, our legitimate interests in securing Boba Globe, preventing abuse, rate limiting, troubleshooting, and improving the service, complying with legal obligations such as tax and accounting rules, and consent where required for optional communications or non-essential cookies.

• Account creation, sign-in, saved projects, exports, and requested route features: contract necessity for signed-in features and requested services, plus legitimate interests in reliable service operation and abuse prevention.
• Checkout, subscriptions, invoices, receipts, taxes, accounting, refunds, chargebacks, and disputes: contract necessity, legal obligations, and legitimate interests in billing integrity and dispute handling.
• Invitation-only creator and affiliate programs: contract necessity and legitimate interests for creator access, promo-code attribution, commission calculation, payout administration, abuse prevention, and accounting records.
• Security, fraud prevention, rate limiting, debugging, service integrity, and incident response: legitimate interests in protecting Boba Globe, users, and paid features, and legal obligations where security or financial records must be kept.
• Service emails, lifecycle notices, and support responses: contract necessity for authentication, billing, subscription, security, and account notices; legitimate interests for support and service reliability; and legal obligations where notices are required.
• Optional editor preference storage or future non-essential storage: consent where required by law, with controls described in our Cookie Policy.

Account email and session data are required to provide signed-in features. Payment information is required to buy Pro. If you do not provide information required for an account, saved project, route lookup, or payment, the related feature may not work.

Our legitimate interests are operating, securing, debugging, protecting, supporting, and improving Boba Globe in ways users reasonably expect, while limiting collection and retention to what is needed for those purposes.

Service Providers

We use service providers including Supabase for authentication, database, storage, and session handling; Stripe for checkout, payments, invoices, billing portal access, and subscription status; AWS SES or similar email providers for authentication and lifecycle emails; Vercel, CloudFront, or similar hosting and CDN providers for app and asset delivery; an npm package CDN such as unpkg if FFmpeg fallback export code is enabled and your browser loads it; Flightradar24 when you request flight route features; Geoapify when you request enabled place autocomplete, geocoding, or driving/transit route features; BusMaps when you request enabled transit route features; and Google Maps Platform only if approved Google directions-route features are enabled and requested.

More detail is available on our Service Providers And Subprocessors page.

Video exports are processed in your browser where possible. If the FFmpeg fallback exporter is enabled and used, your browser may download FFmpeg core JavaScript and WebAssembly assets from a package CDN; that request can expose technical request metadata to the CDN, but Boba Globe does not send your project frames to that CDN for encoding.

If you use enabled Geoapify route features, the search query, origin, destination, selected place details, route mode, and route request details are sent to Geoapify to return autocomplete suggestions, geocoding results, and route geometry. Geoapify processes that information under the Geoapify Privacy Policy. If you use enabled BusMaps transit route features, origin and destination coordinates, selected place details, route mode, and route request details are sent to BusMaps to return public-transit route geometry and timing. BusMaps processes that information under the BusMaps Privacy Policy. If the optional Google Maps provider is enabled and requested instead, Google processes route and place information under the Google Privacy Policy.

Boba Globe Pro is billed by Only eSIM through Stripe. Receipts, invoices, statement descriptors, and the hosted billing portal may show Only eSIM while Boba Globe remains the service you are subscribing to.

Sharing

We do not sell personal information, share personal information for cross-context behavioral advertising, use personal information for targeted advertising, or use personal information for profiling that produces legal or similarly significant effects. We share information with service providers as needed to run Boba Globe, comply with law, prevent abuse, process payments, send service emails, or complete actions you request.

Legal Requests And Safety

We may preserve or disclose information if we believe in good faith that it is required by law, valid legal process, legal obligation, security or abuse prevention needs, protection of users or providers, or an emergency involving risk of harm. We review legal requests for authority, validity, scope, date range, conflicts, cross-border public-authority requirements, and user privacy impact; seek to narrow overbroad requests where appropriate; and notify affected users where legally allowed. More detail is available on our Legal Requests page.

Business Purpose Disclosures

Boba Globe discloses personal information to service providers and recipients for business purposes such as authentication, hosting, storage, security, debugging, support, payment processing, subscription management, email delivery, asset delivery, and requested route features. We do not disclose full card numbers because Stripe processes payment-card data on Stripe-hosted surfaces.

