Blot — Privacy Policy

Last updated: 10 September 2026 · Applies to the Blot iOS app and the Blot backend service.

The short version. Blot has no accounts. We never ask for your name, email or phone number — you are identified only by a random token created on your device. On iPhone and iPad the screenshot you pick is scanned and covered entirely on your device — it never reaches our server. All the server is told is that a scan happened: how many sensitive items were found, what kinds they were, and a hash of the image so re-scanning the same one is free. Where on-device scanning is not available — the web version, an older build, or a device whose text recognition fails — Blot falls back to scanning on our server. On that path the image is sent over HTTPS, held in memory for the request and discarded when it ends; we do not keep it, but we do keep a small record of what was found — the rectangles, the kind of each and how many characters it ran to, never the text itself — and that record expires after 24 hours. We use Google Analytics for Firebase to count how the app is used — screens opened, scans finished, purchases made — keyed to that same anonymous token and never to anything about the contents of your screenshot. We do not sell your data, we run no advertising SDKs, and we do not track you across other companies' apps.

1. Who we are

Blot is operated by StarNova ("we", "us"). Blot finds sensitive text in a screenshot — email addresses, API keys and tokens, credit card numbers, phone numbers and IP addresses — and covers it with a black bar, a blur, a pixel block or decoy text before you share the image. For any privacy question or request, contact us at vdnhan97@gmail.com.

2. No account, no sign-in

Blot has no user accounts and no sign-in. On first launch the app asks our server for an anonymous visitor token — a random string that is stored on your device in Capacitor Preferences (Keychain-backed storage on iOS) and sent with every request. Everything the service knows about you hangs off that token and nothing else. We never collect your name, email address, phone number, postal address, date of birth or contacts.

The app also generates a per-install fingerprint: the literal string blot- followed by 32 random hexadecimal characters, produced on device by the system random number generator and stored alongside the token. It is not derived from your hardware, your browser or anything about you — it is simply a random label. The server uses it so that clearing the app's storage and registering again lands on the same identity and the same monthly scan allowance, rather than handing out a fresh free allowance every time.

3. What happens to the screenshot you pick

Whichever path runs, the app first reads the image you selected and downscales it on your device (longest edge 1600 pixels, re-encoded as JPEG). What happens next depends on whether your device can do the scan itself. On iPhone and iPad it can, and that is the path Blot takes.

On your device — the normal path on iPhone and iPad

Blot hands the downscaled image to Apple's own text recognition, which runs inside the app on your phone, and then matches each recognised word against patterns for emails, API keys and tokens, credit card numbers, phone numbers and IP addresses. The list of rectangles it produces stays on the phone. You review that list, choose a cover style, and the covers are drawn onto the image on the phone too. The screenshot, the text read out of it and the cleaned copy never leave your device on this path.

Our server is still involved, because it owns your monthly scan allowance, but all it receives is the scan's metadata: a SHA-256 hash of the downscaled image, how many sensitive items were found and which kinds they were (email, API key, card, phone, IP). It does not receive the image, the rectangles, the character counts or any matched text. Against that hash it stores only a marker saying a scan happened and whether anything was found, so that re-scanning the same screenshot within 24 hours does not spend your allowance twice.

Why a hash and not the image. The hash is a one-way fingerprint computed on your phone. It lets the server recognise that you are re-scanning an image you already paid for, and it cannot be turned back into the picture.

On our server — the fallback path

On-device recognition is not available everywhere: the web version has no such plugin, older builds of the app did not ship one, and a device's text recognition can fail on a given image. In those cases Blot falls back to the original pipeline: the downscaled image is sent to the Blot backend over HTTPS, the backend forwards it to our screenshot engine, the engine runs Google Cloud Vision optical character recognition over it, classifies the recognised words the same way, and renders the covers onto the image server-side, returning a PNG.

