--- title: "Privacy at Sblurp" description: "What sblurp.chat stores about you, what it never stores, what it shares with communities you join, and how to get a copy or delete it." doc_version: 4 last_updated: 2026-10-17 --- # Privacy **Draft.** This policy is a first draft and is not final. It describes how sblurp.chat works today, in plain words. ## What sblurp.chat stores - Your email address, username and a hash of your password (argon2id). We never store the password itself. - Whether you confirmed your email. - From your date of birth: that you are 13 or older and whether you are 18 or older. If you are under 18, we keep the date you turn 18, so the flag can change on that day. We do not keep the date of birth itself. - The profile you choose to fill in: display name, avatar, bio and pronouns. - If you turn on two-factor sign-in: the secret your authenticator app uses, and hashes of your recovery codes. - If you add passkeys: each one's public key, the name you give it, and when it was added and last used. The private key never leaves your device. - Your active sign-ins: when they started, the last IP address and the browser name, so you can see and end them. - The app settings you choose to sync: its appearance, and the addresses of the communities you added, in your order, so they follow you to your other devices. ## What it does not store Messages, channels, files and member lists. Those live on each community's own server, and the people who run that server are responsible for them. Ask them how they handle it. ## Where your data lives Your account lives in the United States, on Fly.io in San Jose, California, with backups in Cloudflare R2. California has one of the strongest US privacy laws, the [California Consumer Privacy Act](https://oag.ca.gov/privacy/ccpa), and we follow its spirit for everyone, wherever you live. We may offer accounts in other regions, such as the EU, if people ask for them. A community's messages and files live wherever its owner runs the server. If a community runs its server in the EU, everything except your account stays there and only there. ## Why we keep it - To run your account: your email, username, password hash, age flags and profile. Without them there is no account. - To keep you and the service safe: sign-in IP addresses and browsers, two-factor data and the Turnstile bot check. - To keep a promise to you: old usernames are held for you for 90 days, so nobody else can take one right after you change it. We do not use your data for ads, profiling or training AI models, and we do not sell it. ## How long we keep it - Your account and profile: until you delete them. - Sign-ins: 30 days at most. Ended sign-ins, expired links and expired tokens are deleted every hour. - Old usernames: 90 days. - Backups: copies of the account database expire after about a day. Encrypted avatar backups keep monthly copies for up to 12 months. ## What we share, and with whom When you join a community, it receives a sign-in token with your account id, username, whether your email is confirmed, and the two age flags. Your profile goes to a community only after you agree in the app. We share nothing with advertisers, data brokers or analytics companies, because we do not work with any. The sign-up and password reset pages use Cloudflare Turnstile to stop bots. On those two pages, Cloudflare receives your IP address and some facts about your browser. It uses them only to decide if you are a person. Read [Cloudflare's Turnstile privacy addendum](https://www.cloudflare.com/turnstile-privacy-policy/). ## Companies that help run sblurp.chat These companies process data for us, only to provide their service. All of them are in the United States. | Company | What it does | What it sees | |---|---|---| | [Fly.io](https://fly.io/legal/privacy-policy) | Runs sblurp.chat | Everything sblurp.chat stores | | [Cloudflare](https://www.cloudflare.com/privacypolicy/) | Backups (R2) and the bot check (Turnstile) | Backups of sblurp.chat, and your IP address on the two Turnstile pages | | [Resend](https://resend.com/legal/privacy-policy) | Sends our email | Your email address and the message | If we add a company to this list, we update this page first. ## Email We send email only to confirm your address, to reset your password, and to tell your old address when you change it. No newsletters unless you ask for one. ## Cookies Three cookies: one keeps you signed in, one protects forms against forgery, and one remembers that you saw the cookie notice. No tracking cookies. ## Your rights Wherever you live, you can see, copy, correct and delete what sblurp.chat keeps about you. Most of it you can do yourself, below. For anything else, write to us and we will answer within 30 days. ## Getting a copy Download everything above as a JSON file from your account page, under Your data. ## Deleting your