Privacy policy

1. What we collect

When you sign in. You sign in with Google, or with a 6-digit code we email you. We store your email address. If you use Google, Google also shares your name, email address and a link to your profile photo with us.

Sign-in records. Supabase Auth, our sign-in service, keeps an audit log of sign-ins. It records the time, your IP address and your browser’s user agent (which describes your browser and operating system).

Your identity key. Every account gets one. Section 2 explains how we hold it.

When you use the app. Cloudflare, which serves the app, processes your IP address and request details to deliver and secure the service. We keep short-term request logs for troubleshooting.

When you contact us. If you email us, we’ll have your email address and whatever you include.

2. Your identity key

Each account gets a cryptographic identity key (a Nostr key). The public half identifies you in communities. The secret half signs your messages, so others can tell they came from you.

• We store your secret key encrypted, using AES-256-GCM, in our Supabase database. The encryption master key is kept separately, as a secret in Cloudflare Workers.
• When you sign in, our server decrypts your key and sends it to your browser over HTTPS. Your browser keeps it in memory, for that tab only, and never saves it to your device.
• If you already use the Bleepy desktop app, you can link your existing key when you sign in. It’s then stored the same way.

To be clear: because we hold the master key, we can technically decrypt your key. We only do so to deliver it to you, the signed-in owner.

3. What you share in communities

When you take part in a community, your browser sends these to the community’s server, where they’re stored:

• messages, reactions, thread replies and edits
• files and images you upload
• your profile: display name, photo and “about” text.

This goes straight to the community’s server, not through ours. When you set up your profile, we can fill in your name and photo from your Google account, and you can change them before you save. If you keep your Google photo, your profile links to the copy Google hosts.

Keep in mind:

• Members can see it. Your content is visible to the community’s members.
• It’s attributable. It’s signed with your key, so it can be traced to you.
• It isn’t end-to-end encrypted. The community’s host can access it.
• Deleting has limits. Deleting a message sends a deletion request that the host honours, but other members may already have seen or copied it.

FounderForge and Buzz

Bleepy’s first community, FounderForge, is hosted on Buzz (communities.buzz.xyz), a service run by Block, Inc. in the United States. To join a Buzz-hosted community, you accept Buzz’s own Terms of Service and Privacy Notice, which are shown when you join. Block handles that community’s content under those terms, not this policy.

4. AI agents

Communities may include AI agents run by the community’s owner or by members. An agent in a channel can read that channel’s messages, and may send them to AI model providers to write its replies. Whoever runs the agent chooses the provider, and that provider handles the messages under its own terms. Bear this in mind before you post in a channel with an agent in it.

5. Your browser

The app keeps some information in your browser so it works and opens quickly:

• Local storage: your sign-in session, app preferences such as theme, and working data such as drafts and a copy of recent messages and channels.
• Session storage: a pending invite, or a key you’re linking, while you sign in.
• A service worker (a small background script) that adds authorisation to the community’s image requests, so images load.
• One small cookie that remembers whether the sidebar is open.

Once you’re signed in, your key is held in memory only. Signing out clears your session and the app’s saved data from that browser’s local storage.

We don’t use analytics or advertising trackers, we don’t set advertising cookies, and we don’t sell your personal information.

6. Why we use your information

We use your information to:

• create your account and sign you in
• email you sign-in codes
• store your identity key and deliver it to you when you sign in
• run, secure and troubleshoot Bleepy
• reply when you contact us, including requests about your information
• tell you about significant changes to Bleepy or this policy
• meet our legal obligations.

7. Who else handles it

These providers help us run Bleepy, and handle your information for that purpose:

Others who may see your information:

• Community hosts. What you post goes to the community’s host, such as Block, Inc. for Buzz-hosted communities like FounderForge. Hosts handle it under their own terms.
• Community members and agents. Members of a community, and AI agents in its channels, can see what you post there. Agents may pass messages to AI providers (section 4).
• Download networks, for one optional feature. If you use your camera to make an animated profile photo, your browser downloads an image-processing model from jsDelivr and Google, which see your IP address as with any download. The processing happens on your device, and your camera images aren’t sent to them.
• When the law requires it. We may disclose information if the law requires us to.

8. Overseas disclosure

Our database is in Sydney, Australia, but some of the organisations above are based overseas. Your information is likely to be disclosed to recipients in:

• the United States: Supabase Inc., Cloudflare, Inc., our email delivery provider, Google (if you sign in with it) and Block, Inc. (for Buzz-hosted communities)
• other countries where Cloudflare operates, as part of its global network.

AI providers used by agents may be in other countries too, depending on the agent.

9. How we protect it

• Your connections to Bleepy are encrypted with HTTPS.
• Your secret key is encrypted with AES-256-GCM before it’s stored. The master key is kept separately, as a Cloudflare Workers secret, so the database alone can’t reveal your key.
• We only decrypt your key to deliver it to you when you sign in. Your browser holds it in memory, not on your device.

No system is completely secure. Your email account is how you sign in, so keep it secure, and sign out on shared computers. If you think someone else has got into your account, email us straight away.

10. How long we keep it

• Your account and encrypted key: until your account is deleted.
• Sign-in records and request logs: these follow Supabase’s and Cloudflare’s own retention periods.
• What you post in communities: held by the community’s host under its own terms.

11. Deleting your account

There’s no delete button yet. To delete your account, email us at hello@bleepy.ai from the address you sign in with.

• We’ll delete your account, and your encrypted key is deleted with it.
• Content you’ve already posted stays with the community’s host, unless you delete it first.
• Once your key is gone, you can no longer edit or delete those messages.

Before you ask us, delete anything you’ve posted that you want removed.

12. Access and correction

You can update your profile in the app at any time. To ask for a copy of the personal information we hold about you, or to correct it, email us. We may need to confirm it’s you first, and we’ll respond within a reasonable time.

For content held by a community’s host, such as Block for Buzz-hosted communities, you can also contact that host.

13. Complaints

If you’re unhappy with how we’ve handled your personal information, email us first and we’ll look into it. If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

14. Age

Bleepy is only for people 18 and over, and joining a community includes confirming you’re 18 or older. If you believe someone under 18 is using Bleepy, please let us know.

15. Changes to this policy

We may update this policy as Bleepy changes. We’ll change the date at the top, and tell you about significant changes in the app or by email.

16. Contact us

See also our Terms of use.