Privacy Policy for The Blog

Updated 2026-10-04. The Blog is operated by Actual Intelligence Labs LLC. This policy describes how The Blog website and mobile app handle information during the invitation-only beta. Use our private support form to contact the people who run The Blog about privacy.

Your invitation and sign-in

An inviter supplies the name and email address or phone number of the person they want to invite. We store the name and destination and compare the destination’s normalized form when checking the invitation. We also store the invitation link, its sponsor where applicable, and its creation, expiry, revocation, and use information. This can include information about a person who has not joined The Blog. We use it to limit signup to the intended recipient, manage invitations, and prevent abuse.

Signup starts from a valid invitation link and requires a verified sign-in identity that matches its recipient. A link alone does not let a different person join. Members can create a limited number of single-use links that expire after three days. The inviter can see the destination they entered and whether the link is open, used, expired, or revoked. The invitation does not reveal a different email address or phone number used in a failed sign-in attempt, or give the inviter access to your private account information.

Sharing an invitation is an explicit choice. The Blog does not message your contacts automatically. When invitation delivery is enabled, a member or operator may explicitly request an invitation by email or text. The configured delivery provider receives the selected recipient and invitation message. A delivery attempt is recorded so we can show its status and limit repeated messages. Invitation expiry stops the link being used; it does not automatically erase the invitation record. If you received an invitation and do not want your information retained, contact us through Support for a review.

You can instead prepare a personal phone invitation and open it in your own messaging app. Only the selected number and invitation message are passed to that app; you review the message and press Send yourself. This does not request an automated text from The Blog or create an automated-text permission record. Canceling the composer leaves the invitation available in Friends. We store a private request identifier and the selected name and number to recover interrupted requests without creating extra invitations. These request records remain until you delete your membership, even if the associated invitation is removed; they are not proof that a message was sent or received. Your data download includes the preparation times, without the recipient’s contact details or reusable invitation links.

For an automated invitation text sent by The Blog, the inviter individually selects each recipient, reviews the message, and expressly confirms that each person agreed to receive a one-time invitation text from The Blog on the inviter's behalf. Contact access and general account agreement are not this confirmation. We store the inviter's account identifier and public name, selected recipient names and phone numbers, the exact confirmation wording and version, and the server-recorded time. This records the inviter's statement about prior permission; it does not independently establish what the recipient said. Only authorized operators can review the complete record. An inviter's data download includes their own statement, version, and time, without other people's contact details.

We retain this private invitation confirmation after a link expires, is revoked or deleted, or the inviter deletes their account, to investigate complaints and prevent repeated messages. A minimal phone-number digest and first-attempt record also remain to prevent another automated invitation to the same number. We send at most one automated invitation text per number, with no reminders or recurring invitation messages; an uncertain or failed attempt is not retried. This restriction is separate from verification codes you request for sign-in. Contact Support to request review of retained records. We do not sell or share phone numbers or SMS permission records for third-party marketing or advertising; service providers may process them as necessary to deliver the requested message, investigate a delivery complaint, or meet a legal obligation.

Google processes Google sign-in and provides Supabase and The Blog with your account identifier, verified email, and profile information such as your name and picture. We use that information to authenticate you, check your invitation, and set up your account. We do not receive your Google password.

When Sign in with Apple is enabled, if you choose it, Apple and Supabase process your sign-in and provide an Apple account identifier and a verified email address, which may be an Apple private relay address when you choose Hide My Email. We do not receive your Apple password. A private relay address does not replace proof that an invitation belongs to you: you first verify the invited phone number or email before connecting Apple to the same account. Existing members can connect Apple from Settings.

We keep Apple authorization credentials encrypted on the server so we can revoke our access when you delete your account. They are never included in invitation links, public profiles, or data downloads. If an Apple sign-in attempt does not qualify for membership, we attempt to revoke the new authorization. Successfully retained credentials remain private for cleanup and retry if that revocation fails. Deletion waits for confirmed revocation rather than leaving an active authorization behind.

Email-code sign-in and optional verified email linking are available. When code sign-in is enabled, you can enter your email or international phone number, or choose a code delivery method for your username. The server privately resolves a username to its current verified contact; it does not show that contact or whether a method is connected to someone who has not signed in. A new recipient must have a matching live invitation before a code is sent through this flow, and verification checks the invitation again. Your username is not a secret or a verification factor. A login code proves access to its destination; it does not by itself complete two-factor authentication.

If you choose to add an email during optional onboarding or in Settings, we verify ownership before associating it with the same account. Adding an email does not create another membership, merge two accounts, turn on discoverability, or replace an existing authenticator requirement. We keep the original admission email as historical membership and enforcement information, separately from your current verified sign-in email. Codes and temporary verification context are used to complete the requested sign-in or change, not to publish contact details.

