Privacy Policy
Last updated September 2026.
1. What we collect
Your account: the email address and full name you sign up with, and which blogs you own or have been invited to. Passwords are handled by our authentication provider and never stored by us in a form we can read. Your content: the posts, images, fonts and designs you create, and the settings on your blogs. Readers of your blog: when someone reads one of your posts through the public API, we record the post, the time, and a salted hash of the reader's IP address and browser string. We never store the address or the browser string themselves. The hash exists only to avoid counting the same person twice within a short window, and it cannot be reversed into anyone's identity. Support: a bug report you file carries the page you were on, your browser string, your email address, and any screenshots you attach. Operations: we keep a log of staff actions, and a log of handled errors from the software itself. Error records can quote the message a failed request returned.
2. What we do not collect
No analytics or advertising trackers, on this site or on yours. The SDK you embed in your own site fetches your posts and does nothing else - it sets no cookies, sends nothing to us about your readers beyond the view count described above, and has no third-party scripts in it. We do not use your content to train machine-learning models, and we do not sell anything to anyone.
3. Cookies
Only what signing in requires: a session cookie set by our authentication provider, and a short-lived cookie used once to show you a newly created API key. There are no analytics, advertising, or preference-tracking cookies, which is why this site has no cookie banner - there is nothing to consent to.
4. Who else processes your data
We use a small number of providers to run the service, and each sees only what it needs: Supabase - the database and authentication, and therefore your account and all of your content. Cloudflare R2 - object storage for the images and fonts you upload. Resend - sends your verification code, team invitations, and staff invitations. Sees the recipient address and the message. Stripe - payments. Handles card details directly; we never see or store a card number. Stripe receives your email address and name in order to bill you. Vercel - hosting. Processes requests and keeps short-lived server logs.
5. Staff access
BlogBuddy staff can read account records, and can open the dashboard as you in order to reproduce a problem you have reported. Every one of those actions is written to an internal audit log that staff cannot edit or delete except at the most senior level, and that deletion is itself recorded. We do this to support and operate the service.
6. How long we keep things
Your content stays until you delete it or close your account. Spent rate-limiting records are discarded within a day. Screenshots on a bug report are deleted about ninety days after the report is resolved, while the text of the report is kept. Records of handled errors are deleted a month after they are marked resolved. View records are kept so your analytics keep working over time.
7. Deleting your account
You can delete your account from your settings page at any time. That removes the blogs you own, with their posts, uploaded media and API keys, and takes you off any blog someone else shared with you. Bug reports you filed and the internal audit record of staff actions are deliberately kept - the first so we can still fix what you reported, the second because an audit log that can be erased by the person it describes is not an audit log. You can export every post in a blog as JSON from the dashboard before you go.
8. Security
Tenant separation is enforced in the database itself, not only in application code, so your queries can only ever return blogs you own or were invited to. API keys are stored as hashes and shown to you exactly once. Uploads are checked by inspecting the file's actual contents rather than trusting its name or its declared type.
9. Children
BlogBuddy is not directed at children and we do not knowingly collect information from anyone under 13.
10. Changes and contact
We'll post material changes here with an updated date. Questions, or a request to access or delete your data: support@blogbuddy.net.