Privacy Policy

Last updated: August 26, 2026

Somba is a private, application-based network for builders aged 13 to 17. We collect as little as we can and we do not sell your information or use it for advertising. For privacy questions or data requests, email ymjiang77@gmail.com. For general or safety matters, email safety@somba.dev.

Your verification photo

If you apply, the photo you send with your application is checked by a person on our team to confirm your age. If your application is not accepted, we delete it. If you are accepted, that same photo becomes your starting profile photo when your account is activated, unless you unticked “Keep this as my profile photo” on the step where you took it, in which case it is deleted and you arrive with no profile photo. Either way the copy our reviewers saw is deleted at that point. A community invitation code does not skip this application or verification process. You can replace or remove your profile photo at any time in Settings, and removing it deletes the image from our storage.

Turning 18

Somba is for people aged 13 to 17, so membership ends on your eighteenth birthday. That ending is never a surprise. In the 30 days before your birthday we tell you inside the app, and for 30 days afterwards you can still sign in to a single page to download everything you made here and hand over any working groups you own. During that time you cannot browse Somba, post, or message anyone, because everyone still using Somba is a minor.

After those 30 days the account is deactivated. Messages you wrote inside shared working groups stay so your collaborators keep their project history, but your name is removed from them. If you want your data deleted sooner, email ymjiang77@gmail.com and we will remove it.

If we end your membership

A membership can also end because a person on our team ends it, which happens when somebody breaks the rules in a way we are not willing to keep on Somba. That one is immediate rather than warned in advance: the account is signed out everywhere straight away. We email you when it happens, and that email says why, in the words of the person who decided it. Nothing is deleted, so if you think it is wrong you can reply to that email or write to safety@somba.dev and a person will read it.

1. Who this applies to, and age

Ordinary Somba membership is only for people aged 13 to 17, and if we learn an ordinary account belongs to somebody under 13 or over 17 we remove it. Nobody under 13 can hold an account of any kind, and where somebody enters a community code we stop before collecting anything else about them. Adults cannot become ordinary members.

There are two kinds of adult account, both restricted and both reviewed by a person before they open. Where a partner club, programme or school issues an invite code, an adult from that organisation may hold an account so they can be in the Net with the people they brought. Separately, an adult may apply to be a verified community leader for one approved community. Neither can browse or search members, appear in Discover, post Signals, send direct messages, or reach any part of Somba outside the Net they are approved for.

There are two ways to get an ordinary account, set out below, and they differ in who vouches for you. A community invitation is a third thing and creates no account by itself: a teenager invited to a community still completes the normal application and guardian process. Before approval, the guardian sees the verified adult leaders, their organizations and roles, the checks Somba actually performed, what those leaders can see, whether Somba moderates the community, and how to report a leader or remove their teenager.

By application. A person on our team reads the whole application. What happens next depends on where you are. In the EU, the EEA, the UK, and the US states that have their own parental-consent law for minors, we ask for a parent or legal guardian's email address, and an accepted account stays inactive until that guardian approves it using a link we send them. Everywhere else, we ask you to confirm that a parent or guardian knows you are applying, and an accepted account opens when the reviewer accepts it. If you give us a guardian's address anyway, we use it and wait for their approval. We record which of these happened, and a confirmation you gave yourself is never recorded as an approval anyone granted.
By invite code. A partner club, programme or school can issue a code to its own members. That organisation is the party vouching for the person, so we do not separately ask a guardian to approve the account, and we record that no guardian approval was given rather than implying one was. The age range is enforced exactly the same way: a partner vouching for someone does not make a 12-year-old eligible.
On this route we do not ask you for a parent or guardian's email address at all, in any country. The partner organisation is the party vouching for you, and issuing you a code is that organisation telling us it has already obtained whatever permission you need to take part. You can still give us a guardian's address if you want them told you have joined, and we will write to them if you do. We record that the organisation vouched, and we name it, so it is always clear whose word an account rests on. This is the older of the two code routes and it is not the same thing as a community invitation code, which admits nobody on its own.
Through a community invitation. A code names a community and routes the person to the correct process. Ages 13–17 complete the ordinary application and applicable guardian approval. Ages 18 and older may apply separately for a verified adult role. A code never grants immediate access.

