Privacy Policy

Effective date: March 20, 2026

1. What We Collect

• Email address — provided at signup, used for account identification and transactional emails.
• Password — hashed with PBKDF2 (100,000 iterations, SHA-256). We never store or see your plaintext password.
• Stripe customer ID — created when you subscribe to a paid plan, used to manage your subscription.
• Deployed application code — the files you send to blob for hosting.
• Usage metrics — request counts, response times, and error rates collected via Cloudflare Analytics Engine.
• IP address — included in server logs by Cloudflare. We do not store IP addresses long-term ourselves.

2. How We Use Your Data

• Provide and operate the hosting service
• Process payments through Stripe
• Send transactional emails (password resets, billing confirmations)
• Enforce plan limits and usage quotas
• Prevent abuse and enforce our Terms of Service

We do not sell your data. We do not use your data for advertising.

3. Cookies

We use a single session cookie (aihost_session) to keep you logged in. This cookie is:

• HttpOnly — cannot be accessed by JavaScript
• Secure — only sent over HTTPS
• SameSite=Lax — protects against cross-site request forgery

We also use Cloudflare Turnstile for bot protection on signup and login forms. Turnstile may set its own cookies for verification purposes.

We do not use tracking cookies, analytics cookies, or advertising cookies.

4. Third-Party Services

We share data with the following services, only as necessary to operate blob:

• Stripe — processes payments. Receives your email and payment information.
• Cloudflare — hosts our infrastructure and provides Turnstile bot protection. Processes requests to your deployed apps.
• Resend — sends transactional emails (password resets, billing). Receives your email address.

5. Data Security

• All traffic is encrypted with HTTPS
• Passwords are hashed with PBKDF2 (100,000 iterations, SHA-256)
• Session tokens are 256-bit cryptographically random values
• Your apps run in isolated V8 sandboxes (Cloudflare Workers for Platforms)
• Infrastructure runs on Cloudflare's global network with built-in DDoS protection

6. Your Rights

You have the right to:

• Access — request a copy of the data we hold about you.
• Deletion — delete your account and all associated data. You can do this from your dashboard, or email us.
• Correction — request correction of inaccurate data.
• Export — request an export of your data.

To exercise any of these rights, email support@imblob.com or delete your account directly from the dashboard.

We are not an EU entity, but we respect the principles of GDPR and will honor data access and deletion requests from all users regardless of location.

7. Data Retention

• Active accounts — data is retained while your account exists.
• Deleted accounts — all data (apps, databases, files, account info) is permanently deleted when you delete your account.
• Payment records — Stripe retains payment history per their own privacy policy and legal requirements.

8. Session Metadata

When you use blob's AI coding session, we store the following metadata for debugging purposes (retained for 30 days):

• Session ID — an opaque identifier generated by the AI model.
• Account ID and app name associated with the session.
• Session start and end timestamps.
• Error messages and exit codes — captured only when a session ends unexpectedly.

We do not store the content of your conversations, prompts, or code — unless it appears verbatim in an error message.

Session metadata is accessible only to authorized blob team members via an internal API protected by a secret API key. Session records are automatically deleted after 30 days.

9. Children

blob is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us at support@imblob.com and we will delete the account.

10. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you via the email address associated with your account at least 14 days before the changes take effect.

11. Contact

Questions about this Privacy Policy? Email us at support@imblob.com.