Privacy policy — Blep and Blep Messenger

Who is responsible

The data controller is Krzysztof Grzesiak, residing in Warsaw, a private person (not a company). The service is a private, non-commercial project.

Contact for anything about your data: chat at blep.pl.

The information website

The service’s information website sets no cookies, uses no analytics or advertising trackers, and loads nothing from other servers.

Like any web server, it records in its access log the IP address, time, requested page and browser identification of each request. These logs are used to keep the site running and secure and are kept for 14 days.

What Blep Messenger stores

Account: your login, email address and a hash of your password (never the password itself), plus account settings.
Furs (identities): for each one, its display name, avatar, bio, short tag and settings. Friends, friend requests and blocks are stored per fur.
Conversations: the rooms a fur belongs to, and the messages, edits, replies, photos, videos, files, voice messages and stickers sent in them. A deleted message loses its content and stays as an empty placeholder. Call records appear as messages in the conversation.
Devices: a list of your logged-in devices (name, platform and last use), and, for devices that enable notifications, the push token used to wake them.
Technical data: server logs that contain IP addresses (kept 14 days) and short-lived counters used to limit abuse by IP address.

LiveChat messages are kept in the server’s memory only and are not written to the database.

Why, and on what basis

We use this data to provide the service you asked for (creating your account, delivering messages and calls, notifying you), and to keep it secure and prevent abuse. We do not show ads, build advertising profiles or sell data.

Under the GDPR the bases are performance of the service you requested (Art. 6(1)(b)) and our legitimate interest in security and abuse prevention (Art. 6(1)(f)).

Who receives data

Other users receive what you send them, and see the public profile of the fur you use.
Google Firebase Cloud Messaging delivers push notifications to Android phones and browsers that enable them. Notifications carry identifiers only, unless you turn on message previews in the settings. This data may be transferred to the USA under protection standards approved by the European Commission (the EU-US Data Privacy Framework).
Your email provider and our mail server handle the verification and password-reset emails we send you.
Calls are relayed by a server we run; the media is not recorded or stored.

The service runs on a server operated by the controller. We do not give your data to anyone else.

Security and encryption

Connections are encrypted in transit (HTTPS and secure WebSockets). Messages are not end-to-end encrypted: the server stores them in readable form, so the person running the server could technically read them. Passwords are stored only as hashes, and sessions can be listed and revoked in the settings.

On Android, the app keeps its local copy of your chats in an encrypted database. Web browsers keep a local cache in the browser’s storage.

How long we keep data

Account and conversations: until you delete them. Deleting your account ends your furs and sessions at once, and the data is purged after 30 days.
Logged-in sessions: a device stays signed in for up to 60 days after its last use, unless you log it out.
Server logs: 14 days. Call relay logs: 7 days.
Copies on your own devices stay until you log out or remove the app.

Your rights

You can ask for access to your data, correction, deletion, restriction of processing, a copy of your data in a portable form, and you can object to processing based on legitimate interest. Write to chat at blep.pl and we will answer within one month. You can delete your account yourself in the app’s settings.

You also have the right to complain to the supervisory authority: in Poland, the President of the Personal Data Protection Office (UODO).

Cookies and local storage in the messenger

The web messenger uses cookies that are strictly necessary to keep you signed in, and browser storage for its offline cache and your preferences. It sets no advertising or analytics cookies.

Changes

If this policy changes in a way that matters, we will say so in the messenger and update the date above.