Blip Privacy Policy

Effective: 13 September 2026
Last updated: 13 September 2026

The short version

1. People see you type. In a Blip conversation, the others in it see your words as you write them, before you press send. That is what the app is, not a setting you forgot to turn off.
2. Text you never send still passes through our servers, and is then deleted. It goes to the people you are talking to, and is removed the moment you send it, clear it, leave the conversation, switch away from the app, or lose your connection. It is never added to your message history, never put in a notification, and never written to a log. A copy stays on your own phone for up to seven days so a crash does not cost you your sentence.
3. Blip is not end-to-end encrypted. Your data is encrypted in transit and encrypted at rest on Google's servers, but we could technically read it. The one routine time a person actually does is when someone files a report, which takes a copy of the reported message.
4. Nothing here is collected for advertising or analytics. No analytics library, no advertising identifiers, no tracking across other apps, no location, no contacts, no payment details. Every kind of data Blip holds is there to make the app work. Section 3 lists them.
5. You can delete everything from inside the app — Profile, then Delete account — and you have to be at least 13 to be here in the first place.

The rest of this document is the detail.

1. Live typing: what happens to text you have not sent

This is the part of Blip least like other messaging apps, so it goes first.

While you are typing in a conversation, your in-progress text is sent to the other people in that conversation and appears on their screens as you write it. Not a "typing…" dot — the actual words, in the place your message will sit once you send it. Within a conversation this cannot be switched off, because it is the app.

Here is exactly what happens to that text.

• It travels over an encrypted connection to Firebase Realtime Database, where it is held at drafts/{conversationId}/{yourUserId}/{session}. That record holds three things and nothing else: the current text, the time of your last keystroke, and the time the draft began. The last two are written by the server's clock so their order cannot be faked. That is storage, briefly, and we would rather say so than imply the text only ever exists in flight.
• It is never copied into our message database. There is no history of it. There is only the current value, overwritten as you type.
• It is never included in a push notification, and never written to our logs.
• It is deleted when you send the message, when you clear the text box, when you leave the conversation, and when you switch away from the app. If your connection drops or the app is force-quit, our server deletes it for you — the instruction to do that is registered with the database at the moment your connection opens, so it does not depend on your phone being reachable.
• Only members of that conversation can read it, and that is enforced by our server's rules, not just by the app.
• Live typing does not start until a conversation is actually two-way. In a one-to-one conversation your typing is not shared until each of you has sent at least one message. In a group, it is not shared until something has been said in the group. A stranger who knows your username can message you; they cannot watch you compose a reply to a thread nobody has spoken in. This is enforced on the server: our database rules refuse a draft write until a server-written flag for that conversation says the condition is met.
• Blocking someone stops it immediately. Blocking a person in a one-to-one conversation clears that flag and deletes the drafts in that conversation there and then. Unblocking restores live typing only if the two-way condition still holds.
• You are asked to acknowledge this behavior before any of your typing is ever transmitted, and we keep a record that you did — a date, nothing more.

A copy of your own unsent text is also kept on your device, so coming back to a conversation does not lose your work. This is real storage, not a cache we can wave away, so here is how it is held: the file is written with iOS complete file protection, meaning it cannot be read while your device is locked, and it is excluded from device backups. It is deleted when you sign out or delete your account, and any draft more than seven days old is discarded. We check that when the app launches and again when you open that conversation, so an untouched draft can sit on your own phone slightly past the seven days until one of those happens.

Two other things live only on your device and never reach us: which conversations you have pinned, and which you have removed from your inbox. They sit in the app's own preferences, labeled with your account, and are cleared when you sign out or delete your account.

What no policy can fix. The people in your conversation can read, remember, screenshot or write down anything you type, including the sentence you decided not to send. Blip cannot prevent that and no technical measure could. Treat anything you type in a Blip conversation as something you have said.

