privacy policy
last updated: 15 September 2026
1. Who we are
This Privacy Policy explains how Blobme Ltd (“Blob”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you use the Blob mobile application, website, helpdesk and related services.
We are the controller of the personal data we collect and use for the purposes described in this Privacy Policy, unless we tell you otherwise.
Our contact details are: Blobme Limited, company number 17177836, 14-16 Stanley Street, Holyhead, Anglesey, LL65 1HG, help@blobme.ai. Privacy requests should be sent to privacy@blobme.ai.
2. Scope and key points
This Privacy Policy applies to your use of Blob in Portugal and, where applicable, the European Economic Area.
Blob is a social and campus platform. Other users may see information you choose to make visible, including profile information, posts, group activity, community membership, event RSVPs and other public or semi-public interactions depending on your settings and feature choices.
Direct and group messages are not end-to-end encrypted unless we expressly state otherwise. Message content may be accessed in limited circumstances for safety, moderation, legal compliance, security and support purposes.
Some fields and activity may reveal sensitive information about you, such as political opinions, beliefs, ethnicity, health, dietary/religious choices or sexual orientation. We aim to minimise this risk and provide controls, but you should consider this before sharing information on Blob.
3. Personal data we collect
| Category | Examples |
|---|---|
| Account and verification | Name, university email address, password hash, date of birth or age confirmation, verification code/status, university, course, year of study, degree level and country of study. |
| Optional profile fields | Gender, pronouns, nationality, languages, accommodation type, hometown, biography, interests, prompts, looking-for preferences, social media links and CV/work information, where enabled. |
| Profile media | Avatar, cover image, photo gallery, uploaded images and associated metadata. |
| Posts, comments and reactions | Post text, images/videos, GIFs, polls and votes, tags, privacy settings, comments, replies, likes and emoji reactions. |
| Stories and highlights | Story images, text overlays, background colours, view records, likes, replies and highlight collections, where enabled. |
| Messaging | Direct and group messages, images, files, GIFs, emoji reactions, polls, read receipts, message requests, reply threads and timestamps. |
| Connections and matching | Connection requests/status, blocked users, swipes, match status, timestamps and related profile discovery data. |
| Events and communities | Event creator details, event metadata, location, RSVP and check-in records, group/community/society/núcleo membership, roles and chat activity. |
| Marketplace, petitions, external event ticket links, discounts and bookings | Marketplace: seller ID, listing title, description, price and currency, category, condition, photos, location text, preferred payment method, sold status, buyer ID once marked sold and watchlist saves. Petitions: creator ID, title, description, signatures, user ID and timestamp. Events: ticket price, currency and external ticket URL entered by the organiser. Discounts and bookings: no data collected unless and until those features are enabled. Blob does not process purchase or payment data. |
| Gamification | Blob Score inputs, activity events recorded in a server-side ledger with daily caps per action type, and the resulting score. Public leaderboard opt-in status, rank and display information are processed only if a public leaderboard is activated. |
| Reports and moderation | Reporter ID, target content/profile/message, reason, description, status, resolution notes and enforcement action. |
| Search, bookmarks and notifications | Search queries if retained, results served, saved content references, notification type, actor, content references, read status and timestamps. |
| Location data | Place names and latitude/longitude attached to posts, events, marketplace listings or check-ins where enabled. |
| Technical and device data | IP address, device type, operating system, app version, crash reports, logs, security events, local settings and cookie/SDK identifiers. |
4. Special category data and sensitive inferences
Some information you provide or generate on Blob may reveal or allow inferences about special category data under the GDPR, including racial or ethnic origin, religious or philosophical beliefs, political opinions, health information or sexual orientation.
Examples include nationality and languages, dietary preferences, petition creation or signatures, pronouns, matching behaviour, content posted in groups, messages or communities, and free-text profile or post content.
We will not intentionally require special category data unless necessary for a clearly explained feature. Where we process special category data, we will identify an Article 6 lawful basis and an Article 9 condition, such as explicit consent where appropriate.
You can reduce the amount of sensitive information processed by not completing optional fields, adjusting privacy settings, not joining sensitive groups or petitions, and deleting content you no longer want to share.
5. Purposes and lawful bases
| Purpose | Data involved | Lawful basis |
|---|---|---|
| Creating and managing your account | Account and verification data | Contract |
| Verifying university/student status | University email, university, course/year where needed | Contract; legitimate interests for platform integrity |
| Providing profiles, posts, comments, communities, messaging and core social features | Profile, content, membership, messaging and interaction data | Contract |
| Providing optional profile fields and optional CV/work section | Optional profile data and CV/work information | Consent or contract depending on feature design |
| Location tagging and location-based features | Place names and GPS coordinates | Consent where precise or optional location is used |
| Providing swiping/discovery/matching | Profile data, preferences, swipes, match status | Consent or contract with clear opt-in |
| Showing profile views | Viewer/viewed IDs and timestamp | Legitimate interests, subject to LIA and user controls |
| Calculating Blob Score internally | Activity metrics and score | Legitimate interests, subject to LIA/DPIA |
| Displaying users on a public leaderboard | Name/username, avatar, university, course, rank | Consent / opt-in if a public leaderboard is activated |
| Events, RSVPs and check-ins | Event data, RSVP/check-in records, location where used | Contract; legitimate interests for event management and safety |
| Marketplace listings and external event ticket links | Listing, seller, buyer-on-sale, watchlist, ticket price/currency and external ticket URL; no Blob payment or purchase data | Contract; legitimate interests; legal obligation where applicable |
| Petitions | Petition creator, petition content, signatures/support and timestamps | Consent; explicit consent may be required if special category data is involved |
| Trust and safety, reporting and moderation | Reports, content, messages, logs, account data | Legitimate interests; legal obligation where applicable |
| Security, fraud prevention, debugging and service integrity | Logs, IP address, device/crash data, security events | Legitimate interests; legal obligation where applicable |
| Service communications | Email, notifications, account details | Contract; legitimate interests |
| Marketing communications | Email, preferences, device tokens where used | Consent unless another lawful route is confirmed; ePrivacy rules apply |
| Operational analytics, crash/error monitoring and product improvement | Usage and interaction data, device data, aggregated metrics and crash/error logs | Legitimate interests for strictly necessary operational analytics and debugging; consent where non-essential analytics cookies/SDKs are introduced |
6. Profiling and automated processing
Blob uses automated processing to operate features such as discovery, matching, search, notifications, profile views, moderation tooling and Blob Score.
