Privacy Policy

1. Introduction

Origin 22 LLC ("we," "us," or "bearbear") operates the bearbear platform, including bearbear web, mobile, and desktop applications. This Privacy Policy explains how we collect, use, and protect your information when you use our services.

2. Information We Collect

Account Information

• Email address (for account creation and recovery)
• Display name (chosen by you)
• Date of birth (for age verification only — we do not share this)
• Password (stored as a cryptographic hash; we cannot read your password)

Usage Information

• IP address (for security and abuse prevention)
• Device type and operating system
• Approximate location (if you opt into "Near You" community discovery)

Message Content

bearbear uses end-to-end quantum-safe encryption (CRYSTALS-Kyber-768 + ChaCha20-Poly1305) for direct messages and voice calls. We cannot read, access, or decrypt your private messages. Server/community messages are stored encrypted at rest but are accessible to server administrators per their server's moderation policies.

3. How We Use Your Information

• To provide, maintain, and improve the bearbear service
• To verify your identity and enforce age requirements
• To detect and prevent fraud, abuse, and security threats
• To process payments (via Stripe — we do not store credit card numbers)
• To send service-related notifications (you can opt out)

4. Information Sharing

We do not sell your personal information. We share data only:

• With Stripe for payment processing
• When required by law (valid legal process)
• To protect the safety of our users

5. Data Security

We use post-quantum cryptographic standards (NIST FIPS 203 / CRYSTALS-Kyber) to protect your communications. Account passwords are hashed with Argon2id. All data in transit uses TLS 1.3. Data at rest is encrypted on our infrastructure.

6. Children's Privacy (COPPA)

bearbear is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we discover that a user is under 13, we will promptly delete their account and associated data. If you believe a child under 13 has created an account, please contact us at privacy@bearbear.io.

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Export your data in a portable format
• Opt out of optional data collection (location, analytics)

For California residents: Under the CCPA, you have additional rights including the right to know what personal information is collected and the right to opt out of its sale (which we do not engage in).

For EU/EEA residents: Under GDPR, you have the right to lodge a complaint with your local supervisory authority. Our legal basis for processing is contract performance and legitimate interest.

8. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are legally required to retain certain information.

9. Third-Party Services

• Stripe — Payment processing (Stripe Privacy Policy)
• Google OAuth — Optional sign-in (Google Privacy Policy)
• Apple Sign-In — Optional sign-in (Apple Privacy Policy)
• Fly.io — Infrastructure hosting

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via in-app notification or email. Continued use after changes constitutes acceptance.

11. Contact Us

If you have questions about this Privacy Policy or your data, contact us at:
privacy@bearbear.io
Origin 22 LLC
Las Vegas, NV