Either way, an account belongs to a minor and is treated that way throughout this policy.

2. What we collect

Application information: your first name, optional middle name, last name, and any suffix; a username; your email; your date of birth; your state or province and country; your time zone; your written answers about what you have built, what you learned, and who you want to meet; an optional link to your work; and your parent or guardian's email.
Age-verification photo: a photo you take on your camera during the application, or choose from a file only where your browser will not give the page a camera so a member of our team can confirm you are 13 to 17. While your application is open it is seen only by the reviewer and never by other members. If your application is declined, we delete it. If it is accepted, that photo becomes your starting profile photo unless you asked us not to keep it, so from that point other accepted members see it. The reviewer's copy is deleted either way. You can replace or remove the profile photo at any time in Settings.
Images you attach to a message: a picture you attach to a direct message or to a Net. Before the person you sent it to can see it, an adult on our team opens it and looks at it, together with the first part of the message you sent with it, so that we can check it. If we do not approve it, it is deleted and never delivered, and you are told it was removed. If we approve it, only the people in that conversation or that Net can see it. Camera information such as where and when the picture was taken is removed before we store it.
Guardian information: your guardian's email address, used only to request and record their approval, or on the invite-code route to tell them you have joined. It is never shown to other members. Where we ask you to confirm a parent knows instead of collecting their address, we store only that you confirmed it and when, and no address.
Account and profile: your username, your first and last name, optional profile photo, short bio, skills, interests, the signals and links you choose to share with other accepted members, and an optional image, title and description for the piece of work you point at. Accepted members see your first and last name together wherever you appear. Nobody outside Somba does: there is no public profile page and no search-engine indexing. You can change your name yourself once a year in Settings, and after that by writing to safety@somba.dev. A profile photo is visible only to accepted members and is removed when you remove it or delete your account.
Region and time zone: a country, a state or province, and a time zone. These are required on the application, because they are what makes an introduction to somebody you could actually work with possible. What other members see is still yours to set in your profile settings. We never ask for, collect, or infer anything finer than a state or province: no city, no postcode, no GPS or device location, and no IP-based lookup. You choose how much of it other members can see, from your state down to nothing at all, and you can clear it at any time. We use the full answer only to order who is suggested to you and who you are suggested to.
Activity: member Signals and replies you publish, private Thanks you send or receive, messages you send, the working groups ("Nets") you join, and related content you create on Somba.
When you use Somba, and for how long: we record which days you opened Somba and roughly how much time you spent, worked out from when your requests arrive rather than from anything watching you. It is a number of seconds against a date, nothing about what you looked at or who you spoke to. We keep 60 days of it and then it is deleted. It is never shown to other members: we use it only as a total, to answer how many people use Somba on a given day and whether that is going up. Deleting your account deletes it.
Whether you are here right now: we keep the time of your most recent request, so other accepted members can see a green dot when you are around and a grey one when you are not. It is a single timestamp, held in memory rather than saved, and it is forgotten when Somba restarts. It shows next to your name in messages and in the Nets you share. On your profile it is shown only to members who follow you, and to nobody else.
Referrals: if a member invited you, we record who invited you so we can credit them. If you invite others, we count how many join.
Communications: which Somba emails you want. Emails about your own account, such as a sign-in link, always send. The rest are notifications about things that happened to you, plus a weekly brief and the occasional announcement. Those start switched on and you can switch any of them off in Settings, or in one press from the email itself.
Pre-launch waitlist: the email address you submit on the access gate, used to tell you when applications or preview spots open.
Technical: a sign-in session cookie, and basic security information such as your approximate network address, used to protect the service and apply rate limits.

