Blab Privacy Policy

Last updated: 23 July 2026

Blab is a chat app for practising languages with someone you know. This policy explains, in plain language, what information the app handles and which service providers process it. We keep this short on purpose.

The honest version: we don't show ads, we don't sell your data, and we don't run behavioural or product analytics. Hosted builds use scrubbed crash diagnostics to keep the app stable. Your messages are not end-to-end encrypted in this version — that protection is planned for a future update. Today your messages travel over a secure (HTTPS/TLS) connection and are stored on access-controlled servers located in the European Union.

Delete your account: use Profile → Delete account in the app, or request deletion on the web if you no longer have access to the app.

Who is responsible for your data

Blab is operated by Anastasiia Yezhyzhanska, Furkastraße 81, 12107 Berlin, Germany ("we", "us"), who is the data controller for the information described here. You can reach us about privacy at nastia.ez@gmail.com.

What we collect

Account details — your account ID, email address, and the display name you choose.
Messages — the chats you send and receive, so we can deliver them and show your history.
Language preferences — your interface and learning languages, to set up chats and learning aids.
Message activity — read receipts when you enable them. Typing indicators are optional, short-lived realtime signals and are not stored in a Blab application table.
Notification details — a device notification token and your message-preview preference, so we can notify you about new chats.
Safety reports — when you report a person or message, we store the reason, optional details, and the selected evidence needed for review.
Diagnostics — if the app fails, Sentry receives a technical error report such as a stack trace and app/device context. Default personal information is disabled and message request bodies are redacted.

Message notifications

On Android, Blab uses Google Firebase Cloud Messaging to deliver notifications. Message previews are on by default and can be disabled in Profile → Notifications. When previews are on, the sender's display name and original message text are sent through Google for notification delivery. When previews are off, Google receives only generic notification text and the identifier needed to open the chat. Translations are never included in notifications.

How your messages are translated

When you enable translations, Blab sends the text of an eligible message through OpenRouter to an eligible model-infrastructure provider. Requests are restricted to endpoints that OpenRouter classifies as Zero Data Retention, as not collecting prompt data, and as supporting all required response parameters. The eligible infrastructure provider may change without changing these restrictions. The text is sent only to produce the learning aid; it is not used to show you ads. Blab stores successful output so it can be shown again without sending the same message for processing again. OpenRouter may retain non-content request metadata such as token counts and latency.

Who we share information with

We use a small number of service providers to run the app:

Supabase — secure database and hosting for your account and messages (servers in the EU).
Google — when you choose "Sign in with Google", and through Firebase Cloud Messaging for Android notifications as described above.
OpenRouter and eligible model-infrastructure providers — AI learning aids under the controls described above.
Sentry — scrubbed crash and error diagnostics for app stability.

We do not sell your personal data, and we do not share it for advertising. (Under laws like California's CCPA/CPRA, we do not "sell" or "share" your personal information.)

Why we're allowed to use your data (legal basis)

Where laws such as the EU/UK GDPR apply, we process your data to provide the service you asked for (delivering and translating your messages and running your account). You can close your account at any time.

Where your data is processed (international transfers)

Your account and messages are stored on servers in the European Union. Some of our service providers operate outside the EU/your country — for example the translation provider (OpenRouter and its eligible model-infrastructure providers), Google sign-in and Firebase messaging, and our crash-diagnostics provider (Sentry) may process data outside the EU. We use provider contractual and transfer safeguards where applicable.

Your privacy rights

Depending on where you live (for example under the EU/UK GDPR, Brazil's LGPD, California's CCPA/CPRA, and similar laws), you have the right to:

access the personal data we hold about you;
correct it if it's wrong;
delete it in the app or through our public deletion request page;
get a copy of it to take elsewhere;
object to or restrict certain processing, and withdraw consent;
complain to your local data-protection regulator.

To exercise any of these, email nastia.ez@gmail.com. We don't charge for this and we won't treat you differently for asking.

Keeping and deleting your data

We keep your account and messages for as long as your account exists. You can delete your account from Profile → Delete account, or use our public deletion request page. Deleting your account removes your profile and messages from our live database. Temporary copies may remain in provider infrastructure backups and logs until they expire under the applicable project/provider schedule. Minimized evidence that forms part of an abuse or safety report may be kept for 180 days after the report is resolved, or longer when a legal hold or reporting duty requires it.

How we protect your data

We use HTTPS/TLS encryption in transit, access controls so only the people in a chat can read its messages, and EU-based hosting. No system is perfectly secure, but we take reasonable steps to protect your information. If a data breach affects you, we will notify you and the relevant regulators where the law requires.

Cookies and tracking

The Blab app contains no advertising or behaviour/product-analytics SDKs, and these policy pages set no tracking cookies. We don't build advertising profiles about you. Sentry crash diagnostics are used only to investigate app stability; Google Play classifies that purpose as "Analytics" in its Data Safety form.

Automated processing

Translations are produced automatically by an AI service. This is a convenience feature — we don't use it, or any other automated process, to make decisions that have legal or similarly significant effects on you.

Sensitive information

We don't ask for special-category data (such as health, religion, or political views). Because Blab is a chat app, your messages could contain whatever you choose to type — please avoid sharing sensitive personal details you wouldn't want stored.

Information we handle (categories)

For laws that ask us to list categories (such as California's CCPA/CPRA), we handle: identifiers (email, account ID), your name, your user content (messages and language settings), and technical diagnostics, device/app identifiers used for notifications, and optional message activity. We disclose these only to the service providers listed above to run the app, and we do not sell or share them for advertising.

Children

Blab is only for adults aged 18 and over and is not intended for anyone under 18. We have zero tolerance for child sexual abuse and exploitation; see our Terms of Use for our child-safety standards and how to report concerns.

Changes

If we change this policy we'll update the date at the top. When end-to-end encryption ships, this page will be updated to reflect it.

Contact

Questions? Email nastia.ez@gmail.com.