Privacy Policy

Data we store

• Your account and profile — the email and identity your sign-in provider returns, your profile details, and the OAuth links connecting them.
• What you post — posts, comments, upvotes, bookmarks, attachments, and the communities and topics you join.
• Your social graph — who you follow, friend requests, and anyone you block.
• Direct messages — conversations and their participants. Message content is encrypted with a per-conversation key that is itself encrypted to each participant, so a database dump alone does not read your messages. Conversation membership and timing are not encrypted.
• Meetings and video rooms — the rooms you create and who joined them.
• Jobs and applications — job posts and the applications you submit.
• Payments — subscriptions and vault accounts, so money owed between members can be tracked and settled.
• Moderation records — reports you file or that are filed about you, and any bans applied.
• Notifications — your preferences, push subscriptions if you enable them, and email preferences per workspace.

Who else receives your data

• GitHub — if you sign in with it. You authenticate there and it returns your identity to us.
• Stripe — subscriptions, checkout and payouts. Card and bank details go to Stripe directly and are never stored here.
• Resend — delivers our transactional email (invitations, message notifications, moderation notices). Your email address is shared with Resend for delivery.
• Sentry — error reports (stack trace, page URL, browser) and session replays for a small sample of sessions. Replays mask all text and inputs and block media, so message and profile content is not recorded.
• Cloudflare (R2) and Backblaze (B2) — store files you attach to posts, and archived content.
• Google (Gemini, via the Vercel AI Gateway) — when a community grows past its most recent posts, older public posts are summarised into a digest. Direct messages are never sent.
• Upstash — a Redis cache and job queue. It holds transient identifiers and job metadata, not message content.

Everything else runs on our own infrastructure. We do not sell or rent your personal data.

Why we process it, and where it goes

We process your data to provide the service you signed up for (contract), to keep it secure and prevent abuse (legitimate interests), to take payments and meet tax obligations (legal obligation), and to send optional notifications (consent, which you can withdraw in settings). Several providers above are based in the United States; where your data is transferred outside the EU or UK we rely on the provider's Standard Contractual Clauses or its EU–US Data Privacy Framework certification.

Cookies

A session cookie keeps you signed in. It is strictly necessary and is not used for tracking or advertising. There is no third-party advertising or cross-site tracking on this service.

How long we keep it

Your content stays while your account does. Deleting a post removes it and its attachments; deleting your account removes your profile, posts, comments and messages, and cancels any subscription. Moderation and payment records may be retained where we are required to keep them, or where they concern someone else's report.

Your rights

You can download a copy of your data and delete your account yourself under Settings → Privacy. If you are in the EU or UK you can also ask us to correct your data or object to how we use it. Write to privacy@blueforge.studio and we will respond within 30 days.