Privacy Policy.

Introduction

Welcome to Blunt ("we," "our," or "us"), operated by Blunt AI FZ-LLC. This Privacy Policy explains how we collect, use, share, and protect your information when you use our mobile applications and web platform (collectively, the "App").

By using Blunt, you agree to the practices described in this policy. If you do not agree, please do not use the App.

Information we collect

Information you provide

• Email address and name when you create an account.
• Username, bio, and profile picture.
• Date of birth and gender, if you choose to add them. These are not shown on your profile. We use them, in de-identified form, for statistics.
• Reports, feedback, and requests you send us, including any screenshot you attach and basic details about your device and app version.
• Photos you upload for search. These are processed by third-party search services to identify the subject, then deleted from our temporary storage. See "Image search and biometric data" below.
• Searches you speak, and songs you ask the App to identify. For a spoken search we receive the short recording, use it only to work out what to search, and do not keep it. For a song we receive only the matched title and artist, never the audio. See "Microphone, voice, and music" below.
• Ratings, scores, reviews, comments, and opinions you share.
• Collections and saved content.
• Social activity, including the accounts you follow, your followers, and your reactions to reviews.

We begin collecting usage data when you start using the App, including before you create an account. If you later create an account, we may link that earlier activity to your account.

Information collected automatically

• Device type, operating system, and platform.
• App and mobile identifiers, and advertising identifiers where available.
• Usage data such as features accessed, entities viewed, and search queries.
• General location (country and city) derived from your IP address. We use your IP address to derive this and to protect the service; we do not keep it in your usage history. IP Geolocation by DB-IP.
• Log data including access times and browser type.
• Crash and error reports from the apps, with your device type and app version, through Google's Firebase Crashlytics. These are not linked to your account.
• Data from cookies and similar technologies. See "Cookies, tracking, and advertising."

Information from third-party sources

We aggregate publicly available information from web sources and data providers to generate sentiment scores. This information relates to public topics and entities. When an entity is a real person, that public information may relate to that individual.

Pages about real people are published for information only. By default we do not publish a Blunt Score about a person, and those pages do not accept ratings or reviews. We may enable scoring on a specific page, including with the consent of its subject.

How we generate scores (automated processing)

Blunt Scores and the accompanying explanations are generated by automated systems, including third-party artificial intelligence models, applied to publicly available information. This is automated processing. Scores are AI-generated estimates of sentiment and opinion, not verified facts and not decisions that produce legal or similarly significant effects about you. Where required by law, you may contact us to ask about the logic involved or to object to processing, as described in "Your rights and choices."

Image search and biometric data

When you upload a photo to search, it is held in temporary storage while two things read it: a reverse-image search provider (Serper, which queries Google Lens) and an AI vision model (Google Gemini). Both are used only to work out what the photo shows. The photo is then deleted from that temporary storage. It is not sent to our other AI providers or attached to your profile, and we do not keep it once the search is done. Google may keep what Gemini receives for up to 55 days, as described in "Service providers."

Depending on your jurisdiction, analyzing a photo to identify a person may involve biometric or special-category data. We do not use uploaded photos to build a facial-recognition database, and we do not sell biometric identifiers. Only upload photos of other people if you have the right and any consent required by law to do so.

Microphone, voice, and music

The App can search by voice and can identify music playing near you. Both use the microphone, and both ask your permission first. You can turn that permission off at any time in your device settings.

Voice search.When you search by voice, the App records what you say, for up to 15 seconds, and sends the recording to us. We pass it to an AI model provider (currently Google Gemini), which works out the words you said and the search they ask for. We send both back to the App, which then runs the search as if you had typed it. We hold the recording only while it is being processed: we do not store it, we do not log it, and we do not attach it to your profile. We do not log the words in it either, unless Gemini's answer cannot be read, when the start of that answer may stay in our error logs for up to 30 days. Google may keep the recording and Gemini's answer for up to 55 days, as described in "Service providers." The App does not keep the recording on your device. As part of usage data, we record that a voice search took place, whether it produced a search, the size of the recording, and how long it took.

