Privacy Policy

blob is a keyboard-first note-taking application. In this policy, “blob”, “we”, “us” and “our” mean the team operating the blob service and website; “you” and “your” mean anyone who uses it. “Service” means the blob application; “Website” means these marketing and legal pages.

A. Information you provide to us

Account information. When you sign in, we receive your email address. If you use a social provider, we also receive a display name and avatar image from it. Sign-in is available through Google, GitHub, GitLab, or a one-time code sent to your email. We never receive your password for any of those providers. You may optionally change your display name and upload your own avatar, which we store in our file storage.

The notes you write. When your notes sync, we store what a notes app must store in order to give them back to you: the title and full body text of each note; the folder it sits in; links between notes; created, updated and moved-to-trash timestamps; and flags such as starred, pinned, and whether the note came from Quick Capture.

Your communications with us. If you email us for support or to exercise a privacy right, we keep that correspondence so we can answer it and show what was agreed.

B. Information collected automatically

Our hosting and database providers keep ordinary server logs, which include IP addresses, browser user-agent strings and request timestamps. These exist so the Service can run and so we can investigate outages and abuse. We do not run our own product analytics, session recording or advertising technology today; if that changes, we will update this policy and the Cookie Policy first.

C. Information from other sources

If you sign in through Google, GitHub or GitLab, we receive from them only the identity details described above. We do not buy data about you from data brokers or enrichment providers.

• We do not run advertising, and we do not embed advertising trackers or pixels.
• We do not sell, rent or trade your personal information or your notes.
• We do not build advertising or interest profiles from the content of your notes.
• We do not use your notes to train machine-learning models.
• We do not read your notes as a matter of course — see “Encryption and access” below for what that promise does and does not cover.

• To store your notes and return them to you on any device you sign in from.
• To authenticate you and keep your workspace separate from everyone else’s.
• To operate, debug and improve the Service — for example, diagnosing a failed sync.
• To detect, investigate and prevent abuse, fraud and security incidents.
• To answer your support requests.
• To contact you about the Service itself, such as a security issue or a material change to this policy.
• To comply with legal obligations and enforce our Terms.

We do not use your note content for any purpose beyond delivering it back to you and keeping the Service working.

We use a small number of service providers, and only for the job named here:

Beyond these, we disclose personal data only when the law requires it, or when it is genuinely necessary to protect the rights and safety of our users or the public. If we are ever compelled to hand over data, we will tell you unless we are legally barred from doing so.

If blob is ever involved in a merger, acquisition or sale of assets, your information may transfer as part of that transaction. We will give notice before your data becomes subject to a different privacy policy.

Our providers operate infrastructure outside Vietnam, so your information may be transferred to, stored and processed in other countries whose data-protection laws differ from those where you live. When we transfer data, we take reasonable steps to keep it protected consistently with this policy.

• Email: we only send you messages about the Service itself. We do not run marketing campaigns today; if we start, those emails will carry an unsubscribe link.
• Local data: you can clear blob’s local storage at any time through your browser’s site-data settings.
• Cookies: see the Cookie Policy for what we store in your browser and how to control it.
• Deletion: you can delete your account and everything in it from Settings → Profile.

Depending on where you live, you may have the right to access your personal information, to correct it, to request its deletion, to restrict or object to processing, to receive a portable copy, and not to be discriminated against for exercising these rights.

To exercise any of them, email huynhtrungduc.growth@gmail.com. We will respond within 30 days. We may need to verify your identity first — usually by asking you to write from the address on the account. If you are in the EEA or the UK, you also have the right to complain to your local supervisory authority.

We keep your account information and notes for as long as your account exists. Notes stay until you delete them: deleting a note moves it to trash, where it can be restored, and emptying the trash removes it from our database.

Server logs are kept only as long as they are useful for security and reliability. Data held locally in your browser stays there until you or your browser clears it.

You can delete your account yourself, from Settings → Profile → Delete account. It asks you to confirm, and it cannot be undone.

Deletion removes your notes, folders, note links, uploaded avatar and account record from our database. Copies may remain in our provider’s routine backups for a short period before those rotate out. The local copy in your browser is cleared at the same time.

If self-service deletion fails for any reason, email huynhtrungduc.growth@gmail.com and we will complete it for you.

We take reasonable steps to protect your information. Traffic between your browser and our servers is encrypted in transit using HTTPS/TLS, our database provider encrypts the underlying storage at rest, and access to production data is limited to the people who need it. Note content is not end-to-end encrypted — it is not encrypted with a key held only by you, so it can be read by someone with administrative access to our database. We do not read it, and we never sell or share it. For passwords, recovery codes and similar secrets we recommend a dedicated password manager rather than a notes app. No system is completely secure, however, and we cannot guarantee the security of information you provide to us.

If we learn of a breach affecting your data, we will notify you electronically — by a notice in the Service or by email — as required by applicable law.

We use browser storage for two things: keeping you signed in, and holding your notes and preferences locally so the app opens instantly and works offline. We do not use advertising cookies, and we do not run third-party analytics that profile you across other websites. Our Cookie Policy sets out each category in detail and how to control it.

Notes may contain links to other websites, and those sites are not controlled by us. We do not endorse or screen them and are not responsible for their content or privacy practices. Visiting them is at your own risk.

blob is intended for a general audience and is not directed at children under 13, and we do not knowingly collect their personal information. If we learn we have collected data from a child without valid parental consent where such consent is required, we will delete it promptly. If you believe this has happened, contact us.

We will update this page as the product changes. If a change materially reduces your privacy — a new category of data, a new recipient, or a new tracking technology — we will say so clearly rather than quietly editing the text, and we will update the date at the top. Continuing to use blob after a change takes effect means you accept the updated policy.

Questions, requests or complaints: huynhtrungduc.growth@gmail.com.