Privacy Policy
Last updated October 13, 2026
Gabbex is run by Jeva Technologies OPC, a company registered in the Philippines ("we", "us"). This policy explains what personal data we collect when you use the Gabbex apps, the web app at app.gabbex.com and this website (together, "Gabbex"), why we collect it, and what you can do about it. We process personal data under the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.
What we collect
Information you give us
- Account details: your email address and password. We store only a one-way hash of the password, never the password itself.
- If you continue with Facebook: Facebook tells us your Facebook user ID for our app, your name, your email address and your profile picture. We keep the ID to recognise you next time and the email address as your account email, and we copy the profile picture as your Gabbex photo if you don't already have one (you can change or remove it at any time). We don't receive your Facebook password, friends or posts, and we don't post to Facebook. An account made this way has no Gabbex password until you set one with "Forgot password".
- If you continue with Google: Google tells us your Google account ID, your name, your email address and whether Google has verified it, and your profile picture. We use them the same way as for Facebook, and only link to an existing Gabbex account when Google has verified the email address. We don't receive your Google password, contacts or any other Google data.
- Your agreement to our terms: when you confirmed you are 18 or older and agreed to the Terms of Service and this policy, and which version you agreed to.
- Profile: your nickname, profile photo, the interests you pick, and your settings (who can message and call you, notification and quiet-hour preferences, time zone).
- What you post: messages in rooms and direct messages, replies, reactions, mentions, and the photos, videos and files you upload, including their original file names.
- Channels, rooms and bots you create: names, descriptions, logos, settings, webhook templates and trivia questions.
- Reports you send about other users, including the reason and any note you add.
Information created as you use Gabbex
- Social connections: friends, friend requests, blocked and muted users, rooms and conversations.
- Room activity: the rooms and channels you join, your role in them, and joins, leaves, nickname changes, kicks, bans and silences, with any reason given. When a room message is deleted, we record who deleted it and whose message it was.
- Read markers showing how far you have read in each room, conversation and thread.
- Call records: who started a voice or video call, who was invited, who joined, declined or left, and when. We do not record the audio or video of calls.
- Trivia scores and answers when you play trivia in a room.
- Device push details: if you turn on notifications, a push token (or, in a browser, a Web Push address and its keys) and your device's platform.
- Password resets: if you ask to reset your password, a one-way hash of the single-use link we email you. The link stops working after an hour or once it has been used.
- Your in-app notifications, which include a short preview of the message that triggered them.
- Safety records: if an upload is flagged as sexually explicit, we keep a record of what happened, where, and a fingerprint (hash) of the content. We do not keep the flagged picture itself. If you are timed out for flooding, we keep a record of the timeout, which room it was in, and how long it lasted. We do not keep the messages that were held back.
- Flood checks: to stop people sending too fast, we briefly remember, in server memory, how often you are posting, reacting, uploading, starting calls, sending friend requests or invites, and changing your nickname, plus the recent text of messages so we can spot repeats. These counts last only for the short window of each limit, then they are discarded. They are not saved to your account.
- Sign-up checks: when you create an account, we check that the request comes from a genuine copy of our app or a real browser, using Google Play Integrity on Android, Apple App Attest on iPhone and iPad, or Cloudflare Turnstile on the web. We keep a single-use code for up to 30 minutes, and the result isn't saved to your account.
- IP addresses: we use your IP address to limit requests and stop password-guessing. IP addresses from failed sign-ins and blocks are kept only for a short time (see How long we keep it).
What we don't collect
We don't ask for your real name, phone number, birthday, contacts or location. We don't use advertising, analytics or tracking tools, and we don't sell your personal data.
Device permissions
The apps ask for camera, microphone and photo library access only so you can take or send pictures and make calls. You can say no or change this later in your device settings; the related features just won't work.
How we use it
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and run your account, deliver messages, files and calls | Account, profile, content, connections, call records | Needed to provide the service you signed up for |
| Send push notifications and in-app notifications | Push tokens, preferences, message previews | Your consent (you can turn notifications off any time) |
| Send emails about your account, such as password reset links, friend requests and account deletion notices | Email address, nickname | Needed to provide the service |
| Keep Gabbex safe: scan uploads for explicit content, slow down flooding, review reports, ban abusive accounts | Uploads, reports, safety records, short-lived flood checks, IP addresses | Our legitimate interest in protecting users and the service |
| Protect accounts from password-guessing | IP addresses, failed sign-in attempts | Our legitimate interest in security |
| Respond to legal requests and enforce our Terms | Any data relevant to the request | Legal obligation and legitimate interest |
What other people see
Who can reach you: by default, only your friends can start a direct message with you or call you. InPrivacy settings you can open each of these to anyone who shares a channel with you, or turn them off (with calls off, nobody can ring you, but you can still join calls yourself). Changing who can message you doesn't affect conversations you already have. Blocking someone stops them from finding or messaging you.
Gabbex is built around open rooms. Anyone who can open a room can see what is posted there, along with the poster's nickname and photo. That includes people who join later, room moderators, and bots the room's creator has added. Direct messages are visible to you and the other person. Your email address is never shown to other users.
Other people can also see whether you are online and, during your quiet hours, that you are on do not disturb and when it ends. Rooms show activity lines when people join or leave, change their nickname, or are silenced, kicked or banned, along with any reason a moderator gives. A timeout for flooding is announced in the room, with your nickname and how long it lasts.
