YDA Ltd (UIC 206471089), established in Bulgaria, is the data controller for your personal data.
a. Account data — email address, username, password (stored hashed by our authentication provider), the fact that you confirmed being old enough and when, your country (suggested from your connection, which you can change), your language and display preferences, your email notification choices, and the profile details you add: avatar, bio, answers to profile questions.
b. Content you create — the messages and photos you put in bottles, your replies (emoji, short answers, letters), and the reports you file.
c. Location data — Bottl is built on real places, so location is involved in several ways:
How precisely any of this is shown to other people is explained in §4.
d. Payment data — Bottl has no paid features today and processes no payment data.
e. Technical & usage data — IP address, device and browser type, the pages you open and a few in-app events (see PostHog, §5a), server logs, and error reports.
f. Cookies / local storage — see our Cookie Policy.
Where the table says contract, the contract is our Terms of Service, which you agree to when you create an account: we need that data to provide the service they describe.
| Purpose | Legal basis |
|---|---|
| Create and manage your account | Contract |
| Carry bottles, let them be found, deliver replies and letters | Contract |
| Show bottles on the map, simulate their journey by wind and current | Contract |
| Translate a message, when you ask for it | Contract |
| Emails about your bottles (found, landed, replies, the Sunday recap) — each can be switched off | Contract; legitimate interest |
| Use your device's location | Consent (device permission) |
| Push notifications | Consent (browser permission) |
| Approximate location from your connection | Legitimate interest (sensible defaults) |
| Moderation, safety, preventing abuse | Legitimate interest; legal obligation |
| Security, diagnostics, error monitoring | Legitimate interest |
| Product improvement / analytics | Legitimate interest (anonymous, cookieless audience measurement) |
We send no marketing emails. You may withdraw consent at any time; this does not affect processing done before withdrawal.
Other users: the essence of Bottl is that a bottle you release can be read by another user (a stranger). Do not put sensitive personal information in a message. Your username, avatar and bio are visible to others. We do not sell your personal data.
Opening a bottle is not anonymous. When you unseal someone else’s bottle, the person who sent it is told that you opened it, and is shown your username; so are the people following that bottle, in their weekly recap. That happens whether or not you write back, and it cannot be undone by staying silent — sealing in silence withholds what you thought of the message, not who read it. The sender also learns where the bottle was lying when you opened it — a spot already shown on the map — never the position of your device.
A bottle never departs, in public, from where you were standing. The spot you launch from is often enough your own doorstep. So wherever your bottle's departure appears to anybody else — the map, the trail of its journey and its milestones, a replay, the list of bottles nearby, a link preview, an email — it is replaced by a decoy point several kilometres away. We do not publish how far, or in which direction, and the decoy is the same on every request, so it cannot be averaged back to the truth by reading a bottle repeatedly. The person who finds your bottle sees the decoy too. Your exact coordinates stay on our servers, where the flight and the drift are computed from them; you still see the real departure on your own bottles.
The departure is also named in words: “near” the nearest town of 15,000 inhabitants or more to where you launched (or the town itself, if you picked it from the list) — or, far from any such town, as coordinates rounded to the whole degree. The places a bottle crosses are named by sea, country or landmark, and no landmark within 30 km of its departure is ever named.
Replies and letters. The place you write from is shown to the other person the same way — as a decoy point, never the real one.
Pinned bottles are different. They stay at the exact spot you choose, and that spot is shown precisely to anyone looking at the map — that is the point of a pin, and the app says so on the screen where you drop one. Only pin public places, never a private home, yours or someone else's. You can report a pin from the bottle itself, without opening it: the report withholds its message immediately and puts it in front of a human, who takes it off the map if it should not be there. You can take one of your own pins off the map at any time, from the bottle itself.
We rely on the following providers, who process data on our behalf or receive data to make features work. Data may be processed outside the EU; where so, we rely on appropriate safeguards (e.g. Standard Contractual Clauses).
Nothing else is loaded from a third party: fonts are served from our own servers, and searching the map or naming a town uses a list of towns that ships inside the app.
Weather, wind, wave, ocean-current and tidal data are downloaded on a schedule (wind roughly every 6 hours, the rest less often) from public scientific sources onto our own infrastructure, and served to you from there. The list of towns the app uses to name a place and to answer the search box is built the same way, and ships inside the app. No user data, coordinates or IP are sent to these sources. They are not processors of your personal data.
One public source is queried live rather than on a schedule. When a drifting bottle comes ashore, our server asks OpenStreetMap — through the Overpass API — for the coastline around the point the simulation put it at, so the bottle comes to rest on a real shore instead of in open water. What leaves our server is that computed drift position: a point the engine arrived at from wind and currents, not anyone's location, sent on its own with no account, name or address attached.
You have the right to access, correct, delete ("right to be forgotten"), restrict or object to processing, data portability, and to withdraw consent. To exercise these, contact hello@bottl.world. You may also complain to your supervisory authority — in Bulgaria, the Commission for Personal Data Protection (cpdp.bg).
You can delete your account yourself, at any time, from your profile panel ("delete my account", at the bottom). No email required, and there is no waiting period — the deletion happens when you confirm it.
What is erased immediately and for good:
What remains: a bottle someone has already opened, with its journey, and the replies and letters exchanged about it. That content is part of another person's experience of the Service, and it stays under the name “someone”, with no link to you. The reports you filed stay too, without your name. If you want any of it removed as well, write to hello@bottl.world and we will handle it case by case.
You must be at least 16 to create an account. Sign-up asks you to confirm it, and we store only that you did and when — we do not ask for your date of birth. We do not knowingly collect the data of anyone under 16, and if we learn we have, we will delete it.
We use reasonable technical and organizational measures (encryption in transit, hashed passwords, access controls). No system is perfectly secure; we cannot guarantee absolute security.
We are based in Bulgaria and process data under EU law. If you use Bottl from outside the EU, your data may be transferred to and processed in the EU and by the providers listed above.
We may update this policy. Material changes will be notified in-app or by email. The "Last updated" date shows the current version.
YDA Ltd · hello@bottl.world · Drujba, bl. 170, ent. B, fl. 7, apt. 67, 1592 Sofia, Bulgaria