There is one narrower fallback as well. If your device swept the screenshot but then fails to draw the covers on it, only the drawing moves to the server: the image and the rectangles you confirmed are sent so the covers can be rendered, and the image is discarded when that request ends, exactly as above. The scan itself has already happened on your device and nothing more about it is sent.

Even on that path the image itself is not stored. It exists in server memory for the duration of the request and is discarded when the request ends. It is never written to a database, a disk or an object store, and it is never given a URL. What is kept on this path is the detection result described below — read that carefully, because "we do not store the image" is not the same as "we keep nothing".

The cleaned copy

The cleaned image is kept on your phone, in the app's own storage, which is what lets the Archive reopen it. The server never receives it on either path, so deleting a cleaned copy in the app deletes it everywhere it existed.

What the record does not contain. The text that matched never leaves the scan, on either path. If the scanner finds the API key sk_live_… in your screenshot, the most that is ever written down is its rectangle, the label api_key and its length — never the key, and on the on-device path not even that much reaches us. Decoy covers are built from the type and the length, which is enough to produce a fake of the same shape without anything worth stealing having to survive the sweep. Earlier builds of Blot did store the matched string, and this section used to say so; it no longer does because the behaviour changed, not the wording.

4. What we collect and why

Data	Why	Kept
Anonymous visitor token (random string)	Identifies your scan history, allowance and entitlement without an account	Until you ask us to delete it
Per-install fingerprint (`blot-` + random hex)	Keeps one install on one monthly allowance so clearing storage does not mint a fresh one	Until you ask us to delete it
The screenshot you pick	Scanned for sensitive text and rendered with covers	On-device path: we never receive it. Fallback path: not stored — held in server memory for the request only
SHA-256 hash of the downscaled image, computed on your device	Recognises the exact same image so re-scanning it is free and does not spend your allowance. On the on-device path this is the only thing about the image we ever see	24 hours, then deleted automatically
Fallback path only — detection result for that hash: the rectangles found, the type of each (email, API key, card, phone, IP) and the number of characters each covered, never the text itself. On the on-device path we store a marker instead: that a scan ran and whether anything was found	Serves a repeat scan of the same image from cache without charging you again, and sizes decoy text	24 hours, then deleted automatically; or when you ask us to delete it, whichever comes first
Case record: case number, how many items were found, which types, and the timestamp	The Archive list in the app	Until you ask us to delete it. On Free only the last 7 days are shown to you
Monthly scan counter	Enforces the plan's monthly scan allowance	One row per calendar month
Hourly request counters	Abuse prevention (a ceiling on scans and renders per hour)	Old windows are deleted automatically
IP address	Rate limiting and abuse prevention only — it caps how many brand-new identities one connection can create. The most recently seen address is stored on the visitor record.	Until you ask us to delete it; also present in short-lived server logs
Time zone offset (minutes from UTC)	Decides when your billing month rolls over. Pinned the first time we see it so it cannot be rotated to farm a second allowance.	Until you ask us to delete it
Analytics events and identifiers: the events listed in section 6, keyed to your visitor token, plus the Firebase app instance id and the vendor identifier (IDFV)	Tells us which screens are used, whether scans succeed and where people stop. Counts, type names and fixed labels only — never a screenshot, a matched string or any text you typed.	Google Analytics data retention (section 8)
Subscription and credit status	Unlocks Plus or Pro and tops up scans. We receive the entitlement status, never your card details.	While the entitlement is active plus records required for accounting

Blot does not collect your contacts, your location, health data, advertising identifiers (IDFA), browsing history or your photo library as a whole. We never receive your photo library, and on iPhone and iPad we do not receive the individual screenshots you scan either — only on the fallback path described in section 3 does an image reach us at all, and then only the one you chose, for the length of one request.