• Identifiers and account information: disclosed to authentication, database, hosting, email, security, and support providers.
• Project content and saved visualization information: disclosed to database, storage, hosting, CDN, and support providers; route lookup and geolocation-like route information is disclosed to Flightradar24, Geoapify, BusMaps, or Google Maps Platform only when you request those features.
• Commercial and billing information: disclosed to Stripe and the shared Only eSIM Stripe account for checkout, subscriptions, invoices, receipts, fraud prevention, disputes, and tax or accounting obligations.
• Internet, device, and security information: disclosed to hosting, CDN, database, logging, security, and infrastructure providers to deliver, debug, protect, and monitor the service, including limited internal account, project, subscription, or provider event identifiers in structured operational logs.
• Browser storage and preference information: processed in your browser and disclosed to authentication/session providers, hosted checkout and billing providers, hosting, CDN, database, logging, security, and infrastructure providers as needed for sign-in, security, checkout and billing access, local UI state, and optional editor preferences if you enable them.

For the 12 months before the last updated date above, Boba Globe has not sold personal information, shared personal information for cross-context behavioral advertising, or used personal information for targeted advertising. We have disclosed the categories described above to service providers and recipients for the business purposes described in this policy.

Sensitive Personal Information

Boba Globe does not ask for government identifiers, health information, biometric identifiers, or full payment-card details. Travel routes, precise places, flight tracks, and account login data can still be sensitive depending on how you use the service. We use that information to provide requested features, protect accounts, process payments, and meet legal obligations; we do not use it to infer sensitive characteristics or for cross-context behavioral advertising.

Boba Globe does not use or disclose sensitive personal information for purposes that require a right to limit under the CCPA, such as cross-context behavioral advertising, profiling, or inferring characteristics unrelated to the features you request.

Boba Globe is not a health app and does not ask for consumer health data. We do not use route, place, flight, or project information to identify, infer, rank, or target a person's physical or mental health status, health-care choices, reproductive or gender-affirming care, or visits to health-related locations. Please do not send unnecessary health, biometric, government-id, financial-account, or similar sensitive information in project names, support requests, or privacy requests.

Boba Globe does not collect device GPS data or background location. Route and place information is entered, imported, or requested by you for creative map visualization features.

International Transfers

Boba Globe and our service providers may process information in the United States and other countries where we or they operate. If you are in the EEA, UK, Switzerland, or another region with transfer rules, your information may be transferred to countries that may not provide the same level of protection as your home jurisdiction.

Where privacy laws require transfer safeguards, we rely on lawful transfer mechanisms such as adequacy decisions, the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, provider data-processing terms, transfer-risk assessments, and supplementary technical, contractual, or organisational measures where appropriate. Provider references are listed on our Service Providers And Subprocessors page.

Retention

We keep account and project data while your account is active or as needed to provide the service. Billing, security, support, and transaction records may be retained as required for accounting, tax, fraud prevention, dispute, and legal obligations. Server logs are kept for the period needed to secure and operate the service unless a longer period is required for an investigation or legal obligation. We maintain an internal retention schedule to review, delete, or anonymize personal information when it is no longer needed.

Your Privacy Rights And Choices

You can update profile information, delete saved projects, manage billing through Stripe, review our Billing Policy, or request account deletion by contacting Boba Globe support at support@bobaglobe.com from the email address on your account. Account deletion requests include deleting or anonymizing account profile data and saved project data unless retention is required for billing, fraud prevention, security, tax, legal, or dispute obligations.

We review deletion and erasure requests under applicable law. Where required, we delete or anonymize active account, project, and user-owned thumbnail information, assess whether affected service providers or recipients need notice, and explain any retained categories and reasons. Some retained records, backups, and provider systems may follow secure deletion, restoration-suppression, or provider-deletion cycles instead of immediate physical deletion.

Depending on where you live, including under the GDPR and UK GDPR, you may have rights to request access, correction, deletion, portability, restriction, objection, or withdrawal of consent. California residents may also have rights under the California Consumer Privacy Act (CCPA) to request notice of categories of personal information collected, used, disclosed, or retained, and to opt out of sale or sharing if those activities occur. We do not sell or share personal information for cross-context behavioral advertising.

For correction or completion requests, tell us what account, profile, subscription-status, or project information you believe is inaccurate or incomplete and the corrected value. We will review the request under applicable law, may ask you to update project content directly where self-service editing is available, and will explain the decision and any required appeal or complaint routes if we cannot make the requested change.

Where applicable law requires portability, we provide portable information in a structured, commonly used, machine-readable format after verification. If you ask us to transmit portable information directly to another service, we will review whether the transfer is technically feasible, lawful, and secure before doing so.