account Delete it any time from your account page. Your account, profile, avatar and sign-ins are removed from sblurp.chat right away. Communities you joined keep their own copies of your messages; ask their admins. ## Questions Write to [privacy@sblurp.chat](mailto:privacy@sblurp.chat). By post: Sblurp, 495 Jackson Street #1200, Oakland CA 94607, United States. ## Sitemap - [Sblurp: chat for communities](https://sblurp.chat/index.md): Sblurp is group chat with channels, threads and roles. Each community runs on its own server, and one Sblurp account signs you in to all of them. - [About Sblurp](https://sblurp.chat/about.md): Why Sblurp exists: chat for communities that each run their own server, with no ads, no unasked-for AI and an honest word on encryption. - [Privacy at Sblurp](https://sblurp.chat/privacy.md): What sblurp.chat stores about you, what it never stores, what it shares with communities you join, and how to get a copy or delete it. - [Terms of use](https://sblurp.chat/terms.md): The terms for a sblurp.chat account: who can sign up, what you must not do, and what we do and do not promise. A first draft. - [Create your Sblurp account](https://sblurp.chat/signup.md): Create a Sblurp account: one account for every Sblurp community you join. You need an email, a username, a password and to be 13 or older. - [Sign in to Sblurp](https://sblurp.chat/login.md): Sign in to your Sblurp account with your email or username and password, or with a passkey. One account works in every Sblurp community. - [Reset your password](https://sblurp.chat/forgot.md): Forgot your Sblurp password? Type the email you signed up with and we send a link to choose a new one. The link works once, for one hour. - [Sblurp docs](https://sblurp.chat/docs.md): Sblurp documentation: how accounts and communities work, how to run a community server, how to add bots, and the full API reference. - [Accounts and communities](https://sblurp.chat/docs/accounts.md): How a Sblurp account relates to the communities you join: what sblurp.chat keeps, what each community server sees, and what stays private. - [Join a community](https://sblurp.chat/docs/join.md): Join a Sblurp community: add it by address or invite link, answer its questions, choose what to share, and join. - [Sblurp glossary](https://sblurp.chat/docs/glossary.md): The words the Sblurp docs use, from account and community to issuer, track, bot token and seq, each with a link to the page that explains it. - [Run a Sblurp community](https://sblurp.chat/docs/self-host.md): Run a Sblurp community on your own server: one small program and one data folder. What you need, how to start it, and what it stores. - [Run a server](https://sblurp.chat/docs/create.md): For developers: start your own Sblurp community. Run the open-source server, join it first to become the owner, then set it up and invite people. - [Set up a server with AI](https://sblurp.chat/docs/ai.md): Not a developer? Ask an AI assistant such as Claude to set up your Sblurp community server. - [Sblurp server sizes and costs](https://sblurp.chat/docs/hosting.md): Which server size to rent for a Sblurp community and what it costs each month: measured limits per size and prices at Fly.io, DigitalOcean, Hetzner, OVHcloud and AWS Lightsail. - [Run Sblurp on Render](https://sblurp.chat/docs/render.md): Run a Sblurp community server on Render: one Starter web service with a persistent disk, the released image, and optional backups to Cloudflare R2. - [Run Sblurp on Railway](https://sblurp.chat/docs/railway.md): Run a Sblurp community server on Railway: one service from the released image, a volume for /data, and optional backups to Cloudflare R2. - [Run Sblurp on Fly.io](https://sblurp.chat/docs/fly.md): Run a Sblurp community server on Fly.io: one always-on machine with a volume, h2c streaming, and optional backups to Cloudflare R2. - [Run Sblurp on any VPS](https://sblurp.chat/docs/vps.md): Run a Sblurp community server on a small virtual server from Hetzner, OVHcloud, Akamai Linode, Vultr, DigitalOcean or any other host, with Docker Compose. - [Run Sblurp with Docker and Compose](https://sblurp.chat/docs/docker.md): Run a Sblurp community server with Docker Compose and Caddy: the files, the settings, where the data lives, and how to run it behind your own proxy. - [Run Sblurp with Podman](https://sblurp.chat/docs/podman.md): Run a Sblurp community server with a Podman Quadlet file, with daily automatic updates that roll back when a new image does not start. - [Sblurp server configuration](https://sblurp.chat/docs/configuration.md): Every flag and environment variable of the Sblurp community server, with defaults, plus the backup variables of the container image and the built-in limits. - [TLS and reverse proxies for Sblurp](https://sblurp.chat/docs/proxies.md): Put Caddy, nginx or Cloudflare in front of a Sblurp