5. Photos and camera permissions

Blot declares three permission strings in its iOS app:

Photo Library (read) — so you can pick the screenshot you want cleaned. iOS shows you the picker; only the image you tap is handed to the app.
Photo Library (add) — so the cleaned copy can be saved back to your photos when you choose to save it from the iOS share sheet. Blot can also save the cleaned PNG into Files → Blot instead.
Camera — Blot never opens the camera. The Capacitor photo picker we use checks all three usage descriptions before it will open at all and refuses the call if any one of them is missing, so the camera key has to be declared for "Choose from Photos" to work. The app only ever requests the Photos source; no code path in Blot takes a picture. We are telling you this plainly because a camera permission on a privacy tool deserves an explanation rather than silence.

6. Analytics and tracking

Blot uses Google Analytics for Firebase (the app side of Google Analytics 4) to understand how the app is used. On iOS the events go through the Firebase Analytics SDK; the SDK is built without advertising-identifier support, which is a deliberate choice and not a default. There is no third-party attribution SDK and no crash-reporting SDK in the app.

The analytics user is your anonymous visitor token — the same random string described in section 2. It is pseudonymous: it is not your name, email, phone number or any identifier Google or anyone else can resolve to a person. Firebase additionally generates an app instance id and reads Apple's vendor identifier (IDFV), which is scoped to apps from us alone and resets when you delete the app.

We send counts, type names and fixed labels, and nothing else. A scan event carries how many sensitive items were found, which categories they fell into (email, API key, card, phone, IP), whether the result came from cache, and whether the sweep ran on your device or on our server. It does not carry the screenshot, any thumbnail of it, any matched string, any file name or any text you typed. This is a rule in the code, not a promise about intent: the analytics module is documented as counts-and-enums-only precisely because a screenshot redaction tool leaking a matched string into an analytics parameter would defeat the entire product.

The full list of what we send is: screens opened, a screenshot being picked and from where, a scan finishing (with the counts above) or failing (with a fixed reason code), a cover style being chosen, a cleaned copy being shared or saved, the scan allowance being reached, the paywall being shown and why, a purchase completing (tier and billing period, never a price or a card), a restore completing, and a setting being changed (which setting, and its new on/off or cover value).

Blot does not use the advertising identifier (IDFA), does not show the App Tracking Transparency prompt, does not build advertising profiles, does not run remarketing or Google Signals, and does not track you across other companies' apps or websites. We do not use analytics data for advertising and we do not share it with advertising networks.

Analytics is also build-gated: if the app is built without a Google Analytics measurement id configured, the analytics code never loads and nothing is sent at all.

Separately from analytics, what the backend records is operational rather than behavioural: the counters and case records listed in section 4. Those never travel to Google Analytics.

7. Where your data goes

We share data only with the service providers needed to run the app:

Apple's on-device text recognition — on iPhone and iPad this is what reads the text in your screenshot. It is part of the operating system and runs inside the app on your device; the image is not sent anywhere, to Apple or to us, and no third party receives it.
Google Cloud Vision — on the fallback path only (see section 3), receives the downscaled screenshot and returns the recognised text with pixel coordinates. Google processes the image as our service provider under the Google Cloud terms; the request carries no identity of yours, only the image. On the on-device path Google Cloud Vision never sees your screenshot.
Our screenshot engine — fallback path only. A service we operate that calls Vision, classifies the recognised words and renders the covers. It is passed an opaque per-visitor client id (your visitor record's internal id, prefixed blot-) so its caches and rate limits follow the right user.
Google Analytics for Firebase — receives the product events described in section 6, keyed to your anonymous visitor token, plus the app instance id and vendor identifier the SDK generates. It never receives your screenshot, any part of its contents, or any matched string. Google processes this as our service provider.
Apple — processes your purchase and reports the subscription status. Apple never gives us your payment details.
RevenueCat — manages subscription state and tells our server, by webhook, whether Plus or Pro is active for your anonymous visitor token, and when a credit pack has been bought. The identifier RevenueCat holds for you is that token.

Data is processed on servers we operate and on the infrastructure of the providers above. We do not sell your data, we do not share it with data brokers, and we do not use it for advertising.

