Privacy Policy

To create an account we store your email address, an optional name, your interface language, and a password stored only as a salted hash. If you sign in with Google or Apple we store the identifier that provider gives us for you instead of a password.

We keep a record of security-relevant actions in your workspace — such as publishing, deleting, creating API keys, and connecting an AI agent — including the IP address the request came from.

We store what you write, upload, or import: drafts, published pages, earlier versions, images, and the sources you cite. Published pages are public. Drafts are visible only to you and to the agents you connect.

You own your content. From Settings you can export all of it as Markdown and JSON, and you can delete individual pages or your whole account. Deleting your account removes your workspace, publications, pages, versions, and connections from our database.

We set a session cookie that keeps you signed in. It is not readable by scripts, is limited to this site, and is never sent to publication subdomains. A second cookie remembers the interface language you chose, and a short-lived one holds a draft you start before creating an account so it isn’t lost. We set no advertising or cross-site tracking cookies.

Published pages count visits without cookies. For each view we record the page, the site the visitor came from, the type of device, and a visitor identifier that is a salted hash rotated every day. The hash cannot be turned back into an IP address and cannot link one day’s visits to the next. We also record page-speed measurements (Core Web Vitals).

Visitors whose browser sends Do Not Track or Global Privacy Control are not counted. Known bots are excluded.

If a visitor subscribes to a publication, we store the email address they entered for that publication.

When you use AI writing or editing, the text you provide is sent to the AI model provider configured for the service in order to produce the result. We record how many tokens each request used so we can enforce plan limits. Text found inside documents and web pages you import is treated as material, not as instructions.

Google Search Console — if you connect it, we request read-only access and store an encrypted token and the search performance data for your verified site. Disconnecting deletes both.

AI agents and API keys — connections act with only the permissions you grant, and you can revoke them at any time. API keys are stored as hashes.

LOOPIS — a separate network that provides the recommendation area on published pages. When it is on, a visitor’s browser loads a script from LOOPIS, which therefore receives that request and the address of the page, and its own privacy terms apply to what it shows. A publication’s owner can switch it off.

Each publication controls its own crawler access. Search crawlers are allowed by default; AI-training crawlers are blocked by default and are a separate setting. These choices are published in the publication’s robots.txt, which well-behaved crawlers follow.

We don’t sell personal information, and we don’t use your drafts or your visitors’ data for advertising profiles.

Questions, or a request to access or delete your data: support@bloting.com.