Room share links (such as gabbex.com/c/channel/room) show a preview to anyone, without signing in: the channel and room name and, unless the channel is secret, its description, logo and member count. Previews never show messages or who the members are. Private rooms and secret invite-only channels show no preview.
Messages and files are encrypted while they travel between your device and our servers, and calls use standard WebRTC encryption. Gabbex is not end-to-end encrypted, so don't share anything you need to keep secret.
If you share a room link or a webhook URL, anyone who has it can use it. Webhook URLs let anyone post into the room as that bot, so keep them private.
Who we share it with
We share personal data only with service providers that help us run Gabbex, and only what they need:
| Provider | What they do | Data involved |
|---|---|---|
| Cloudflare | Hosts this website and the web app; stores uploaded files and photos; carries traffic to our servers; runs voice and video calls; checks web sign-ups for bots (Turnstile) | Uploads, profile photos, logos, network requests such as IP address, your nickname in calls, and call audio and video while the call is live (not recorded) |
| Amazon Web Services | Scans uploaded pictures and videos for sexually explicit content | Uploaded pictures and videos (videos are held briefly while scanned) |
| Expo, Apple and Google | Deliver push notifications to phones and browsers; Expo also delivers app updates | Push tokens, sender nickname, short message preview; for updates, the app version and device platform |
| Mailtrap | Sends account emails | Email address, email content |
| Meta (Facebook) | Lets you sign in with Facebook, if you choose to | The sign-in request; Facebook then shares the details listed above with us |
| Google and Apple | Confirm that a sign-up comes from a genuine copy of the app (Play Integrity, App Attest) | A one-time code and information about the app and device, under Google's and Apple's own privacy policies |
| Lets you sign in with Google, if you choose to | The sign-in request; Google then shares the details listed above with us | |
| Cloud hosting providers | Run our servers, database and call servers | All data we store |
We may also disclose data when the law requires it, to protect someone's safety, to investigate abuse, or as part of a merger, acquisition or sale of the business (we would tell you before your data became subject to a different policy).
Where it is stored
Some of our providers store or process data outside the Philippines, including in the United States. When data leaves the country, we stay responsible for it under the Data Privacy Act and require our providers to protect it to a comparable standard.
How long we keep it
- Account and content: kept for as long as your account exists.
- Deleting a message: you can delete your own messages, in rooms and in direct messages. They are permanently removed along with their files, for everyone in the conversation. Deleting the first message of a thread also removes its replies.
- Deleting your account: you can delete your account from your profile (see how to delete your account). Your messages are hidden straight away, and you have 30 days to change your mind by signing in again. After 30 days we permanently delete your email, password, Facebook and Google links, profile, photo, friends, settings, notifications, push tokens, memberships, blocks and mutes. Channels you own pass to their longest-standing member, or are deleted if no one else is in them. Messages and files you posted stay in their rooms and conversations so others' conversations still make sense, but they are shown under an anonymous "deleted" name that is no longer linked to your email. Your reactions, call records, trivia scores and room activity lines (such as joins, leaves and nickname changes) are also kept under that anonymous name.
- Failed sign-in records: deleted after about 15 minutes. IP blocks: deleted when the block ends.
- Reports and safety records: kept to stop repeat abuse, including after the account involved is deleted. Flood timeout records are part of this. The short-lived flood checks above are not kept.
- Backups may hold deleted data for a limited time until they are replaced.
To have something removed that you can't delete yourself, email us at hello@gabbex.com.
Security
We protect your data with encrypted connections, hashed passwords, short-lived sign-in tokens, private file storage reached only through links that expire, account lockouts after repeated failed sign-ins, and limited staff access. No system is perfectly secure. If a breach puts your data at risk, we will notify you and the National Privacy Commission as the law requires.
Your rights
Under the Data Privacy Act you have the right to:
- Be informed about how your data is collected and used (this policy).
- Access the personal data we hold about you.
- Correct data that is wrong. You can change your nickname, photo and settings in the app.
- Object to processing, and withdraw consent you have given, such as for notifications.
- Erasure or blocking of data that is no longer needed or was processed unlawfully. You can delete your account yourself at any time.
- Data portability: get a copy of your data in a common electronic format. Gabbex has no export button, so email us and we'll send you a copy.
- Damages if you are harmed by inaccurate, unlawfully obtained or misused data.
- Complain to the National Privacy Commission if you think we have mishandled your data.
To use any of these rights, email hello@gabbex.com from the address on your account. We may need to confirm it's you, and we'll reply within 30 days.
Cookies and local storage
We don't use cookies for tracking or advertising. This website saves only your light or dark theme choice in your browser. The web app saves your sign-in token, your last selected channel, your push settings and, for up to 24 hours, a room link you opened before signing in, so it can take you there afterwards. On phones these are kept in the device's secure storage. Clearing your browser data removes them and signs you out.
Children
Gabbex is not for anyone under 18. If you believe someone under 18 has an account, tell us at hello@gabbex.com and we will delete it.
Changes
If we change this policy, we'll update the date at the top. For significant changes, we'll also tell you in the app or by email before they take effect.
Contact us
Jeva Technologies OPC
hello@gabbex.com (privacy questions and requests go to our Data Protection Officer)
See also our Terms of Service.