Privacy Policy

1. About this policy

Nabudol is operated personally by Mark Christian Yu from the Philippines. For privacy or account requests, contact hellonabudol@gmail.com. This policy describes the current beta with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its principles of transparency, legitimate purpose and proportionality in mind. Publishing a policy is not a certification of compliance.

2. Information we process

Account information includes your email, authentication identifiers and verification status, username, first and last name, optional bio and avatar, and account status. For new members, we record the policy version acknowledged, acceptance timestamp and 18+ self-attestation; we do not collect date of birth for this purpose. Older beta accounts are not treated as having accepted retrospectively. Supabase handles email/password authentication and recovery. When you use Google or Facebook sign-in or linking, identity information can include the provider identifier and email, along with information handled by Supabase for authentication. Nabudol does not intentionally copy social-provider access or refresh tokens into its application social-account records.

Content includes Budols, product names and submitted brand/category/model information, merchant records and listing links, purchase amounts and dates, optional color/size details, experiences, verdicts and verdict history, photos, visibility and hidden-price choices, profile showcases, and influence choices and their history or disputes.

Social and safety records include follows, Budol! reactions, comments, blocks, reports and any report notes, moderation decisions, and timestamps. The Nabudol Din Ako action opens a related purchase flow; publication and any attribution still require your own choices.

We also process search input to provide results, and limited search/creation records to validate product creation and prevent duplicate submissions. Technical information can include request metadata, IP addresses used for abuse limits, cookies, service logs and diagnostic information processed by our infrastructure. Please avoid putting sensitive personal information into story text, images or reports when it is unnecessary.

Purchase amounts and merchant details describe purchases you record yourself. Nabudol does not take payments or request payment-card information.

3. Why information is used

We use information to authenticate you, maintain your account and diary, display the content you choose to publish, provide search and social features, calculate community signals, handle reports and attribution disputes, prevent abuse, troubleshoot problems and understand and improve service usage.

The current application does not implement advertising profiles, targeted advertising or a sale-of-personal-data feature. Analytics is described separately below. Information may also need to be processed or disclosed to meet applicable legal obligations or respond to lawful requests.

4. Public and private are different

Your public profile includes your username, name, bio and avatar, as well as eligible public stories, selected showcases and community information. Public Budols, their visible photos and eligible comments or reactions can be viewed without signing in, linked, shared and potentially indexed by search engines. A follow is not permission to view private content.

Private Budols and their photos are owner-only in ordinary application access. Hiding a price excludes the amount from normal public story output and public damage totals, while keeping it in your own diary and personal totals. Private content is still processed by the service and its providers; these controls are not a promise against every security incident or legally required disclosure.

Making a source Budol private or deleting it hides its source-story details from attribution displays, but the active credited member may still be named on another person’s public Budol. A credited member’s attribution dispute removes that active credit and makes the displayed attribution neutral. Do not use notes or photos to reveal information you intend to hide with a control.

Blocking restricts signed-in access and interactions between the two accounts and removes follows in both directions; unblocking does not restore follows. Historical interactions may remain visible to other eligible viewers. Blocking cannot stop someone from viewing otherwise public material while signed out or from retaining a copy they already obtained. Reports are not displayed as public stories.

5. Essential cookies and session technologies

Essential cookies maintain sign-in, verification/recovery continuity and short-lived action confirmations. Authentication is handled on the server using HTTP-only cookies, which page scripts cannot read. Cookies use secure transport on HTTPS. Nabudol’s browser application does not own the authentication session.

Analytics is optional. Choose Essential only to use Nabudol without Google Analytics, or Accept all to allow analytics. Essential cookies support browsing, registration, sign-in and normal account functionality regardless of that choice. Analytics does not load or send events until you give permission.

Your separate analytics preference is stored in this browser’s local storage, not in Google Analytics or your legal acceptance record. Reopen Cookie settings in the footer to change it. If browser storage is unavailable, the choice applies for the current page session and may need to be made again. Withdrawing analytics permission stops future collection as reliably as practical; it does not retroactively delete data already received by Google. Events and page visits from before permission are not replayed. Disabling essential cookies can prevent sign-in and related features.

