Privacy Policy

1. What we collect

Account details (name, email), content you create or unlock, and payment records processed by our payments partner. We do not ask for your date of birth when you sign up. Creators who set up payouts provide identity details — including a date of birth — directly to our payments partner, who verifies them; we receive only whether the check passed.

2. How we use it

To operate the service, process payments and payouts, prevent abuse, and meet legal obligations.

3. Processors

We share data with service providers strictly to run Blur — e.g. hosting, our payments partner, and age/safety vendors. When a creator uses AI Studio, the descriptions and prompts they enter and the reference images they choose are sent to our AI provider, Replicate, Inc. (United States), which runs the image and video models on our behalf; Replicate deletes these inputs and the results from its systems within an hour, and the results are stored by Blur. AI Studio personas are fictional — no photo of a real person is ever uploaded to it. When a creator makes a Blur Look real, the photo they chose — resized, with its location and camera data removed — goes to Replicate the same way, to be redrawn in that style. Blur deletes that photo once the Look is made and keeps only the result, privately with the creator’s account. Every photo, clip and profile picture you upload is checked before anyone else can see it: a reduced copy of the photo, or still frames taken from the clip, without location or camera data, goes to Replicate, which runs the model that checks it (Gemini, by Google) and deletes it within an hour in the same way. Feedback you send from your profile is kept by Blur with your account, the screen and the kind of device it came from, so we can look into it and answer you, and it is deleted with your account; what you wrote is also sent to Replicate, which runs a language model (Claude, by Anthropic) that sorts it by topic for us, and deletes it within an hour in the same way. When you unblur a post with friends, the link you send shows the people you send it to your first name, your profile picture and that post, blurred. When something in the app breaks, a technical report of the error — which page or request failed, the kind of browser and device, and the error itself — goes to our error-monitoring provider, Sentry (Functional Software, Inc.), which stores it in the European Union. It does not include your IP address, cookies, passwords or payment details, and your screen is never recorded. [Full list, and the transfer safeguards for each provider, to be completed by counsel.]

4. Your rights

You can request access, export, or deletion of your personal data. Some financial and age-verification records are retained where the law requires it.

5. Cookies, device storage and visit counts

We use only what the app needs to work: a sign-in cookie, and your own display choices (such as a collapsed sidebar) kept in your browser. We do not use advertising or tracking cookies. To count visits we store nothing on your device. For each page you open we record the page, the site that sent you, your device type (phone, tablet or computer) and your country, together with a visitor code our server derives from your IP address and browser. The code changes every day, so it cannot be used to follow you from one day to the next, and your IP address itself is not stored. We do this on the basis of our legitimate interest in knowing how Blur is used.

How the feed is ordered. We note how long each post is on your screen in the feed and the full-screen viewer. Together with likes, UnBlurs, comments and shares, that ranks posts for everyone. When you are signed in, the creators and categories you engage with, and the creators you follow, also lift those posts in your own feed, and posts you have already unlocked move down. Nothing is stored on your device for this. Viewing time is kept for 45 days: tied to your account when you are signed in, and to the daily visitor code above when you are not. We do this to run the feed you asked for and on our legitimate interest in showing posts people want to see.

6. Contact

[Data controller entity, jurisdiction, and privacy contact — to be completed by counsel.]