Privacy Policy

Blog App ("we", "us", "our") is an independent publishing platform where writers can create, publish, and share long-form content. We are committed to handling your personal information with transparency, care, and minimal collection.

This Privacy Policy applies to all services operated under the Blog App brand, including our website, web application, and any related services.

If you have questions about this policy, please contact us at privacy@blogapp.io.

Information You Provide

• Account Data — Your full name, email address, and a hashed password when you create an account.
• Profile Data — An optional bio, location, website URL, and profile photo you choose to upload.
• Content Data — Blog posts, drafts, comments, and any media files you upload to the platform.

Information We Collect Automatically

• Session Cookie — An httpOnly, sameSite: strict JWT cookie is set upon login to authenticate your session. It expires after 2 days. No third-party cookies are used.
• Server Logs — Standard request logs recording timestamps, HTTP methods, and status codes for operational purposes. These are not linked to your identity.

What We Do NOT Collect

• We do not use advertising trackers, Google Analytics, Facebook Pixel, or any third-party analytics.
• We do not collect device fingerprints, IP address logs tied to user identities, or browsing history.
• We do not use any form of behavioral profiling or interest-based targeting.

We use collected information exclusively to:

• Create and manage your author account and authenticate your sessions.
• Display your public author profile, published stories, and bio to other readers.
• Associate your name with your published or draft posts.
• Send essential transactional emails (e.g., password reset) — never unsolicited marketing without explicit consent.
• Maintain the security and stability of the platform.

We do not sell, rent, or trade your personal information to any third party.

We may share data only in limited circumstances:

• Legal Compliance — If required by law or court order. We will notify you where legally permitted.
• Service Providers — Infrastructure providers (hosting, database) under strict data processing agreements who cannot use your data for their own purposes.
• Business Transfer — In the event of a merger or acquisition, under the same privacy obligations.

We implement industry-standard security measures including:

• bcrypt password hashing (cost factor 10) — Passwords are never stored in plain text.
• Signed JWT sessions — Authenticated with a secure secret key, 2-day expiry.
• httpOnly + sameSite:strict cookies — Session tokens are inaccessible to JavaScript and protected against CSRF.
• HTTP security headers — We use helmet.js for HSTS, X-Frame-Options, X-Content-Type-Options, and a strict Content Security Policy.
• Input sanitization — All user-generated content is sanitized before rendering to prevent XSS attacks.

You have the following rights over your personal data:

To exercise any of these rights, email privacy@blogapp.io. We respond within 30 days.

We use exactly one cookie:

There are no advertising, social media tracking, or analytics cookies. You can clear this cookie at any time by logging out.

If we make material changes to this Privacy Policy, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email. Continued use of the platform after such changes constitutes your acceptance of the updated policy.