Blouly is a small app made by one person. It has no advertising, no analytics, and no tracking of any kind. This policy explains the data it does handle — what stays on your phone, what is stored in the cloud, and the one thing that gets sent to an AI provider to write your cards.
The short version. We store your email address, the topic names you type, and the cards generated for you. To write a card, the topic name you wrote is sent to Anthropic's API. Nothing that identifies you is sent with it. We do not sell or share your data, we run no advertising or analytics, and you can delete your account and everything in it from inside the app at any time.
- Who we are
- What we collect and why
- What never leaves your device
- What we do not collect
- How your topics are used to write cards
- Legal bases for using your data
- Who else processes your data
- Where your data is stored
- How long we keep it
- Your rights, and how to use them
- Children
- Security
- Changes to this policy
- Contact
1. Who we are
Blouly is provided by Andrei Safronov, an individual established in the United States ("we", "us"). For data protection purposes we are the controller of the personal data described in this policy.
You can reach us at privacy@blouly.com. This policy covers the Blouly iOS app and the backend service it talks to. It does not cover the other apps you use Blouly alongside — those have their own policies.
2. What we collect and why
Account data
You need an account to use the parts of Blouly that generate cards, because the cards are stored against your account so they follow you to a new phone.
| Data | How it reaches us | Why |
|---|---|---|
| Email address | From Sign in with Apple, Sign in with Google, or a one-time code we email you | To identify your account, sign you in, and contact you about the service |
| Display name (optional) | Provided by Apple or Google at first sign-in, or typed by you | To show your name in the account screen. You can leave it blank |
| Sign-in provider identifier | From Apple or Google when you use those buttons | To match you to the same account each time you sign in |
If you use Sign in with Apple and choose "Hide My Email", Apple gives us a private relay address instead of your real one. We never receive your real address, and the app will show your email as hidden. If you choose to hide it entirely, we hold no email address for you at all.
Content you create
| Data | What it is |
|---|---|
| Topic names | Free text you type — whatever subject you want cards about. This is the one field where you decide what the content is, so please read section 5 before typing anything sensitive |
| Card text | The summary and full text of every card generated for you, plus which topic it belongs to |
| Card status | Whether you have read a card and whether you saved it, with timestamps |
| Topic settings | Each topic's colour, its order in your list, and whether it is switched on |
Subscription data
If you subscribe, Apple takes the payment and we never see your card details, your billing address or your invoices — Apple does not make any of that available to apps, which is why the app links you to your iPhone's own subscription settings to manage or cancel.
What we do hold is a record that your account is subscribed: which plan, when it expires, whether it is set to renew, and whether you are in the free trial. We keep it so that our server can check you are entitled before it writes you a card, and so that your subscription works on any phone you sign in on. It is written by RevenueCat, which verifies the purchase with Apple on our behalf — see section 7. RevenueCat receives your Blouly account identifier and your App Store purchase record. It never receives your topics or your cards.
Technical data
When the app asks our server for a card, it sends your device's time zone (for
example Europe/Berlin). We use it for one thing: working out when your day rolls over,
so the daily card allowance resets at midnight where you are rather than midnight UTC. It is not
stored against your account and is not used to locate you.
Like any internet service, our hosting provider records standard server request logs, which include IP addresses, as part of operating and securing the service. We do not use those logs to build a profile of you.
Separately, when something goes wrong on our server we record the failure itself: which part of the service failed, a technical error message, and — where the request had signed you in — your account identifier, so we can tell whether a fault affected one person or everyone. These records are deleted after 30 days, and they are removed immediately if you delete your account. They never contain your topics or your cards. That is a deliberate rule and not a side effect: what you type is the one thing in this app we would least want copied into an operations log.
We also keep a simple count of how much work our AI provider has done for us: one line per card or suggestion written, recording when and which of the two, linked to your account while the account exists. We use it for one thing — knowing what the service costs to run, and being warned if that jumps unexpectedly. It records no topic, no card text and no device information. If you delete your account, the link to you is erased and what remains is an anonymous tally that says only that a card was written at a particular time.
3. What never leaves your device
Some of what Blouly knows about you is deliberately kept on your phone and is never transmitted to us or anyone else. We built it this way on purpose, because this is the most sensitive data the app touches.
- Your blocked-app list — which apps you have chosen to be interrupted on, and whether each is switched on.
- Your interruption history — how many times today you have opened each of those apps. This is behavioural data about your habits, and it stays on your phone.
- Grace timers — the short windows after you tap "Open app" during which Blouly leaves you alone.
- Your daily goal — your target, today's count, and today's date.
- Your sign-in tokens — held in the iOS Keychain and marked so that they cannot be restored onto a different device from an iCloud backup.
Because this data is only on your device, we cannot retrieve it, and it is destroyed when you delete the app.
4. What we do not collect
Stated plainly, because it is unusual enough to be worth saying:
- No analytics and no crash reporting. There is no analytics SDK, no crash reporting SDK, and no product-usage telemetry in the app.
- No advertising and no tracking. We do not collect an advertising identifier (IDFA), we do not track you across other companies' apps or websites, and the app never shows the App Tracking Transparency prompt because it has nothing to ask for.
- One third-party SDK, and only one. The app contains RevenueCat's library, which exists solely to make subscriptions work across your devices — see section 7. Everything else is built on Apple's own frameworks. There is no analytics, crash-reporting, advertising or attribution SDK of any kind.
- No location, contacts, photos, microphone, camera, health or fitness data. The app requests none of these permissions.
- No selling or sharing. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
One thing worth disclosing. So that the apps-block feature can offer to interrupt the apps you actually have, Blouly is able to check whether ten named apps are installed on your phone: Instagram, Facebook, TikTok, YouTube, X (Twitter), Reddit, Snapchat, Pinterest, LinkedIn and Twitch. That check happens entirely on your device, the result is never sent to us, and we cannot see which apps you have.
5. How your topics are used to write cards
Blouly's cards are written by an AI model — Claude, made by Anthropic. This is the only place your content leaves our own systems, so here is precisely what happens.
When you swipe for a new card, our server sends Anthropic's API:
- the name of the topic you typed, and
- up to 40 short summaries of cards you have already seen on that topic, so the model does not repeat itself.
When the app suggests a new topic to you, it sends up to 50 of your topic names so the suggestion fits your interests.
That is the entire payload. Your email address, your name, your account identifier, and any device identifier are not sent to Anthropic — they never form part of the request. Your device never contacts Anthropic directly; only our server does, using our own credentials.
Under our commercial agreement with Anthropic:
- Anthropic does not train its models on the content we send through the API.
- Anthropic automatically deletes API inputs and outputs within 30 days of receiving or generating them.
- The exception is content flagged under Anthropic's usage policies, which it may retain for up to 2 years, with associated safety classification scores kept for up to 7 years.
Please think before you type a topic. A topic name is free text, and it is the one piece of your content that leaves our systems. "Roman history" and "how sourdough works" are exactly what the app is for. Something like a medical diagnosis, a legal matter, or another person's private business is best kept out of it — not because we would misuse it, but because it would be sent to a third party for processing, and because it would be stored until you delete it.
Cards are generated by an AI model and can be wrong. They are general interest reading, not professional advice. See the Terms of Use.
6. Legal bases for using your data
If you are in the UK, the EU or the EEA, the UK GDPR and EU GDPR require us to name a lawful basis for each use of your personal data.
| What we do | Lawful basis |
|---|---|
| Create and maintain your account; store your topics and cards; sync them between your devices | Performance of a contract — this is the service you signed up for (Art. 6(1)(b)) |
| Send your topic names to Anthropic to generate cards | Performance of a contract — generating cards is the app's core function (Art. 6(1)(b)) |
| Enforce daily limits, prevent abuse, and keep the service secure | Legitimate interests — protecting the service and controlling costs so it can keep running (Art. 6(1)(f)) |
| Take payment for a subscription and honour it | Performance of a contract (Art. 6(1)(b)). Payment itself is handled by Apple, not by us |
| Meet our legal and tax obligations | Legal obligation (Art. 6(1)(c)) |
7. Who else processes your data
We use a small number of providers to run the service. Each one is bound by a contract that requires it to protect your data to a standard equivalent to the one described in this policy, to process it only on our instructions, and to keep it confidential.
The full list, with what each one receives, is on the subprocessors page. In summary: Supabase hosts our database, accounts and server functions; Anthropic generates the card text; Apple handles Sign in with Apple and all subscription payments; RevenueCat verifies those subscriptions with Apple and tells our server you are entitled; and Google is involved only if you choose to sign in with a Google account.
Beyond these, we share your personal data only where we are legally required to — for example in response to a valid legal request — or where it is necessary to establish, exercise or defend legal claims. If Blouly is ever transferred to someone else, we will tell you before your data moves, and this policy will continue to apply until you are given a new one.
8. Where your data is stored
Your account, topics and cards are stored in the United States — specifically in
our Supabase project hosted in the AWS us-west-2 region (Oregon). Anthropic processes
card-generation requests in the United States, and RevenueCat processes subscription records there
too. Apple and Google operate globally.
If you are in the UK, EU or EEA, this means your personal data is transferred outside your country. Those transfers are made under the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), which our providers incorporate into their data processing terms, together with the technical measures described in section 12.
9. How long we keep it
| Data | Kept for |
|---|---|
| Your account and profile | Until you delete your account |
| A topic, and every card belonging to it | Until you delete that topic, or delete your account — whichever comes first. Deleting a topic removes it and its cards from the app straight away, and we erase them from our servers within 30 days |
| On-device data (blocked apps, interruption counts, daily goal) | Until you remove it in the app or delete the app. Signing out clears the topics and cards mirrored on your device |
| Content sent to Anthropic | Deleted by Anthropic within 30 days (see section 5 for the exception) |
| Your subscription record | Until you delete your account, which removes our copy along with everything else. Apple and RevenueCat keep their own purchase records under their own policies — we cannot delete those, and neither can you |
| Server request logs held by our hosting provider | The provider's own operational retention period |
| Our own records of server errors (see section 2) | 30 days, then deleted automatically. Removed at once if you delete your account. Never contains your topics or cards |
| Our count of cards and suggestions written, for cost monitoring | Kept as a running total. Deleting your account erases the link to you, leaving an anonymous tally with no topic, card text or device information in it |
We do not otherwise put an expiry on your topics and cards, because the point of a saved card is that it is still there when you come back. If you want them gone sooner, delete the topic or the account.
Why deleting a topic takes 30 days to complete on our side. The topic and its cards leave the app immediately — you will not see them again, and we do not use them for anything after that point. We hold the rows for up to 30 days for two reasons: so that a topic deleted by mistake can be recovered if you ask us, and so that cards already written that day still count towards your daily limit. Without the second one, deleting a topic would hand back allowance you had already used. After 30 days the rows are deleted permanently by an automatic job.
Deleting your account
You can delete your account from inside the app: Menu → Account → Delete account. It is immediate and it cannot be undone. Deleting the account removes the account itself, your profile, every topic and every card, in a single operation — there is no "deactivated" state and nothing is kept back. That includes anything still inside the 30-day window described above: the account deletion takes it all at once, and does not wait. You do not need to email us and we will not ask you why.
Deleting your account does not cancel your subscription. Apple owns the subscription, not us, and no app is able to cancel one on your behalf. If you are subscribed, cancel it first in Settings → your name → Subscriptions on your iPhone — otherwise Apple will keep billing you after your Blouly data is gone.
10. Your rights, and how to use them
Depending on where you live you have some or all of the following rights over your personal data: to access it, to have it corrected, to have it deleted, to receive a portable copy, to restrict or object to how we use it, and to withdraw consent where we relied on it.
The quickest route for most of these is the app itself: edit or delete any topic, and delete your account and all its data, without contacting anyone. For anything else — a copy of your data, a correction, or a question about this policy — email privacy@blouly.com and we will respond within one month.
If you are in California. You have the right to know what personal information we collect and how we use it (this policy), the right to delete it, the right to correct it, and the right not to be discriminated against for exercising those rights. We do not sell your personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We do not offer financial incentives in exchange for personal information.
If you are in the UK, EU or EEA and you think we have handled your data badly, we would like the chance to fix it first — but you also have the right to complain to your national data protection authority.
11. Children
Blouly is not directed at children and is not intended for use by anyone under 13, or under the higher minimum age set by your country where one applies (16 in some EU member states). We do not knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.
12. Security
No system is perfectly secure, but here is what we actually do:
- All traffic between the app and our servers is encrypted in transit with HTTPS.
- Every request to our backend carries your own signed session token. There is no shared password or shared key built into the app — if there were, extracting it from the app would give someone access to everyone's data.
- The database enforces row-level security: each row is tied to a user, and a request authenticated as one user cannot read or modify another user's rows.
- Our AI provider credentials live only on the server, never in the app.
- Your sign-in tokens are stored in the iOS Keychain and marked so they cannot travel to another device via an iCloud backup.
13. Changes to this policy
If we change how we handle your data, we will update this page and change the date at the top. If the change is significant, we will tell you in the app or by email before it takes effect.
14. Contact
Andrei Safronov
800 Parkview Dr, Apt 306, Hallandale Beach, FL 33009
privacy@blouly.com