what we keep
your phone number, kept as a one-way hash with a secret key. it's how we know it's you when you sign in with a texted code, how a seat someone saved for your number finds you when you join, and how a banned number stays out.
a display name and a handle you choose. a photo, if you add one. a short voice hello, if you record one. the voices you record, which are gone once they're heard.
numbers you invite
when you save someone a seat, the app sends us their number once. we keep it only as the same kind of one-way hash, tied to that seat, so the person who signs up with that number finds it waiting. the hash is cleared when the seat is used, taken back, or expires. we never text that number ourselves; the invitation goes out from your own Messages app.
your device
each signed-in device has an identifier and a key pair that proves it's the same device; the private half never leaves your phone. if you allow notifications, we keep the push token Apple gives us so we can knock when someone blips you. signing out drops the token.
what happens to a voice
a voice is encrypted with its own key. once it's heard, or after two days unheard, the key is erased and the voice is gone, for us too. we don't transcribe voices, analyze them, or use them for anything but delivering them to the people you chose. we keep one loudness number per voice so we can even out playback later; nothing else is read from the audio.
reports
when someone reports a voice or a voice hello, a sealed copy is kept for review even though it would normally be gone. the copy can only be opened on our servers. it's gone when the report closes, and within 30 days either way.
the seat page
a seat link you send opens a web page that shows the holder your name, your handle, your photo if you have one, and the voice you left: the things you chose to send. it tells you whether the link was opened and whether the voice was heard, and nothing else.
counts and diagnostics
we keep daily counts of events (sign-ups, blips sent by kind, seat pages opened) with no record of who. if the app crashes or hangs, it sends us a short diagnostic line (the kind of failure, the build, the iOS version, the device class, the screen it was on) with no account identifier. our servers see your IP address, like any service on the internet; we use it only to limit abuse, never to track you.
what we never do
we don't sell your data. we don't share your phone number; people find you by your handle, never by number. no ads, no advertising profiles, no marketing messages.
texts
we send one kind of text: a sign-in code, only when you ask for it in the app. message and data rates may apply. reply HELP for help. reply STOP and we can't text you a code, so you can't sign in; reply START to come back.
who else touches it
Twilio delivers the texts and handles phone numbers for that purpose only. our servers run on Amazon Web Services.
deleting your account
delete your account from the app's settings (from build 111 on), or write to us at support@blipblab.com and we'll do it; it's gone after 30 days — sign in before then to keep it.
write to us
questions or deletion requests: support@blipblab.com. security reports: security@blipblab.com.