For subject access requests, where applicable law requires, we confirm whether we process your personal information, provide a copy of the personal information we can disclose, and include supplementary information about purposes, categories, recipients, retention, rights, complaint routes, sources, and transfer safeguards. We may ask you to clarify a broad or unclear request, and we may redact or withhold another person's information unless disclosure is legally allowed. We provide access responses through a concise, intelligible, and secure support path.

If you ask us to restrict processing, we will review whether restriction is available under applicable law, such as while we check contested accuracy, while an objection is pending, where processing is unlawful and you prefer restriction to deletion, or where you need information preserved for a legal claim. If restriction applies, we will limit active use of the affected information except where the law permits continued processing.

Where we rely on legitimate interests, you may object to processing based on your particular situation. We will review the objection under applicable law and explain whether we will stop, limit, or continue the processing because a permitted exception applies. Boba Globe does not currently use personal information for unrelated direct marketing; if that changes, you may object to direct marketing at any time and we will stop direct-marketing use as required by law.

Other U.S. state privacy laws may also provide rights to confirm processing, access, correct, delete, port, opt out of targeted advertising, opt out of sale, opt out of certain profiling, or appeal a denied privacy request where those rights apply. Boba Globe does not currently use personal information for targeted advertising or for profiling that produces legal or similarly significant effects.

If an applicable U.S. state privacy law gives you the right to appeal a denied request or complain to a state attorney general or privacy regulator after an appeal decision, our response will include the appeal result and any regulator complaint instructions required by that law.

You do not pay a fee to submit a privacy request. Where applicable law allows, if a request is manifestly unfounded, excessive, repetitive, or asks for extra copies, we may ask for clarification, refuse to act, or charge a reasonable administrative fee. If we refuse a request or charge a fee, we will explain the reason and include appeal or complaint routes where required.

You can withdraw optional editor preference storage consent at any time by disabling optional editor preference storage or using the clear-and-disable control on our Cookie Policy page, using the same control surface that enables it. Withdrawal applies going forward, does not affect processing based on consent before withdrawal, and does not disable storage required for authentication, checkout, billing, security, or saved-project features.

California residents may also have rights to correct inaccurate personal information, limit certain uses of sensitive personal information, use an authorized agent, and be free from unlawful discrimination for exercising privacy rights. Where applicable law requires us to honor Global Privacy Control or another legally recognized universal opt-out mechanism or opt-out preference signal, we treat the signal as an opt-out request and publish a machine-readable GPC support resource at /.well-known/gpc.json. Because Boba Globe does not sell personal information, share personal information for cross-context behavioral advertising, or use personal information for targeted advertising, those signals do not change our current sale, sharing, or targeted-advertising practices.

To exercise a privacy right, email support@bobaglobe.com. We may ask you to verify your account email, or to provide proof of authorization for an agent, before completing the request. For authorized agent requests, we may also ask you to verify your own identity directly or confirm the agent's permission where applicable law allows. We respond within the timeframes required by applicable law, including GDPR/UK GDPR and CCPA timing plus other U.S. state privacy timing where those laws apply. If you are in the EEA, UK, or Switzerland, you may also lodge a complaint with your local data-protection authority.

Step-by-step request instructions are available on our Privacy Requests And Choices page.

Security

We use access controls, row-level database policies, HTTPS, and provider-managed security features. No internet service is perfectly secure, so you should only upload route and travel data you are comfortable processing through the service. Security questions and vulnerability reports can be submitted through our Security Policy.

Children

Boba Globe is a general-audience service and is not directed to children under 13. You must be at least 13 to use Boba Globe. If local law requires a higher age, parent or guardian consent, or another age-related condition for online services, you must meet that requirement before using Boba Globe.

We do not knowingly collect personal information from children under 13 or from anyone below the local age where required consent or permission is missing. If you believe a child provided personal information to Boba Globe, contact support@bobaglobe.com. We will review the report and delete, disable, or otherwise handle the information as required by applicable law.

Automated Decisions

We do not make legal or similarly significant decisions about users using solely automated processing, and we do not use automated processing or AI to make employment, credit, housing, insurance, health-care, legal, or similarly significant decisions. Automated checks may enforce authentication, abuse prevention, plan limits, payment status, and feature access.

Changes To This Policy

We may update this policy as Boba Globe changes or legal requirements evolve. The date above shows when this policy was last updated. If we make material changes or plan to use personal information for a new purpose, we will update this policy and provide notice where required before starting the new processing.

Contact

Questions about this policy can be sent to Boba Globe support at support@bobaglobe.com.