community server without breaking live streams: h2c, no buffering, no compression. - [Back up a Sblurp server](https://sblurp.chat/docs/backups.md): Back up a Sblurp community server: Litestream copies the database to Cloudflare R2 within 10 seconds, an encrypted backup tool copies the files, or make a plain copy. How to restore. - [Update a Sblurp server](https://sblurp.chat/docs/updates.md): Release tracks for the Sblurp server image, the daily update check, manual and automatic updates, and how to roll back. - [Verify a Sblurp release](https://sblurp.chat/docs/provenance.md): Check that a Sblurp server image was built by the public release workflow, with GitHub attestations or cosign. - [Troubleshooting a Sblurp server](https://sblurp.chat/docs/troubleshooting.md): Fix common problems with a Sblurp community server: sign-in fails, messages arrive late, certificates, file links, and where the logs are. - [Invites in Sblurp](https://sblurp.chat/docs/invites.md): Make a Sblurp community invite only, create invite links with an expiry and a use limit, and revoke them. - [Moderation and roles in Sblurp](https://sblurp.chat/docs/moderation.md): Permissions in a Sblurp community (owner, admin, moderator, member), custom roles that limit channels, channel modes, kicks and bans. - [Safety in Sblurp](https://sblurp.chat/docs/safety.md): Who can read your messages, how to protect your account, what to do about unwanted messages, how to report a message, what moderators can do, age rules, and how to reach sblurp.chat. - [Your data in Sblurp](https://sblurp.chat/docs/data.md): What sblurp.chat stores about your account, what a community server stores, who controls each, how long data is kept, backups, export and deletion. - [Sblurp bots](https://sblurp.chat/docs/bots.md): Two ways to add a bot to a Sblurp community: a JavaScript plugin on the server, or a program anywhere that uses the API with a bot token. - [Sblurp bot tokens](https://sblurp.chat/docs/bot-tokens.md): Make a Sblurp bot with a token, run the example bot, and call the API from any language: subscribe to events and reply to mentions. - [Connect an AI agent to Sblurp](https://sblurp.chat/docs/agents.md): How to connect a self-hosted AI agent, such as OpenClaw, NanoClaw or Hermes Agent, to a Sblurp community with a bot token. No built-in connector exists yet. - [Use Sblurp from Claude Code and other MCP clients](https://sblurp.chat/docs/mcp.md): Add a Sblurp community to Claude Code, Claude Desktop, VS Code or another MCP client by URL, sign in with your sblurp.chat account, and let the agent read and post as you. - [Sblurp plugins](https://sblurp.chat/docs/plugins.md): Write a Sblurp bot as one JavaScript file and install it in the app, with the API or in the plugins folder: hooks for joins, messages, slash commands and timers, replies, limits and the dice example. - [Sblurp API: protocol and transport](https://sblurp.chat/docs/api.md): How clients and bots talk to a Sblurp community server: Connect RPC over HTTP, the proto contract, JSON and binary bodies, auth, streaming and versioning. - [Sblurp API explorer](https://sblurp.chat/docs/api/explorer.md): Browse and try every call of the Sblurp community server API in your browser, from the OpenAPI 3.1 description in openapi.json. - [Sblurp API: sign-in and tokens](https://sblurp.chat/docs/api/auth.md): How sign-in works across Sblurp: OAuth 2.0 with PKCE at sblurp.chat, per-server access tokens, JWT claims, refresh token rotation, JWKS, and bot tokens. - [Sblurp API: events](https://sblurp.chat/docs/api/events.md): The Sblurp live event stream: Subscribe, sequence numbers, replay and resync, heartbeats, every event kind, who receives it, and unread counts. - [Sblurp API: uploads and files](https://sblurp.chat/docs/api/files.md): The plain HTTP endpoints of a Sblurp community server: uploads, signed file URLs, custom emoji, invite links and the health check. - [Sblurp API: errors and rate limits](https://sblurp.chat/docs/api/errors.md): Error codes the Sblurp community server returns, what each one means for a client, and the rate limits for people and bots. - [ServerService API reference](https://sblurp.chat/docs/api/server-service.md): Every ServerService call of the Sblurp community server: what it does, who may call it, and its request and response fields. - [ChatService API reference](https://sblurp.chat/docs/api/chat-service.md): Every ChatService call of the Sblurp community server: what it does, who may call it, and its request and response fields. - [BotService API reference](https://sblurp.chat/docs/api/bot-service.md): Every BotService call of the Sblurp community server: what it does, who may call it, and its request and response fields. - [API types](https://sblurp.chat/docs/api/types.md): The messages and enums the Sblurp community server API shares between calls, with every field.