2. Who is responsible for your information

Blip is made and run by Andrew Bui, an individual in California, United States. Blip is not a company. There is no team, no office, and no data protection officer — when this policy says "we", it means one person.

3. What Blip collects

Apple asks every app to declare the kinds of data it collects, and Blip's declaration lives in the app itself, in PrivacyInfo.xcprivacy. This table is that declaration in plain words, and it is the whole list. Apple's categories are broad, so one row can hold several kinds of record — the User ID row below is the clearest example, and it names them.

Everything in that list is used for one purpose: making the app work. None of it is used for advertising, analytics, or tracking, and none of it is sold or shared.

Where it lives:

Your password

Your password is handled entirely by Firebase Authentication, which stores it as a salted hash. Blip's own code never receives it, never stores it, and never logs it. We cannot see your password, and it is not kept anywhere in a form anybody — including us — could turn back into the password you chose. If you forget it, the only thing we can do is help you reset it. That is not a limitation we are apologizing for; it is the point.

Date of birth

Asked once, at sign-up, to check you are at least 13, and then discarded. Section 9 sets out exactly what happens to it.

4. What Blip does not collect

This list is unusually short for a messaging app, and all of it is verifiable in the app's own build:

• No analytics. FirebaseAnalytics and FirebaseCrashlytics are not built into Blip at all — nor is any other analytics, attribution or crash-reporting library. There is no usage profile, no funnel measurement, and no setting to turn off, because there is nothing there to turn off.
• No advertising identifiers, and no advertising. Blip shows no ads and works with no ad network.
• No tracking across other apps or websites. Nothing we hold is ever combined with data from another company for advertising or measurement, and nothing goes to a data broker. Blip therefore never shows the iOS tracking permission prompt, because there is nothing to ask you about.
• No location. Blip never asks for location permission and never reads a coordinate. The only place location could have reached us is inside a photo or video you send, and section 5 explains how that is removed before upload.
• No access to your contacts or address book. You find people by typing their exact username.
• No phone number.
• No payment information of any kind. Blip is free. There are no purchases, no subscriptions and no in-app currency, so there is nothing to bill and no card details to hold.
• No health, biometric or financial data.

We also do not build a browsable directory of users. Our rules allow looking up one account by its exact username and specifically refuse any request to list accounts, so nobody — including another Blip user — can harvest the user base.

One honest footnote. The Firebase libraries Blip is built on report a small amount of their own technical information to Google as part of making a request, such as which Firebase components and versions are in use. It carries none of your content, we never see it, and it is not used to profile you. Google also keeps its own operational logs for the services Blip runs on, under Google's retention, which we do not control.

5. Photos and videos, and the metadata inside them

A photo or video straight from a camera usually carries hidden metadata, and the most sensitive part of it is where it was taken. Blip removes that before anything is uploaded.

• Photos are re-encoded on your device before upload. Re-encoding cannot carry the original EXIF, so the GPS coordinates go with it. This happens to every photo, including your profile picture and group pictures. You do not have to ask.
• Videos are rewritten on your device before upload, through the iOS filter built for exactly this (AVMetadataItemFilter.forSharing()), which drops location and recording-device metadata. If that rewrite fails, the send fails. The original file is never uploaded as a fallback — we would rather lose the send than the guarantee.

Your photo library. The first time you tap attach, or choose a profile or group picture, iOS asks whether Blip may see your library. The alert is Apple's; we never re-skin it, and you can answer allow, limit to a selection, or don't allow.

• Only the items you pick are read. Nothing else in your library is opened, scanned, indexed or uploaded, and nothing is uploaded until you send.
• If you answer don't allow, the rest of Blip works normally; you just cannot attach media.
• You can change your answer any time in iOS Settings, under Privacy & Security, then Photos.

6. Notifications

If you allow notifications, we send one when a message arrives for you.