Your account and writing

We store your sign-in email or verified phone number, account identifier, name, handle, profile, pledge and signature, and the writing and media you choose to share. We also store comments, messages, follows, likes, saves, reposts, notifications, and account settings. Your sign-in email and phone number are not displayed on your profile or published to other members. An inviter already knows the destination they supplied for your invitation.

When phone push notifications are enabled, you can choose whether this device receives them. We store a push-delivery token, device platform, an installation credential hash, and the account session it belongs to. Expo routes delivery through Apple Push Notification service or Google Firebase Cloud Messaging. Lock-screen alerts use neutral text without names, posts, or message content. Your notification choices also apply to push alerts. Turning them off removes that device registration; signing out or deleting your account revokes it. Completed or closed delivery records are removed after seven days during routine processing; pending records remain until delivery processing finishes. Inactive device registrations expire after 30 days. Cleanup can be delayed during an outage. Your phone may retain notifications already delivered; you can clear them in its notification center.

When a new member signs the pledge, we privately record their explicit agreement to the Terms, acknowledgement of this Privacy Policy, the versions shown, their confirmation that they are at least 18, and the time of confirmation. This age statement does not collect a birth date or independently verify age. We do not create historical confirmations for members who signed before this record existed. Your record is included in your data download and removed when your account is deleted.

Phone sign-in and finding friends

Phone sign-in and verification are available as an optional sign-in method. When phone verification is available and you choose it, Supabase and its configured text-message delivery service process the number you enter to deliver verification codes. We keep your verified phone number privately to recognize your account. Phone numbers are not published in profiles or returned as contact matches to other members. Verification attempts use temporary verification information and rate-limit records to prevent repeated requests and code guessing.

Contact matching is optional and requires a verified phone number. Before reading contacts, the app explains the check and asks for your consent and your device's contact permission. It reads names and phone numbers from the contacts your device makes available under that permission. Only normalized phone numbers are sent to The Blog over an encrypted connection for matching; contact names stay on your device during matching and are not used to guess who someone is. The app checks a limited number of contacts each time. You can skip this feature, and you can change contact access in your device settings.

Numbers submitted for matching are processed temporarily and are not saved as an address book or used to send invitations or messages. The app does not keep syncing contacts in the background. Its temporary contact list is cleared when you close the feature, navigate away, sign out, or put the app in the background. The single invitation currently being prepared may remain in app memory to recover an interrupted request; this is not a saved address book. We retain per-account usage counts and dates to limit repeated checks, without retaining the numbers checked. If you separately choose to create an invitation for individually selected people, we ask you to review the names and destinations that will be stored with those invitations as described above.

Being found is a separate choice, off by default. You must explicitly turn on discoverability before members who have your verified number can receive your profile as a match. You can turn it off from Find and invite friends. Blocking prevents matching in both directions; private accounts still approve new follow requests. Turning discoverability off prevents future matches and does not remove existing follows or information someone already saw. A missing match does not reveal whether someone has an account.

Pre-publication safety screening

Pre-publication screening is on. Submitted text, supported still images, and every frame of supported GIFs are sent to OpenAI for automated content-safety classification before publication.

When this feature is enabled, it checks newly submitted posts, comments, repost commentary, and public profile changes, including names, handles, profile text and uploaded images. This includes writing shared only with approved followers on private accounts. The automated service receives submitted text and supported still-image bytes. Supported GIFs are decoded into still images so every frame can be checked; the original animation is preserved when published. It does not receive your direct messages, address book, invitation destinations, sign-in credentials or pledge signature through this screening feature. Account restrictions and existing human-report processes remain separate.

A clear classification allows the normal publication checks to continue. Flagged submissions, unsupported media such as video, animated PNG or WebP, GIFs beyond processing limits, and submissions that cannot be classified are held privately. Authorized operators can inspect the exact held text and media, approve publication, or reject it. Approval publishes the submitted content only if current account and visibility checks still pass; rejection does not publish it. You can check the status or cancel a pending submission in Your submissions. A held profile update leaves the previous public profile in place. New-account names and avatars use safe defaults until their public changes pass the process.

Pending drafts and their media expire after seven days. On publication, rejection, cancellation or expiry, routine processing removes the held draft text and media; a published copy remains under the normal account and content rules. The private decision record, including category flags, decision time and operator notes, is retained for up to 30 days from the original submission. Account deletion removes your held submissions. Maintenance outages can delay cleanup; backup retention is separate from removal in the live service. Operators cannot promise immediate erasure of every backup copy.

Your data download includes your available held text, submission status and times. To keep downloads bounded, held media files, internal category flags and reviewer notes are not included. Contact Support before the draft expires if you need help obtaining your own held media. This does not provide other people's private information.