Music.On iOS, music is matched by Apple's ShazamKit, which recognizes a song from an acoustic fingerprint rather than from the recording itself. Apple may process what it receives on its own servers under its own privacy policy. What reaches us is the result, the title and artist of a matched song, which we handle as an ordinary search query. We do not receive or keep music audio or acoustic fingerprints.

How we use your information

• Provide the service. Create and manage your account, display content, and enable core features.
• Generate scores. Process search queries and public information so our automated systems can measure sentiment.
• Operate the social features. Show your public profile and activity to other users, subject to your privacy settings.
• Improve the App. Understand how the App is used and make it better.
• Measure marketing.Understand how people find the App and how our campaigns perform. See "Cookies, tracking, and advertising."
• Communicate. Send important updates, respond to inquiries, and, with your consent where required, send push notifications and promotional messages.
• Ensure safety. Detect and prevent abuse, fraud, and violations of our Terms.
• Comply with law. Meet legal obligations and enforce our rights.

Legal bases (for users in the EEA and UK)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract to provide the App and your account.
• Legitimate interests to secure, analyze, and improve the App, to measure marketing, and to operate public sentiment features, balanced against your rights.
• Consent for push notifications and promotional messages, which you can withdraw at any time.
• Legal obligation to comply with applicable law.

How we share your information

We do not sell your personal information for money. We may share it as follows.

Service providers

We use trusted third-party providers for cloud infrastructure, authentication, data storage, image and content hosting, email delivery, analytics, crash reporting, and artificial intelligence and language analysis. Examples of the categories of processing and the kinds of data shared:

• Search queries, entity text, and related content are sent to AI model providers (currently OpenAI, Google, and Groq) and to web and image search providers (currently Serper, including Google Lens through it) to generate scores and search results.
• Voice search recordings are sent to an AI model provider (currently Google Gemini) only to work out what was said, as described in "Microphone, voice, and music."
• Account and authentication data is handled by our authentication and database providers.
• Uploaded images are handled by image storage and search providers as described above.

These providers access your information only as needed to perform services on our behalf and are bound by contractual obligations to protect it. Some may retain or use limited data as described in their own policies. Google, for example, may keep what we send to Gemini, such as voice recordings and search photos, and Gemini's answers, for up to 55 days, only to detect misuse of its service and where the law requires, and does not use them to improve its products.

Public content

By default, your account is public. This means your username, profile, ratings and scores, reviews, comments, public collections, and your follower and following lists are visible to other users and visitors. Aggregated, anonymized sentiment derived from user activity is displayed publicly in the App. If you set your account to private, the ratings, reviews, and collections on your profile and your follower and following lists are hidden going forward from everyone except the followers you approve. Your name, username, photo, bio, and counts stay visible, and your reviews still appear under your username on the pages where you posted them. Content shared while your account was public may already have been seen, cached, or shared, and anonymized aggregate sentiment may still reflect past activity.

Advertising and measurement partners

We work with advertising and attribution partners (currently Meta, Apple, and Google) to measure how people find the App and how our campaigns perform. This can involve sharing device or advertising identifiers and event data. For Meta, this includes a hashed version of your email address, a hashed account identifier, your IP address, and your browser or device user agent. If we add a partner, we will update this list. Under some laws, such as California's CPRA, this sharing for cross-context behavioral advertising is treated as a "sale" or "share." See "Your rights and choices" for how to limit it.

Legal requirements

We may disclose your information if required by law, regulation, legal process, or governmental request.

Business transfers

If Blunt is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

Cookies, tracking, and advertising

We and our partners use cookies, software development kits, pixels, and similar technologies to run the App, remember your preferences, measure usage, and measure marketing. This includes:

• Analytics to understand how the App is used.
• Attribution and advertising, including the Meta Pixel on the web and the Meta SDK in the app, and identifiers shared with the advertising partners listed above.

You can control cookies through your browser and limit ad tracking through your device settings.

Data storage and security

Where we store data

Your data is stored on secure cloud servers. Our company is based in the United Arab Emirates, and data may be stored and processed globally through our cloud providers.