Blob Score may involve profiling because it evaluates or predicts aspects of user activity and engagement. Users should receive meaningful information about the main factors used and controls over any public display.
A public leaderboard is not live. If activated, public leaderboard participation should be based on opt-in consent unless a further legal assessment supports another approach. Users should be able to use the Service without appearing on a public leaderboard.
Matching and discovery features use automated logic to identify mutual interest or show relevant profiles. We do not consider this to have legal or similarly significant effects. You can manage discovery by pausing your account, which hides your profile from search and discovery, or by blocking individual users.
Account suspensions, content removals or other enforcement decisions may involve automated signals but should allow human review where required or appropriate.
8. International transfers
Our primary database and storage are hosted by Supabase in the EU West (Ireland) region (AWS eu-west-1).
Personal data may leave the EEA where push tokens or app updates are processed by Expo in the United States, where crash reports are processed by Sentry, where app store or push notification services are provided by Apple and Google, where transactional email is processed by Resend, or where Blob staff access data from the United Kingdom. Where personal data is transferred outside the EEA, we will rely on an adequacy decision or appropriate safeguards such as the European Commission Standard Contractual Clauses, together with a transfer impact assessment where required.
Where personal data is transferred from the EEA to the United Kingdom, we may rely on the European Commission’s adequacy decision for the UK for as long as it remains valid and applicable.
You may contact us for more information about the safeguards used for international transfers.
9. Retention
| Data category | Indicative retention |
|---|---|
| Account and core profile data | Until account deletion, plus up to 90 days in backups unless longer retention is required for legal, safety or dispute reasons. Account deletion removes data from the live service immediately: files are deleted from storage, the profile is anonymised, authored content is deleted and login identity is removed. |
| Optional profile/CV fields | Until removed by the user or account deletion, plus backup period. |
| Posts, comments, reactions and reposts | Until deleted by the user or account deletion, subject to copies shared by others, moderation records, legal retention and backups. |
| Stories | Visible for 24 hours unless saved as highlights; story view records retained for up to 30 days. |
| Highlights | Until removed by the user or account deletion. |
| Direct and group messages | Until deleted according to product functionality or account deletion, but copies may remain for other participants and moderation/safety records may be retained for up to 12 months. |
| Swipes and matches | Until account deletion or match dismissal, unless needed for safety, abuse prevention or legal reasons. |
| Profile views | For up to 90 days unless settings or product design require shorter retention. |
| Events and check-ins | For up to 12 months after the event, unless required for safety, dispute or legal reasons. |
| Marketplace, booking, ticketing or partner interactions | Marketplace listing, external ticket link and petition records are retained until deletion or account deletion as applicable, subject to legal, safety, tax/reporting or dispute needs. Booking, partner or paid-service records will be defined if those features are introduced. |
| Petitions and signatures | Until petition closure/deletion or account deletion, subject to transparency, public record, legal or moderation needs. |
| Blob Score and leaderboard records | Current score/rank while account is active; historic records retained only as needed for integrity, abuse prevention and analytics. |
| Reports and moderation records | Up to 3 years after resolution, or longer where necessary for legal claims, safety or regulatory compliance. |
| Technical logs and security data | Typically 30-90 days unless needed for security investigations, legal compliance or abuse prevention. |
10. Your rights
Under EU and Portuguese data protection law, you may have rights to access your data, rectify inaccurate data, erase data, restrict processing, object to processing, receive data portability, withdraw consent and challenge certain automated decisions.
You can exercise your rights by contacting privacy@blobme.ai. We will respond within one month unless an extension is permitted by law. Data portability/export requests are handled manually.
Where we rely on consent, you may withdraw consent at any time. This will not affect processing that occurred before withdrawal.
You can complain to the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority, although we would appreciate the chance to address your concerns first.
11. Security
We use technical and organisational measures designed to protect personal data, including encryption in transit, hashed password storage, access controls, logging, monitoring and security review practices.
No service is completely secure. If we discover a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required and notify affected users where required by law.
Because messages are not end-to-end encrypted unless expressly stated, you should not use Blob messaging for highly sensitive or confidential information.
12. Children and age assurance
Blob is intended for users aged 18 and over only. Date of birth is required at signup and users under 18 are rejected.
If we become aware that we have collected personal data from a child who is not permitted to use the Service, we will take appropriate steps to delete or restrict the account and related data, subject to legal and safety obligations.
13. Changes and contact
We may update this Privacy Policy from time to time. Where changes are material, we will notify you through the Service or by email where practical.
Questions about this Privacy Policy should be sent to privacy@blobme.ai.