8. How long we keep things

The screenshot: on the on-device path it never reaches us at all. On the fallback path it is not retained — it lives in server memory for the request.
The cleaned copy: kept on your device, in the app's own storage, until you delete it there. We never hold a copy.
Working caches in the engine (fallback path only): to avoid paying for the same OCR twice, the engine keeps the recognised text of a recently scanned image in memory, keyed by the image's content hash, for up to 30 minutes, and keeps the analysis result in a small in-memory cache that is bounded in size and cleared whenever the service restarts. These caches hold text and coordinates, never the image bytes, and never touch disk.
Detection results and case records in the Blot backend: a detection result exists only on the fallback path and expires after 24 hours; the marker written on the on-device path expires on the same schedule. Case records — case number, count, type names, timestamp — are kept against your visitor record until you ask us to delete them, or until we retire the record. The Free plan limits the history shown to you to the last 7 days; that is a display window, not a deletion schedule, which is why we say so here.
Counters: monthly scan counters are kept per month; hourly rate-limit windows are deleted once they have passed.
Analytics events: held by Google and deleted on the schedule set in our Google Analytics property's data retention setting, which is Google's own control rather than ours; aggregate reports outlive the individual events. Deleting the app and reinstalling mints a new visitor token, so past events are no longer connected to the new install.
Server logs: short-lived, and used for operating and securing the service.

9. Storage and security

All traffic between the app, our backend and our providers runs over HTTPS. The backend database is not publicly reachable and access is restricted to the systems and people needed to operate the service. Purchases never expose card details to us. No system is perfectly secure, which is why we keep as little as the product allows and offer deletion on request — and why, on iPhone and iPad, the screenshot and everything read out of it stay on your device in the first place.

10. Your choices and your rights

Delete everything. Email vdnhan97@gmail.com and we will delete your visitor record and everything attached to it: the fingerprint, the stored IP, the detection results including any matched text, the case history and the counters. Because there is no account, please write from the device you use Blot on, or include enough detail — such as recent case numbers and roughly when you used the app — for us to find the record. Deleting the app from your phone also destroys the token, after which we can no longer connect the record to you but cannot identify it for deletion either, so ask first if you want it gone.
Access and portability. Ask us and we will tell you what is held against your visitor record and send it to you in a machine-readable form.
Correction and restriction. Ask us and we will correct inaccurate data or restrict processing where the law gives you that right.
GDPR (EEA and UK). If you are in the European Economic Area or the United Kingdom, our lawful bases are: performing the contract you enter into by using the app (scanning and covering the screenshot, providing your history and your plan), and our legitimate interests in keeping the service secure and available (rate limiting, abuse prevention, quota enforcement). You have the rights to access, rectification, erasure, restriction, portability and objection, and the right to complain to your local supervisory authority. Contact us at the address above to exercise any of them; we do not require you to create an account to do so.
CCPA/CPRA (California). We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by California law. We have not done so in the preceding twelve months, and we do not knowingly do so for anyone under 16. California residents may request to know, delete or correct the personal information we hold, and we will not discriminate against you for exercising those rights. The categories we collect are identifiers (the anonymous token, the random fingerprint, the IP address) and the internet activity and content records described in section 4.
Revoke Photos access. iOS Settings → Blot → Photos. Blot cannot pick an image without it.
Choose what is scanned for. The detection types Blot watches (emails, API keys, cards, phone numbers, IP addresses), your default cover style and Sentry Mode are stored only on your device; the backend never receives them. Changing one does send an analytics event naming the setting and its new value, as listed in section 6.
Opt out of analytics. Analytics is not required for the app to work. Email us at the address above and we will delete the events held against your visitor token; deleting and reinstalling the app also breaks the link, because a new install gets a new token.

11. Children

Blot is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has used the app and provided data, email us and we will delete it.

12. Changes

If this policy changes materially we will update this page and change the date at the top. Continuing to use Blot after a change means you accept the updated policy.

13. Contact

vdnhan97@gmail.com