The short version. BLAB. is a social app, so what you publish is meant to be seen. We store your account, your posts and the settings the app needs to work — nothing else. There are no intrusive ads or advertising tracking. Sponsored challenges are clearly labelled, and we never sell your data. You can export everything or delete your account from inside the app, at any time.
Who we are
BeatLabs FZE LLC ("BeatLabs", "we", "us"), a company registered in Ajman Media City, United Arab Emirates, operates the BLAB. mobile application (the "App") and is the data controller for the information described here. You can reach us at [email protected].
Where your data lives
Our database and file storage run on Supabase, hosted in the European Union (Ireland). Push notifications go through Apple's Push Notification service on iOS. The current Android app shows activity inside the app; background push notifications are not enabled. Sign-in is handled by Apple or Google, whichever you choose.
Our websites (getblab.app, including the public page of a shared post, and the web app at blab.day) are served by Cloudflare. Like any web host, Cloudflare sees the IP address and browser details of whoever opens a page, including a shared link, and keeps them briefly in its logs to run and protect the site. From those same servers we see totals only — pages served per day and per country — to know whether anyone is visiting. No script runs in your browser for this, and the websites set no advertising or tracking cookies.
What we collect
Your account
- Account identifier and email address, received from Sign in with Apple or from Google when you sign in. If you use Apple's "Hide My Email", we only ever see the relay address.
- Your @name, which is public.
Your profile
- Optional avatar, bio and up to three links.
- Country, as a two-letter code taken from your device's region setting. It is used only for the "My country" ranking, and you can change it in Settings. We do not use location services and we never collect your GPS position.
- Your streak, whether you have BLAB. Pro, and the date you accepted the community guidelines.
What you publish
- Posts (up to 280 characters), the challenge, world and mode you chose, and the date. Edits are marked as such.
- One photo, or one video of up to 15 seconds, with the alternative text you write for it. Attached files are stored in our media bucket and are readable by anyone who has the link.
- Comments, reactions and who you follow.
- Blocks and reports you create, so that we can enforce the guidelines.
Your published posts, comments, reactions, follow relationships and public profile are visible inside the App. Blocks and reports are private. A post you share has a public web page at getblab.app/p/….
How the App is used
When you open a post, open its image, tap its link or share it, we record that action together with your account identifier and the time. We use these signals to rank content and to understand what works. They are first-party only: they never leave our systems, they are not sold, and they are not used for advertising or to track you across other apps and websites.
Automated review of what you publish
The text of every post and comment goes through two automatic checks after it is published: simple server rules against spam (repeated texts, brand-new accounts posting links) and an automated classifier that looks for what the guidelines forbid. The classifier is run by OpenAI, an AI provider, which receives the text of the post together with its world and mode and nothing else: not your name, @name, account or device. Its answer is a verdict and a one-line summary that only our moderators see. Nothing is removed on its say-so alone: it can hide a post while a person looks at it, and the person decides. OpenAI does not use text sent to its moderation service to train its models. Every hide and removal is logged with its reason.
If we suspend your account, we keep the kind of suspension (temporary or permanent), the reason we show you and its dates. The export in Settings → Your data includes them. The internal note a moderator writes about the decision is kept for the team and for appeals.
Notifications
If you allow notifications, we store the push token of your device along with its platform and language, so that our server can send you the notification. Turning notifications off in Settings stops this.
When the App crashes
On iOS, if the App crashes or freezes, the next time it opens it sends us a diagnostic report so that we can fix the bug: the signature of the failure and selected stack frames from the App and Apple system libraries, the reporting interval, the App version, the iOS version and the device model. It contains no content — nothing you wrote, saw or typed — and no identifier beyond your account. It is first-party (it goes only to our own database) and we keep it for 90 days. It is tied to your account while the account exists. Deleting your account removes that link; the diagnostic report can remain without your account identifier until the 90-day retention period ends. This is separate from Apple's own "Share with app developers" setting in iOS: that one goes through Apple, ours does not.
Purchases
BLAB. Pro is bought through Apple. Apple processes the payment; we never see your card or your billing details. After checking signed purchase information with Apple, we store your subscription expiry, product and transaction identifiers, purchase and verification timestamps, and whether the purchase was made in the production or sandbox environment. These records are tied to your account and prevent the same purchase being assigned to another account.
Two things that happen on your device only
- Image moderation. Before a photo is uploaded, iOS analyses it on the device to detect sensitive content. The image is not sent anywhere for this check, not to us and not to Apple.
- Muted words and unsent drafts stay on your device and are never uploaded.
Links you paste
When you paste a link into a post, our server fetches that page once to read its title and preview image. The website you linked to sees a request from our server, not from you.
GIFs
Posts can include GIFs from KLIPY, a GIF provider. When you open the GIF picker or view a post with a GIF, your device loads it directly from KLIPY, which therefore receives your IP address and basic device and app information, like any web request. The searches you type in the GIF picker go to KLIPY together with an anonymous identifier that is not your account, name or @name. We do not send KLIPY your posts or your account.
Rated works. When you use Check-in to attach a film, series, book, comic, game, dish, drink, album, podcast or place to an answer, what you type in that search goes through our server to the catalogue providers (TMDB or IMDb, TVMaze, Open Library, MyAnimeList, RAWG, TheMealDB, TheCocktailDB, Open Food Facts, OpenStreetMap and Apple) without your account, name or @name; the providers receive our server's requests, not your device's. The work you pick and your stars are part of your public answer, and its cover is copied to our storage.
Location pins. You can add a public place (a venue, a square, a city) to an answer. What you type in that search goes through our server to OpenStreetMap without your account. If you tap "Show places near me", the app asks for location permission and sends your position rounded to about 100 metres once, with that request, to list what is around; we never store it, never show it and never log it. Only the place you pick becomes part of your public answer. You can search by name without ever sharing your location.
Sponsored challenges
A brand that sponsors a challenge only receives totals: reach, answers, participants, comments and reactions. Never who took part. Reach is counted once a day per viewer from a hashed account id (or, for guests, a hashed install id), which identifies nobody. The sponsorship is bought inside the app through Apple or Google, who hold the payment details and issue the receipt; we keep the proposal, the brand name and the store's order number.
What we never do
- No intrusive ads or advertising tracking. Clearly labelled sponsored challenges.
- We do not sell or rent your data, and we do not share it with data brokers.
- We do not track you across other companies' apps or websites.
How long we keep it
We keep your data while your account exists. When you delete your account, your profile, posts, comments, reactions, follows, blocks, files, push tokens, notifications and usage signals are deleted. Crash diagnostics lose their account identifier and are deleted after 90 days. Reports you filed, or that others filed about your content, may be kept without your identity attached for as long as we need them to keep the community safe. Backups roll over within 30 days.
Your rights
Wherever you live, you can do all of this from inside the App:
- Get a copy of your data — Settings → Your data gives you a JSON file with everything.
- Correct it — Profile → Edit profile, and Settings for your name and country.
- Delete it — Settings → Delete account removes your account and content permanently. The steps, and what to do if you cannot use the App, are on the Delete account page.
If you are in the European Economic Area or the United Kingdom, you also have the right to object to or restrict processing and to lodge a complaint with your data protection authority. Our legal bases are performance of the contract (running your account and showing your content), our legitimate interest (keeping the community safe and ranking content), and your consent (notifications, which you can withdraw at any time). Write to [email protected] for anything the App does not cover.
Children
BLAB. is not for children. You must be at least 13 years old, or older if the law where you live requires it, to have an account.
Changes
If we change how we handle your data, we will update this page and tell you inside the App before the change takes effect.