Privacy policy

Last updated 15 October 2026

Bloopy helps you learn about Bitcoin, follow the market and buy Bitcoin through licensed payment partners. This page explains, in plain words, what we collect, why, and who we share it with. Questions: hello@bloopy.site.

What we collect

Account details: your name, email address, a recovery email address, when you joined and when you last signed in. Your password is stored only as a secure one-way hash, never as plain text.
Security data: a device ID (in a cookie and your browser storage) to keep one account per device and to recognise new devices, the 6-digit and 4-digit codes we email you (they expire quickly), and a scrambled (hashed) version of your internet address to stop abuse such as too many chat messages.
ID check: whether your ID check was approved, declined or is being reviewed, and the details read from your card: your name, document type and number, date of birth, nationality and expiry date. Your ID card photos and selfie are kept by our ID partner Didit, not on Bloopy's servers. Bloopy's admins can view them on your profile to prevent fraud, for example to spot one ID card used on several accounts.
Mobile number: the number of your phone's SIM, to send you a confirmation code and to keep one account per number. We check with our text-message partner that it's a real mobile number, not a virtual or temporary one.
Built-in wallet: if you create a Bloopy wallet, its 12 backup words and private key are made and stored only on your phone, locked with your PIN. Bloopy's servers only learn the public address, so we can show your balance but can never move your Bitcoin.
Auto-invest plan: the weekly amount, payment method and day you choose.
Wallet address: the public Bitcoin address you choose to save, so we can show its balance. We never ask for your private keys or seed phrase, and we can't move your Bitcoin.
Purchases you start: amount, currency, the receiving wallet address, the time and Bitcoin's price at that moment. The payment itself happens on the payment partner's site.
Early-access list: if you reserve a spot before buying opens, the amount you plan to buy, how you want to pay and, if you add it, your wallet address. Leave the list anytime on the Buy page.
Bloopy Plus: whether you're subscribed and when it renews. Card details are handled by Stripe, not by Bloopy.
Community posts and comments you write, with your name.

Who we share it with, and why

Didit (ID checks): checks that your ID card is real, that you're a real person, and that your face matches the card. Didit stores the photos under its own policy and our retention settings, and does not use them to train its AI models.
Payment partners (Alchemy Pay, Transak): when you buy, we pass your email, the amount and your wallet address so they can take payment and send Bitcoin to you. They may ask for their own ID check.
Stripe (Plus subscription): takes your subscription payment and lets you cancel anytime.
Resend (email): sends your security codes and account emails.
Twilio (text messages): checks your mobile number is a real SIM and sends your code by text or WhatsApp.
Anthropic, through Netlify's AI Gateway (Bloopy chat): your chat messages are sent to generate Bloopy's replies. We don't store your chat on our servers; it stays in your browser for the session.
Netlify (hosting and database), CoinGecko (prices), mempool.space (reading the public balance of your Bitcoin address and, when you send from the built-in wallet, passing your signed payment to the Bitcoin network) and YouTube (creator videos and thumbnails, which load from YouTube's servers).

We don't sell your data and we don't use it for advertising. Some of these companies process data outside Pakistan, for example in the United States or the European Union.

How long we keep it

Account data: while your account is open. Ask us and we'll delete it.
Email codes and sign-in puzzles: minutes, then they expire.
ID check photos held by Didit and the details read from your card: while your account is open, and afterwards for as long as the law requires us to keep identity records.
Manual ID check photos (only used if automatic checks are off): deleted once an admin decides.
Records we must keep by law, such as purchase and payment records, may be kept longer.

Your choices

See, correct or delete your data: email hello@bloopy.site from your account email.
Cancel Plus anytime from Account → Manage subscription.
Remove your saved wallet address anytime on the Wallet page.

Children

Bloopy is for adults aged 18 and over. We don't knowingly allow anyone younger to create an account.

Changes

If we change this policy in a way that matters, we'll tell you in the app or by email before it takes effect.