Blast

To create an account, we collect:

• Your phone number, used to sign you in (a text with a one-time code — no password).
• A username and display name shown to your friends.
• Your date of birth, used once to confirm you meet the minimum age — never shown to other users or used for anything else.

As you use the app, we store:

• Open invites you post (activity, place, time, how many spots), and who claims a slot on them.
• Your friend connections — who you're friends with, and any pending requests.
• If you turn on notifications, a push subscription for that browser/device (an endpoint and encryption keys assigned by your browser) so we can alert you when a friend posts or claims a spot. Only created if you opt in, removed if you turn notifications off.

About contact matching specifically:

If you use “find friends from your contacts,” the phone numbers you provide (pasted, or from your device's contacts) are converted to one-way cryptographic hashes on our server and compared against hashes of existing Blast accounts. The raw phone numbers are never stored, logged, or written anywhere — they exist only for the moment it takes to compute the comparison, then they're gone. We only ever learn which of the numbers you provided already have a matching Blast account; we learn nothing about the ones that don't.

• To run the app: your calendar of invites, your friend graph, and slot claiming.
• To show you which of your contacts are already on Blast, if you ask us to check.
• To send you a push notification when a friend posts an invite or claims a spot on yours, if you've enabled that.
• To keep the app secure and prevent abuse (e.g. rate-limiting rapid requests).

Your invites, and who's claimed a slot on them, are visible only to your accepted friends — never to strangers, and never publicly. Your phone number is never shown to other users; they see your username and display name only.

We don't sell or rent your information. A few outside services help us run the app, and only see what they need to do their job:

• Our database and authentication provider — stores your account and app data, and handles phone sign-in.
• Our SMS provider — delivers the one-time sign-in code to your phone. They see your phone number for that purpose only.
• Our hosting provider — runs the app itself.
• Our rate-limiting service — helps prevent abuse; it doesn't store your profile or invite data.
• Your browser's push notification service (built into your device by its manufacturer) — delivers push notifications if you've enabled them.

We keep your account and app data for as long as your account exists. If you ask us to delete your account (see below), we remove your profile, invites, friend connections, and push subscriptions.

• Turn push notifications on or off anytime from your home screen.
• Get a new invite link anytime from Friends — the old one stops working.
• Request that your account and data be deleted by contacting us — we don't have a self-serve delete button yet, but we'll take care of it promptly.

Blast isn't directed at children, and it isn't intended for use by anyone under 13.

If how we handle your data changes meaningfully, we'll update this page and the date at the top.