3. How we use your information

To review your application and decide on membership. A person reads every application and makes the decision.
To request and record your guardian's approval, where the account came through an application.
To check an invite code against the partner organisation that issued it, where the account came through a code.
To run the network: sign-in, your profile, messaging, Nets, introductions, and referrals.
To keep Somba safe: enforce our rules, respond to reports, prevent abuse, and verify eligibility and age.
To check images before they are delivered. Every image attached to a message is opened and looked at by an adult on our team, together with the first part of the message it was sent with, before the person it was sent to can see it.
To check messages for a short list of dangers. Every message sent on Somba is checked automatically, before it is delivered, against a fixed list of patterns: someone asking for a password, someone pretending to be Somba, an attempt to move a conversation off Somba where nobody can see it, harassment, and words that suggest somebody may be about to hurt themselves. Nearly every message matches none of them, is delivered normally, and nothing is kept. A message that reads as a password request or as an adult grooming a minor is held before delivery. The rest are delivered, and a copy is put in front of a moderator on our team, who reads that message. A person, not a machine, decides what happens next. We do this because Somba is a network of 13 to 17 year olds, and we do not use it for anything else, for advertising, or to build a profile of you.
To count how many people use Somba and how often, as totals rather than as individuals, so we can tell whether what we build is working.
To send you service messages about your application and account, which always send. Notification emails, the weekly brief and announcements start switched on, and stop the moment you turn them off.
To send launch and preview-access updates when you join the pre-launch waitlist.

4. Consent, and your guardian's role

For an account created by application from the EU, the EEA, the UK, or a US state with its own parental-consent law, we rely on your parent or legal guardian's approval, and on our legitimate interest in running a safe, invitation-based community. For an application from anywhere else, we rely on your confirmation that a parent or guardian knows, and on the same legitimate interest; no guardian approved those accounts and we do not record one as having done so. Either way a parent or legal guardian can write to us at any time at ymjiang77@gmail.com to close the account, and we will close it, whether or not we hold their address.

For an account created with a partner organisation's invite code, we rely on that organisation's authorisation for its own members, and on the same legitimate interest. No guardian approved these accounts and we do not record one as having done so. Depending on where you are, we either wrote to a parent to tell them, or asked you to confirm they know. A parent or legal guardian can still write to us at any time to have the account closed, and we will close it on the same terms as a withdrawal of consent, whether or not we hold their address.

A community invitation code does not create an account or replace guardian approval. If the application includes a supervised community, the approval screen names the verified adults and explains their limited access before the guardian decides.

5. How we share information

We do not sell your information, and we do not use it for advertising or third-party ad tracking.

Service providers: we use a small number of vendors to run Somba, such as a hosting and database provider and, when enabled, an email provider (to send sign-in and guardian approval links) and a payment provider (for any future paid features). They may process information only to provide their service to us.
Safety and legal: we may share information if it is needed to protect someone's safety, to respond to a valid legal request, or to enforce our terms.

6. Cookies

We use a single sign-in session cookie so you stay logged in. We do not use advertising or cross-site tracking cookies. Turning off the session cookie will prevent you from signing in.

7. How long we keep information

We keep application and account information while your account is active. If your application is declined or your account is closed, we delete or de-identify your personal information within a reasonable period, except where we must keep limited records for safety or legal reasons. We also remove accounts that age out of the 13 to 17 range.

8. Your choices and rights

You or your guardian can ask us to access, correct, or delete your information, or to close the account. Send data requests to ymjiang77@gmail.com and we will respond within a reasonable time, generally within 30 days. You can opt out of optional Somba news at any time. Because members are minors, we will honor guardian requests about a member's information.

9. Security

We use access controls, encrypted storage where available, restrictive permissions, and other safeguards. No system is perfectly secure, but we work to protect your information and will notify affected members and guardians if a breach affects them.

10. Where information is processed

Somba is operated from the United States, and your information may be processed there.

11. Changes to this policy

If we make material changes, we will update the date above and, where appropriate, notify members and guardians.

12. Contact

Data requests and privacy questions: ymjiang77@gmail.com
General and safety: safety@somba.dev