• A push notification carries the sender's name, the group's name if it was a group, and, for a text message, the beginning of the text (up to 180 characters), so it can appear on your lock screen. For a photo or a video it says only that one was sent. Getting it to your phone means passing it through Firebase Cloud Messaging and Apple's Push Notification service, so those two services handle it on the way. That is a direct consequence of Blip not being end-to-end encrypted.
• Unsent live typing is never sent as a notification. Only a sent message produces one.
• Separately, an entry is written to your in-app Notifications tab. That entry holds a copy of the message — the sender's name, whether it was text, a photo or a video, the group's name, and for a text message a copy of the text. It sits under your own account and only you can read it.
• Muting a conversation stops its push notifications, but activity still appears in your Notifications tab. Blocking stops both.
• You can turn notifications off entirely in iOS Settings, and Blip works without them. Your push token is removed from your account when you sign out on that device, or when it stops working.

7. Who else can see your information

Other people

• Your display name, username and profile picture are visible to anyone you share a conversation with, and to any signed-in user who types your exact username. Treat them as public within Blip.
• Your messages, photos, videos and live typing are visible to the members of that conversation and to nobody else. Every read and write is checked on our servers against conversation membership; the app's own checks are convenience, never security.
• Group membership is visible to the other members of that group.
• A group's history is visible to whoever is in the group now. Someone added to a group can read what was said before they arrived: the server authorises reading a conversation's messages against who belongs to it at the time of the read, not against when each person joined.
• Not visible to other users: your email address, your block list, your private nicknames, your mute settings, and anything about your age check.

What blocking does. Blocking stops someone sending you messages, stops their live typing reaching you, and stops anything they do producing a notification for you. It is enforced on our servers, not hidden in the app. Three limits, stated plainly: in a group you both belong to their messages still appear, because silencing someone in a shared conversation is the group admin's call and not a side effect of your private setting; it is not retroactive, so messages already in the conversation stay; and it is one way for messages — you can still write to them, and they still get a notification when you do. Live typing is the exception, because it belongs to the conversation rather than to either of you: a block switches it off in both directions, so you stop seeing them type, they stop seeing you, and neither of you shows as present there. A reaction stops writing a row to the top of either inbox for the same reason.

Service providers

Two companies are involved in running Blip, and no others.

Google (Firebase) is where Blip runs, and the only company we send your information to. Google processes it for us under Firebase's terms and does not use it for its own purposes.

Apple distributes the app and delivers push notifications to your phone.

There is no analytics vendor, no advertising network, no CRM, no email marketing tool, and no customer support platform holding your messages.

We do not sell your information, and we do not share it for anyone else's purposes.

Legal requests

We may have to disclose information in response to a valid legal demand — a court order or a binding request from law enforcement. If that happens we will look at whether the request is valid, narrow it where we can, and tell the affected user unless the law or a court forbids it. There is no transparency report today; if that changes, this policy will say so.

8. Reports, and how moderation actually works

This is the one routine way a person other than your conversation's members sees message content, so it deserves to be spelled out rather than summarized as "we may review content".

• Reporting a message captures a copy of that message's text, along with who reported it, the account reported, and which conversation it happened in. The copy is taken on our server from the message as it was actually sent, so a report cannot invent text. Very long messages are truncated rather than dropped, and the report records that it is looking at only the start.
• Reporting a person, rather than a specific message, captures no message text at all.
• Andrew reads reports. That is the only routine way message content reaches a human operator.
• There is no moderation tool for browsing conversations. Blip has no message search, no bulk export and no "open this thread" button; a report shows the one message it captured. What remains technically possible is the database console Google gives the owner of any Firebase project, which is the same limit section 10 states: not end-to-end encrypted means exactly that. It is not used to read conversations, and there is no feature built on it.
• Unsent live drafts are never readable by an operator at all. Reporting cannot capture them, because by the time a report is read there is nothing left to capture.
• Reporting someone also blocks them, in the same operation.
• Acting on a report can mean deleting the message, disabling the account, or neither.
• Reports are kept for 12 months after they are resolved, and then deleted. That deletion is done by hand rather than by a scheduled job, so treat 12 months as the policy and not as a countdown timer.
• A report is not deleted when an account is deleted, in either direction. A report about an account is the record of why something was removed, and letting someone erase it by deleting their account and signing up again would defeat the point. A report you filed is evidence about someone else, and is not yours to withdraw.

