Privacy Policy
Last updated: August 6, 2026
This Privacy Policy explains how blury (“blury,” “we,” “us”) collects, uses, discloses, and protects your information when you use our website and services (the “Service”). blury is operated from Ontario, Canada, and for data-protection purposes the operator of blury is the data controller (and the “business” under California law). You can reach us, including on any privacy question or request, at hello@blury.ai.
We try to keep this document short enough to actually read and specific enough to be worth reading. Where we name a retention period or a provider below, that is what the software does today, not an aspiration.
1. Information we collect
- Account information. Your email address, a password hash (if you sign up with a password) or the basic profile details returned by your sign-in provider (currently Google), your display name and optional profile picture, and, if you enable two-factor authentication, the secret needed to verify your codes.
- Age confirmation. At sign-up we ask you to confirm you meet our minimum-age requirement. We record that you confirmed it. We do not collect a date of birth.
- Content you provide. Writing requests, documents, writing samples, style preferences, remembered notes, and files (including images) you submit, plus saved writing history and documents.
- Usage and metering data. Token counts, request counts, and timestamps, used to enforce plan limits and rate limits.
- Operational telemetry. While you have a page open we record a short-lived session record containing an opaque session id, the page path, the site build you loaded, your approximate country and your browser’s user-agent string, plus your email address if you are signed in. This is first-party only, is used to see whether the Service is up and being used, is never sold or shared for advertising, and is deleted automatically (see Section 9).
- Error diagnostics. When a generation fails we store the error and enough context to debug it.
- Security data. Your IP address is used in-memory and in short-lived rate-limit records to throttle abusive traffic.
- Payment information. If you subscribe, our payment processor (Stripe) collects and processes your billing details directly. We never receive or store your full card number. We keep only limited subscription information (plan, status, period end, and Stripe customer and subscription identifiers).
- Support messages. Anything you send us by email or through an in-app feedback form.
2. How we use your information, and our legal bases
We use your information to:
- Provide, maintain, secure, and improve the Service.
- Generate the responses and drafts you request.
- Meter usage, enforce plan limits, and prevent abuse and fraud.
- Manage subscriptions and process payments.
- Send you service email you need in order to use your account: address verification, password reset, and sign-in codes. We do not send marketing email. If we ever start, it will be opt-in and every message will carry an unsubscribe link, as Canada’s Anti-Spam Legislation (CASL) requires.
- Respond to your support requests.
- Comply with legal obligations and enforce our Terms.
Where the EU/UK GDPR applies, our legal bases are: performance of our contract with you (providing the Service, billing); our legitimate interests (securing and operating the Service, preventing abuse, understanding whether the Service works); your consent (where we ask for it, such as the optional Google Drive import); and compliance with legal obligations. You may withdraw consent at any time, without affecting processing already carried out.