6. Google Analytics

With your analytics permission, the production site uses Google Analytics 4 to understand page visits and selected steps such as starting a Flex, searching/selecting or creating a product, publishing a Budol, and choosing Nabudol Din Ako. Local and preview environments do not enable this integration. Analytics permission is separate from the Terms/Privacy acknowledgement required for a new account.

Nabudol’s custom analytics sends only approved event names and sanitized page categories. It excludes usernames, user IDs, product search queries, free-text notes, product URLs, prices and authentication/session data from custom payloads. It does not track policy scrolling or section clicks. These restrictions do not mean Google receives no technical information: Google’s analytics technologies can process cookies, browser/device information, approximate location and interaction data.

The integration disables Google Signals and advertising-personalization signals in code. Automatic collection also depends on the Google Analytics property’s settings; those settings and production collection must be verified separately. These are usage measurements, not an in-app advertising or individual purchase-profiling feature.

7. Services that help run Nabudol

Supabase provides authentication and the PostgreSQL database holding account, content and social records. Google, and Facebook when used, handle social sign-in and provide authentication identity information. Google Analytics processes usage measurements separately from Google sign-in.

Cloudflare delivers and runs the site, provides database connectivity and abuse controls, and stores uploaded images in private R2 storage. Images are served through Nabudol after access checks, rather than from a public bucket. Profile avatars are public profile content even though their storage is private. Image preparation resizes/re-encodes supported photos for display; do not rely on that to remove sensitive information visible in an image.

Account verification and recovery messages are delivered through the authentication service and its configured email delivery provider. External shop links take you to independent services; merely naming a shop or external influence source does not make it a Nabudol processor.

Providers may process or store information outside the Philippines. We do not promise a specific data-center country. Nabudol remains responsible for considering appropriate safeguards and applicable privacy requirements when using these services.

8. Retention, edits and deletion

You can update your profile, edit your Budols, change their visibility or price display, remove photos, delete Budols, and edit or delete your own comments. Budol owners can remove comments on their stories. Shared product records are separate from an individual’s diary and are not deleted simply because a Budol is deleted.

Budol deletion and comment removal hide records from ordinary viewing while retaining underlying records. Verdict and attribution history can also remain. Photo/avatar removal or replacement removes the active reference and attempts storage cleanup; failed cleanup can leave inaccessible stored objects until maintenance. Deleting a Budol does not guarantee immediate deletion of its stored photos.

We retain personal information only for as long as reasonably necessary to provide Nabudol, maintain security and platform integrity, resolve disputes, comply with legal obligations, and establish or defend legal claims. When information is no longer reasonably necessary for these purposes, it may be deleted or anonymized. This purpose-based approach applies to retained content records, histories, media, logs, backups and information held through our providers; it does not promise immediate physical erasure after an in-app deletion.

There is no self-service account deletion or whole-account data export in the current beta. Contact hellonabudol@gmail.com for access, correction, account closure/deletion or other applicable privacy requests. Reasonable identity verification may be needed before action. We assess requests according to applicable rights, obligations and retention needs, and do not promise immediate deletion of every record or independent copy.

9. Your privacy rights

Depending on applicable law and the circumstances, you may have rights to be informed about processing, access your personal information, correct inaccuracies, object to processing, request erasure or blocking, obtain portable data where applicable, and seek remedies for unlawful processing. These rights are subject to the conditions and exceptions in law; they do not imply that every request can be fulfilled immediately or through settings.

Contact hellonabudol@gmail.com to raise a privacy concern or make a request. We may ask for reasonable information to verify your identity and clarify the request before acting. You may also lodge a complaint with the Philippine National Privacy Commission. Do not post identity documents or private account information in a public Budol or comment to make a request.

10. Safeguards and policy changes

The application uses server-side access checks, secure session handling, private image storage and abuse limits. No online system offers absolute security. These measures do not replace operational monitoring, maintenance or appropriate provider safeguards.

The beta is for people aged 18 and above only. We rely on explicit age self-attestation for new accounts, without collecting date of birth. If you believe an under-18 person is using Nabudol or their personal information has been submitted, contact hellonabudol@gmail.com so we can assess appropriate action.

We will update the date on this page when the policy changes and communicate material changes through a prominent service notice or another appropriate channel where required.