The honest limit. Blip is run by one person. Review is not instant, there is no 24/7 team, and nobody reads everything. If something is urgent or dangerous, write to safety@tryblip.app and block the person in the app, which takes effect immediately and does not wait for us.

How reporting works in more detail, including what a report does and does not capture, is set out in Safety and moderation.

9. Age, and what happens to your date of birth

You must be at least 13 to use Blip. People under 13 must not create an account. Blip is not directed to children, and we do not knowingly collect anything from anyone under 13.

When you sign up, Blip asks your date of birth once. Exactly what happens to it:

1. It is sent once, over an encrypted connection, to our server.
2. The server works out whether you are at least 13.
3. It records only that you met the minimum, the date it checked, which rule it applied (a 13+ minimum), and that the age was self-declared rather than verified.
4. The date of birth itself is never stored. It is not written to the database and not written to the logs — a failure records a reason code such as "underage", never the date. It exists only for the moment the check takes.
5. If you are under 13, no account is created. Your device creates the sign-in credential first, so your password is only ever handled by Firebase Authentication; the age check then runs on our server; and if it says you are under 13, that same call deletes the credential before it answers. No profile, no username, nothing else is written. A date we cannot read is refused without deleting anything, so you can correct it and try again; a daily sweep removes any credential left without a profile behind it, whether sign-up was never finished or that deletion itself failed.

We do it this way because a date of birth is a permanent identifier, and keeping one for every user would create a risk far out of proportion to the question it answers.

The limit, stated plainly: this is a self-declared age check, not verification. Someone can type a false date. Stronger age assurance would mean collecting an identity document, a payment instrument, or a face scan, which would be a far larger intrusion on everyone.

If we learn that an account belongs to someone under 13, we delete it. If you are a parent or guardian and believe your child under 13 has an account, write to privacy@tryblip.app and we will delete it.

10. Security, stated precisely

• Your data is encrypted in transit (TLS) between your phone and our servers, and encrypted at rest on Google's infrastructure.
• Blip is not end-to-end encrypted. We, and Google as our host, are technically able to read your messages and your live typing. We say this plainly because "encrypted" is routinely used to imply more than it delivers. If Blip ever gets end-to-end encryption, this policy will say so after it is built and verified, not before.
• Passwords are held only by Firebase Authentication, as salted hashes. Our code never sees them.
• Every read and write of a message, photo, video, draft or presence record is authorized on the server against conversation membership.
• Sign-up, reporting and account deletion are protected by Firebase App Check, so they can only be called by a genuine copy of Blip and not by a script.
• Media is stored by internal path, never at a guessable public URL. Permission to fetch a link to a photo, a video or a group picture is checked against conversation membership every time the app asks for one. A profile picture is the exception: any signed-in user may fetch one, which is what section 7 means by treating it as public within Blip.
• What that does not do, because the difference matters: a link the app has already fetched is a bearer link — whoever holds it can fetch that one file without signing in — and it keeps working until the file is deleted. Blip never saves those links; they are fetched when a photo is displayed and dropped when you sign out. But a link already used, and a photo already saved to someone's phone, cannot be called back.
• Unsent text on your device is stored with iOS file protection and kept out of your backups.

No system is perfectly secure. If personal information is exposed in a breach, we will email the affected users without unreasonable delay — email, because that is the channel that exists — and notify the authorities where the law requires it.

11. How long things are kept

12. Your choices

See and correct your information. Your display name, username and profile picture are editable in the app, in Profile. For anything you cannot see or fix there, write to privacy@tryblip.app.

