Privacy policy
Bubble Simulator (formerly Bolhas Musicais) is a tool to create bouncing-ball simulation videos and publish them to your social accounts. The service is run by an individual based in Brazil, who is the controller of the data described here. This policy explains what data we use, why, and how to request access or deletion.
Data we collect
- Account: name, username, email, password (stored only as a hash, never in plain text) and preferred language.
- Instagram: when you sign in with Instagram, we receive the account ID, username, name, profile picture, account type and an access token. We use them to publish the videos you request and to read the metrics (views, reach, likes, comments, shares and saves) of posts made through the app.
- Google / YouTube: when you sign in with Google, we receive your ID, email, name, picture, YouTube channel data and access tokens. We use them to upload the videos you request to your channel and read those videos' statistics.
- TikTok: when you connect TikTok, we receive the account ID (open_id), display name, profile picture and access tokens. We use them to post the videos you request (with the visibility and options you choose at posting time) and to read the statistics (views, likes, comments and shares) of videos posted through the app.
- Waitlist: on the sales page we store your email, name (optional), plan of interest, where you post, language and how you arrived (referral link). We use it to confirm the signup, announce the launch and hold the Founder spot.
- Subscription: plan, price, currency, status and the subscription IDs at the payment provider. We never receive or store card data: payment is entered on Mercado Pago's page (BRL) or Lemon Squeezy's page (USD).
- AI requests: the text you write for the AI to create a video and the cost of each request, used to deduct credits.
- Videos: videos you export and send for publishing are stored on our server and available through a public link, which Instagram and TikTok use to fetch the video.
- Sales page visits: counted per day, source and language, with no cookie and no stored IP address.
Emails
We only send emails tied to something you did: waitlist confirmation, launch notice, subscription receipts and notices (activation, renewal, cancellation, declined payment), password reset and low-credit notices. To leave the waitlist, reply to any of our emails or write to [email protected].
What we do not do
We do not sell data, use tracking or advertising cookies, publish anything without your action, or read messages, followers or other content in your accounts.
Third-party services (processors)
- Meta (Instagram), Google (YouTube) and TikTok: publishing and metrics, through their official APIs.
- Anthropic: processes the text of AI requests to generate the video scene.
- Mercado Pago and Lemon Squeezy: subscription billing. Lemon Squeezy is the merchant of record for USD sales and handles the sales taxes on them.
- Resend: delivery of platform emails.
- Cloudflare: DNS and forwarding of contact emails.
Some of these services are located outside Brazil (mainly in the United States); data is transferred to perform our contract with you. By using YouTube features you agree to the YouTube Terms of Service and the Google Privacy Policy. Use of data received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Legal bases and retention
We process data to perform the contract (account, publishing, subscription), to meet legal obligations (payment records) and, for the waitlist, based on your consent. Account data is kept while the account exists; payment records for the period required by law; waitlist data until launch or until you ask to leave.
Your rights
You can request access, correction, a copy or deletion of your data, or withdraw consent, under Brazil's LGPD and, for people in the European Union, the GDPR. Write to [email protected]; we reply within 15 days.
Removing access and deleting your data
Use the Disconnect button in the app: that account's tokens are deleted immediately. You can also revoke access in the Google permissions page, in Instagram settings (Apps and websites) or in TikTok (Settings and privacy > Security > Apps and services). To also delete videos and publishing history, see Data deletion or write to [email protected].
Storage and security
Data is kept on our own server, accessible only to the service owner, over HTTPS. Tokens are kept while the account is connected. Passwords are stored only as a hash (PBKDF2).
Contact: [email protected] · Last updated November 9, 2026