How long we keep data

• Account data is retained while your account is active. Earlier versions of profile details you change, such as your name or email, are kept for up to 90 days.
• User content is retained until you delete your account, after which reviews are anonymized rather than removed.
• Uploaded search photos are deleted from temporary storage shortly after processing.
• Voice search recordings are not retained by us: we hold each only while it is processed. Music audio never reaches us. We keep the resulting search text as a search query.
• Usage and analytics data linked to your account is retained while your account is active. When you delete your account, it is de-identified so it is no longer linked to you.
• Backups may retain data for a limited period (generally up to 30 days) before permanent removal.

We set retention periods based on the purpose of the data and applicable legal requirements.

Security measures

We protect your information with encryption in transit and at rest, secure authentication protocols, and access controls. No system is 100% secure, and we cannot guarantee absolute security.

Breach notification

If a data breach affects your personal information, we will notify you and the relevant authorities where required by applicable law and within the timeframes those laws require.

Your rights and choices

Access and control

You have the right to access the personal information we hold about you, update or correct it through the App, delete your account and associated data, and withdraw consent for optional data collection.

Do not sell or share my personal information

You can limit the sharing of your information with advertising partners for cross-context behavioral advertising through your device and browser settings. On iOS, do not allow the App to track you, in its prompt or later in Settings > Privacy & Security > Tracking. On Android, delete or reset your advertising ID in your device's ad settings. In a browser, block cookies and trackers in its settings. For questions or requests about this sharing, contact support@blunt.ai.

Account deletion

You can delete your account at any time through the App settings or by emailing support@blunt.ai. When you delete your account, you are signed out and your profile is removed immediately. Your ratings and reviews remain on the pages where you left them, attributed to "Deleted User," and continue to count toward Blunt Scores. Within 30 days, your personal data, including your email, name, profile details, and the feedback and requests you sent us, is deleted from our systems; reports you filed about content are kept for moderation without any link to you; and the rest of your usage data is de-identified so it is no longer linked to you. We keep only general statistics such as country, age range, and platform. Backups are removed on a rolling schedule of up to 30 days. Data already shared with advertising partners is handled under their policies. We may keep limited records where the law requires it.

Communications

You can turn off push notifications, including promotional ones, in your device settings.

Regional privacy rights

European Economic Area and United Kingdom (GDPR)

If you are in the EEA or UK, you have rights including access, correction, deletion, data portability, restriction of processing, objection to processing, and the right to lodge a complaint with a supervisory authority. Where we transfer personal data outside the EEA or UK, we use appropriate safeguards such as Standard Contractual Clauses.

California (CCPA and CPRA)

California residents have the right to know what personal information is collected and how it is used, to request deletion, to correct inaccurate information, to opt out of the sale or sharing of personal information for cross-context behavioral advertising, to limit the use of sensitive personal information, and to non-discrimination for exercising these rights.

United Arab Emirates

We handle personal data in line with the UAE Federal Personal Data Protection Law, including obtaining consent where required, honoring data-subject rights, and notifying breaches as required.

Children's privacy

Blunt is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. Users between 13 and 18 must have parental or guardian consent. If we learn we have collected information from a child under 13 without proper consent, we will delete it promptly. Contact support@blunt.ai if you believe this has occurred.

Third-party links

The App may link to third-party websites or services. We are not responsible for their privacy practices and encourage you to review their policies.

To show a website's icon next to a source a page cites, the App loads the icon from Google's favicon service, which receives the website's address and your IP address.

International data transfers

Your information may be transferred to and processed in countries other than your own, which may have different data protection laws. Where required, we use appropriate safeguards such as Standard Contractual Clauses for these transfers.

Changes to this policy

We may update this Privacy Policy to reflect changes in our practices or for legal reasons. We will notify you of material changes by posting the updated policy in the App, updating the "Last updated" date, and, for significant changes, sending a notification. Continued use after changes are posted means you accept the updated policy.

Contact

For questions, concerns, or requests regarding this Privacy Policy or your data: