Privacy Policy

Account data — name, email, hashed password, optional phone number (for SMS alerts), plan and billing status.

Your content — posts, drafts, listings, voice profiles, photos you upload for listings, and scheduling data.

Connected-platform credentials — tokens you provide for live publishing (e.g., Bluesky, Mastodon), encrypted at rest with AES-256-GCM and never shown back to you or anyone else.

Usage data — activity logs (publishes, retries, exports), API request counts, and standard server logs.

To operate the Service: generating and adapting content with AI, publishing on your instruction, scheduling, billing, sending transactional email and SMS alerts, enforcing plan limits and rate limits, preventing abuse, and improving reliability. We do not sell personal data and we do not use your content to train AI models.

We share data only with processors needed to run the Service: Vercel (hosting), Supabase (database), Anthropic (AI processing of content you ask us to generate or adapt), Stripe (payments — we never store card numbers), Resend (email), and Telnyx (SMS). Each receives only what its function requires. Content is sent to the platforms you choose to publish to, under their terms.

We keep your data while your account is active. You can delete your account (or email hello@blastopus.com) and we will delete your data within 30 days, except records we must keep for legal, billing, or security reasons. Backups roll off on a schedule.

Encryption in transit (TLS) and at rest, encrypted platform credentials, hashed passwords (bcrypt) and API keys (SHA-256), row-level-security-locked database, and least-privilege access. No system is perfectly secure; notify us immediately of any suspected breach at hello@blastopus.com.

You may access, correct, export, or delete your data at any time from the app or by emailing us. Depending on where you live (e.g., EU/UK GDPR, California CCPA), you may have additional statutory rights — we honor verified requests under applicable law. We do not respond to Do-Not-Track signals; we use only essential session cookies, no advertising trackers.

The Service is for adults 18+; we do not knowingly collect children's data. We will announce material changes to this policy by email or in-app at least 14 days before they take effect. Contact: hello@blastopus.com.