Privacy policy

Version 7 · in effect from 30 September 2026

Blip has no accounts. It never asks for your name, email address or phone number, and there is no profile to fill in. This page says exactly what is kept, because "we care about your privacy" is what everyone writes.

What Blip never collects

• No account, password or profile. We never ask for your name or phone number. The only email address Blip ever sees is one you choose to leave when you write to us, so that we can reply.
• No contacts, photos, calendar or advertising identifier.
• No analytics and no tracking, in the app or on this website. The website serves its fonts from our own server rather than from Google. A shared area page (blip.city/c/…) shows a small map drawn with tiles from OpenStreetMap, so opening one sends your IP address to the OpenStreetMap Foundation, as any map tile request does.
• No location in the background. Blip can only see where you are while it is open, and the app ships with no background location permission at all. Anyone can check that on the App Store listing.

The one identifier there is

Your iPhone proves it is a real device using Apple's App Attest, which gives each installation a random key. We store a scrambled version of that key so we can slow down a device that is abusing Blip, and so your own reports stay yours to update or withdraw.

We are honest about what this is. It is not your name and it is not linked to your Apple Account, but it does single out one installation, and European data protection law treats that as personal data even when nobody can put a name to it. What it means in practice:

• We cannot tell who you are, where you live, or what else you do.
• We keep a record that a device reported in a given area, so the same device cannot report the same place twice over. In a busy area that says almost nothing; in a quiet one, fewer reports mean less cover, which is why reports are grouped into areas rather than points.
• Because we cannot identify you, we cannot look up "your" data if you ask us to, and the law does not require us to collect more information in order to be able to (GDPR Article 11). Deleting the app removes what is on your phone; reports expire on their own within 30 days.

What a report contains

• The area it belongs to — about 100 m across. The exact point you pressed is used to work out which area that is, and is then rounded to the centre of that area before anything is stored. The exact point is never stored.
• The city name, so reports can be grouped by region.
• The tags you chose, your note if you wrote one, and the time.

Your own position is used once, rounded to about 500 m, to check that the place you are reporting is within 2 km of you. It is not stored.

What other people see

Only totals for an area: how often it has been reported and which tags people chose, and a short summary of the area. Your note is never shown to anyone, and no person ever reads it. Nothing on the map identifies who reported anything.

What happens to your note

Your note is never published and never shown to another user, in any form. It is not read by us or by anyone else at Blip.

What it is used for is the short summary that appears above an area's tags. That summary is written automatically, by a computer program, from two things: the tag counts, and the notes people wrote about that area, taken together. Nobody's wording is carried across into it, and no note is quoted or repeated.

The rules that summary is written under are deliberately narrow, and the program checks its own output against them before anything is published:

• The part written from notes exists only where at least three people have written a note about that area. Below that there is no summary from notes at all, only from the tags.
• It describes what several notes have in common. Nothing is said unless at least two separate notes support it.
• It never contains a name, a business, a vehicle, a number plate, a street or a landmark, and never a number or a time of day more precise than morning, afternoon, evening or night.
• Anything failing those checks is discarded, and the area keeps a summary written from the tags alone.

The app says which of the two you are reading, under every summary.

Anthropic provides the language model that writes these summaries, as a processor acting on our instructions. Notes sent to it are not used to train anyone's models. On our side, your note is kept for exactly as long as the report it belongs to — no longer — and is deleted with it, within 30 days. Anthropic keeps what it was sent for up to 30 days to run its service, and longer only if a note breaks its usage rules.

Official warnings

In Germany, Blip may also show official warnings from NINA, the federal warning system run by the BBK. Blip downloads every active warning in the country at once and your iPhone works out on its own whether any of them covers where you are. Your phone never contacts the warning service, so no authority learns that you use Blip or where you are, and neither do we. Which warnings you choose to show is kept on your iPhone.

When things are deleted

• Reports are deleted after 30 days, and your note is part of the report — it is deleted with it, on the same clock, with no copy kept anywhere.
• An area keeps a score that fades once people stop reporting it, so an old problem disappears on its own. That score is a number attached to a piece of ground, not to a person.
• A summary written from notes outlives the notes it was written from, because it contains none of them. Once the reports under an area age out, the summary goes with them.
• Your own list of reports lives on your iPhone. Deleting the app deletes it.
• The scrambled device key is deleted after a year in which that installation has not contacted Blip. Deleting the app ends the contact, so the key follows within a year at the latest.

Feedback

If you send feedback from the app, or write to us through the form on this website, we receive what you typed. From the app, and only if you leave that switch on, we also receive your iPhone model, iOS version and app version. No device key is stored with a message.

You can leave an email address so that we can reply. It is optional, it is used for nothing but answering that message, and it is stored with the message. Messages are deleted 90 days after they have been answered, or after a year if they never were. To stop the website form being flooded, it counts submissions per IP address for one hour and then forgets them.

Every message is delivered to our mailbox, [email protected], which is hosted by Google. The only other place a message goes is a notification to us on Telegram that a message has arrived — the notification carries no text and no address.

Who processes what

Blip is run by Abhishek Singh (see the Impressum), who is the controller for this data. Processing rests on legitimate interests (Article 6(1)(f) GDPR): running a map people can contribute to anonymously, and keeping it usable by limiting abuse.

• Hetzner — servers in Germany, where the app's requests arrive.
• Supabase, running on AWS in Ireland — the database.
• Cloudflare — serves this website, sits in front of the app's API, and handles the mail for [email protected]. Every request the app makes and every visit to this site passes through Cloudflare, which processes your IP address to do that, as it does for any site it serves. There are no cookies and no analytics on this site.
• OpenStreetMap Foundation — the map tiles on shared area pages. It sees the IP address of anyone who opens one, and nothing else from us.
• Google — hosts the [email protected] mailbox, so a message you send us, and the address you leave with it, is stored there under Google's terms for as long as we keep it.
• Telegram — receives a notification that a message or a flag has arrived, with no text and no address in it, so that we notice the same day.
• Apple — App Attest, which issues the device key, and the App Store.
• Anthropic — the language model that writes area summaries from the tags and notes. It receives notes and nothing else: no device key, no position, no times. It does not use them to train models.

No data is sold or shared for advertising, ever.

Everything above runs in the EU except the summariser: notes are sent to Anthropic, whose processing may take place outside the EU. That transfer is covered by the European Commission's standard contractual clauses. It is the only transfer out of the EU that Blip makes, and what crosses it is notes alone — never the device key, your position, or anything that could be tied back to you.

Your rights

You have the rights GDPR gives you, including access, correction, deletion, objection and complaint. As explained above, we hold nothing that lets us find your data on request, so the practical answer to most of them is that there is nothing for us to return. The one exception is a message you sent us with an email address on it: write to us from that address and we will show you, correct or delete what we hold under it. If you believe your data has been mishandled, you can complain to a supervisory authority — in our case the Hessischer Beauftragte für Datenschutz und Informationsfreiheit, or the authority where you live.

Children

Blip is not directed at children and collects nothing that would identify anyone, of any age.

Changes

Material changes to how existing features handle your data are published here at least 30 days before they take effect, and the app shows you what changed. A new optional feature that handles data in a new way describes that when you turn it on, and does nothing until you do, so it needs no advance notice. Every earlier version stays available.

Contact

[email protected]