Delete your account. In the app: Profile, then Delete account. It is not a deactivation. It removes:

• your sign-in credential, including your email address and password hash;
• your profile, your username claim (which becomes available again), and your profile picture;
• your private settings — your block list, your nicknames, your age-check record, your acknowledgement of live typing;
• your notification history and your push tokens;
• the record of any message you hid from your own view;
• every message you have sent, in every conversation, with the photos and videos attached to them;
• every one-to-one conversation you were part of, in full;
• your unsent drafts on that device, along with your pinned and removed-conversation lists and the copy of your messages the app had cached locally. Your drafts on our servers are gone by then in any case, because they only exist while you are connected.

For groups, you are removed from the membership and your messages are deleted, but the group continues for the people who remain. If you created it, admin passes to the member who has been in it longest, and they are told by a notification that names you, so they do not discover it by accident.

Three consequences worth being clear about:

• Deleting your messages leaves gaps in group conversations other people can still see. That is the honest consequence of pulling your data out of a shared space.
• Copies other people already took outside Blip — screenshots, saved photos — are beyond our reach.
• A few records other people made stay, because they are those people's data rather than yours: a private nickname someone gave you stays under their account and from then on shows against an unknown user; a block someone placed on you stays; and reports stay, as section 8 explains. None of them contain your messages, your email address, or anything from your profile beyond the name you used.

Get a copy of your data. There is no export button today. If you want a copy of what Blip holds about you, write to privacy@tryblip.app and it will be put together by hand, which means it will not be instant. We would rather tell you that than advertise a mechanism that does not exist.

Turn things off. Notifications and photo library access are both yours to change any time in iOS Settings, and Blip keeps working with both switched off. Live typing is the one thing you cannot switch off inside a conversation, because it is what the app is — so the way to withdraw from it is to delete your account, which you can do yourself, in the app, in one place.

Block someone. Blocking is in the conversation's menu and in a person's profile, and takes effect immediately.

No retaliation. Using any of these choices will never get your account treated worse.

13. If you live in California

Andrew is a Californian, and many of Blip's users will be. To be straight with you about the legal position: a free app run by one person almost certainly does not meet the revenue or volume thresholds that make an operator a "business" under the CCPA and CPRA, so this policy does not claim that status. It offers you the substance of those rights anyway, as a matter of policy:

• Know what is collected, why, and who it goes to — section 3, section 4 and section 7 are that disclosure, and they are the complete list.
• Access a copy of what we hold about you — section 12.
• Delete it — in the app, immediately, or by asking.
• Correct it — in the app, or by asking.
• No retaliation for asking for any of the above.

There is no sale of personal information and no sharing of it, in the CCPA sense or any other. No money and no data change hands, there is no advertising, and there is no cross-context behavioral advertising. We have no actual knowledge of selling or sharing the personal information of anyone under 16, because we do not sell or share anyone's.

Write to privacy@tryblip.app to exercise any of this. We will ask you to send the request from the email address on the account, because that is the only way we can tell it is you.

14. Where your data lives, and who Blip is for

Blip runs on Google Cloud in the us-central1 region, in the United States, and is operated from the United States. It is intended for users in the United States.

If you use Blip from outside the United States, your information is stored and handled in the United States, under United States law. This policy does not claim compliance with the GDPR, the UK GDPR or any other non-US data protection regime, and there is no EU representative — claiming otherwise would be the exact kind of promise this document is written to avoid. Access and deletion requests are honored for anyone who asks, wherever they are.

15. Changes to this policy

Every change updates the "last updated" date at the top, and where a change materially affects you we will also email the address on your account. There is no in-app notice of a policy change today, and this policy will not promise one before it is built. Smaller corrections — a clearer sentence, a fixed typo — just get the new date. The current version always lives at https://tryblip.app/privacy.

16. Contact

Questions about this policy, or about your information:

privacy@tryblip.app

Blip is operated by Andrew Bui, California, United States. See also the Terms of Service.