Automated classification can make mistakes. It does not determine whether writing is AI-generated, truthful, sincere, selling or vagueposting, and it does not guarantee that content is safe. Our pledge and human reporting process still apply. Contact Support to request a review of a decision.

When external classification is enabled, OpenAI processes the submitted text and supported images under its API data practices. OpenAI states that API data is not used to train its models by default unless the customer opts in; endpoint-specific retention and any account settings govern its handling. See OpenAI's API data controls. We do not promise that all provider technical records are erased immediately. Existing content is not automatically sent for retrospective classification by this feature.

Your feed

We use follows and interactions with pieces, including opens and time on screen, to order your feed. This activity is linked to your account. “Not interested” stores a private preference that hides that piece from your recommendations; it is not a public reaction or a moderation report. You can undo it, and your account archive includes these preferences. We temporarily store a private ordering of recommended piece IDs to keep scrolling consistent and vary comparable recommendations when you refresh. That ordering expires after 20 minutes and expired records are cleared during later feed requests. The Blog does not currently show advertising or include an advertising SDK.

Who can see it

The beta requires an invitation. Private writing is available to you and accepted followers; comments on a visible public thread remain visible there. Blocking limits access in both directions. Messages are available to their conversation participants; they are not end-to-end encrypted. Service operators can access stored information to operate the service and investigate safety issues.

Public records and deletion

An authenticated account deletion request creates a private status receipt. We store a hash of its random code, the account identifier while removal is pending, and request, expected-processing and completion times. The receipt does not contain your name, contact details or writing. Pending records stay until removal finishes. Completion removes the account identifier from the receipt; routine cleanup removes the remaining receipt record after 30 days. Cleanup may be delayed during an outage. A cookie lets this browser check the receipt for up to 90 days, including after sign-in is removed; anyone you give the receipt code to can see its status. This confirmation record is separate from the private enforcement records described below.

The Banned List, its published evidence, and decided appeals can be read without an account. These records may identify the subject by their chosen name, handle, picture, and writing. Account deletion removes the account, profile, writing, messages, media, and the subject’s identity and original evidence from public ban and appeal pages. Your private current email and phone mappings and discovery preference are removed with your account, and unused invitations you sponsored are revoked. A minimal private enforcement record, including an account identifier and verified email or phone identities associated with a ban or private suspension, can remain to prevent evasion and preserve the review record. This includes verified email replacements while a ban or suspension is active. Lifting a decision stops that decision blocking access; it does not automatically erase its private review history. These identity matches are never published on the Banned List. Other people’s writing remains theirs. If a provider is unavailable, a private cleanup job remains until removal completes. Safety restrictions can also remove material from public access.

Use Download your data or Delete your account in settings. Your export identifies your current verified email and separately labels the original admission email as historical; it does not include other members’ login contacts or private enforcement identity matches. If you cannot sign in or want a retained record reviewed, use the deletion request form. Ownership must be verified before a request changes an account.

Private account suspension

Moderators can suspend an account after reviewing a report. The account loses access to member content and invitations, and its writing and profile content are hidden while the suspension is active. Suspension records, reviewer notes and verified identity matches stay in the private moderation system. They do not create a public Banned List entry. We retain the decision and verified identities, including verified replacements during a suspension, so changing credentials or deleting and recreating an account cannot bypass an active decision. A reviewer can lift a suspension; that does not automatically restore separately restricted items or previously revoked invitations. You can request a private review or account deletion through Support.

Service providers and storage

Our hosting and security providers may derive approximate location, such as city or country, from your network address to operate and protect the service. The Blog does not request precise device location.

Vercel serves the app, Supabase provides authentication, database and file storage, Cloudflare Turnstile helps prevent automated abuse, and Resend delivers service email. Google processes Google authentication, and Apple processes optional Sign in with Apple when enabled; Twilio processes requested phone verification messages and, when its separate invitation delivery service is enabled, the one-time invitation messages described above. These providers receive information needed for their service, including technical connection information such as network address, device and browser details, and request times. Connections to The Blog use HTTPS. Cookies keep you signed in; local browser storage remembers interface preferences. If you choose to share an invitation through another app, that app handles the link under its own privacy practices.

Help and safety requests

Support requests store the email and words you submit in a private review queue. Private safety and community reports record the item, reporter, reason, explanation and review outcome privately. Community reasons include AI content, LARPing, selling and gatekeeping or vagueposting; these are allegations for human review, not automatic findings. A keyed hash of the request’s network address is used to limit repeated support submissions; expired limit records are pruned on later requests. Do not submit passwords or verification codes. Requests and review records are retained while needed to handle the issue, prevent abuse, and operate the service; contact us to request review of retained information.

Contact The Blog about privacy. The Terms describe the membership agreement. Any future advertising or material change to these practices will require updated disclosures and applicable choices before implementation.