This policy explains how [Company], based in France, handles personal data when you use Blueping (blueping.dev), an iMessage API for developers. It covers two groups: developers who use the API, and people who text an app through the Blueping line. We do not sell personal data.
Who is responsible for your data
For developer accounts, [Company] is the controller.
For the people an app texts, the developer of that app is the controller: they decide why and how their app talks to you. Blueping acts as their processor and handles that data only to run the service for them. Developers must tell the people who join their app who they are and how they use their data, so the developer's own notice is the first place to look.
What we store about developers
When you open an account, we store:
- Your handle: the phone number or Apple email you texted from.
- Your API key and session tokens, stored as hashes.
- Your app name, which people see when they talk to your app.
- Your webhook URL and its signing secret.
- Your usage of the free plan, and the messages between your app and your own iPhone (the contact “me”).
What we store about people who text an app
When you text an app's code to the Blueping line, we store:
- Your handle: the phone number or email you text from.
- The apps you joined, the one you currently talk to, and when you joined.
- Whether you opted out.
- The text of the messages you send and receive, with their date and status.
Why we use it
We use developer data to open and secure your account, sign you in with one-time links, send and receive your messages, deliver your webhooks, apply the free plan limits and answer your requests. The legal basis is our contract with you (GDPR, Article 6(1)(b)). We also use it to prevent abuse and keep the line working, which is our legitimate interest (Article 6(1)(f)), and to meet legal obligations (Article 6(1)(c)).
For people who text an app, we use their data to deliver messages between them and that app, apply the line's limits, and pass their messages and events to the developer through the API and webhooks. Blueping also answers the line's keywords (MENU, LEAVE, HELP and STOP) and keeps a record of opt-outs, so that a STOP applies to every app on the line.
When you email hello@blueping.dev, we use your address and your message to answer you.
Where your data goes
Blueping is hosted on Cloudflare (Workers and D1), which acts as our processor. Messages travel through Apple's iMessage service, which Apple runs under its own terms and privacy policy, and through a Mac that runs Messages for the Blueping line.
The developer of the app you talk to receives your handle and your messages through the API and at the webhook URL they choose. We disclose data to authorities only when the law requires it.
Transfers outside the European Union
Your data may be processed outside the European Union, in particular in the United States, by Cloudflare and by Apple. Transfers to Cloudflare rely on the EU-U.S. Data Privacy Framework, under which Cloudflare is certified, and on the European Commission's Standard Contractual Clauses in its data processing terms.
How long we keep it
We keep personal data for these periods:
- Messages: deleted after 90 days.
- Developer account data: kept while the account is open and deleted when it is closed, unless the law requires us to keep it longer.
- A person's handle and opt-out record: kept as long as needed to deliver their messages and to keep their opt-out effective.
- Emails to hello@blueping.dev: kept as long as needed to handle your request.
Security
API keys and session tokens are stored as hashes. The site and the API use HTTPS. Every webhook is signed with your webhook secret, so your server can check that it came from Blueping.
Cookies
The site uses only the cookies needed to sign you up and keep you signed in. We use no advertising trackers.
Your rights
Under the GDPR, you can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. You can also give instructions on what happens to your data after your death. Email hello@blueping.dev and we will answer within one month. We may ask you to confirm that the handle concerned is yours.
If you text an app on the line, its developer controls your data, so contact them first; we will pass on any request we receive. You can also text LEAVE to leave the current app, or STOP to stop messages from every app on the line.
You can file a complaint with the CNIL, the French data protection authority (cnil.fr).
Minors
Blueping is not meant for minors, and apps on Blueping must not be aimed at them.
Changes to this policy
We will post any update on this page with its date, and tell developers before a significant change takes effect.
Contact
[Company], France. Email: hello@blueping.dev.