Privacy Policy

Last updated: July 6, 2026

The Blind Machine is built so that we can see as little as possible. This policy covers the two kinds of data that exist here — the encrypted data the platform computes on, and the ordinary website data any web service holds — and states plainly what we collect, what we can see, and what we cannot.

This policy is written by us, not by lawyers, and it is not legal advice. If anything here contradicts how the product actually behaves, the behavior is the bug — tell us.

1. Encrypted data: what never reaches us

The computation pipeline is designed so the sensitive material stays on your machine.

• Never uploaded: raw data, encoded data, and secret keys. The open blind CLI marks these LOCAL ONLY and refuses to send them. Key generation, encoding, encryption, and decryption all happen locally.
• What we store: encrypted contributions (ciphertext), public crypto contexts, signed application bundles, computation results (still encrypted), and Computation Certificates. We cannot decrypt contributions — the server has no field to store a secret key.
• What we can still see: metadata. Who submits, when, how many contributors join a project, ciphertext sizes, and which application runs. We say this because encrypted is not the same as invisible.
• What is public: published applications, public crypto contexts, and Computation Certificates on public result pages. These are shareable by design so anyone can verify a result; they contain hashes and aggregate facts (such as cohort size), never individual contributions.

2. Account information

If you create an account we store your email address, username, and a hashed password (we never store the password itself). If you sign in with Google, we receive your email address from Google; we do not receive your Google password.

Contributors do not need accounts. A contributor invited by a bearer link can upload ciphertext without ever telling us who they are beyond the request metadata any web server sees.

3. Usage analytics

We run our own first-party analytics on our own servers. No data is sent to a third-party analytics company.

• No analytics cookies and no fingerprinting.
• IP addresses are masked before storage (the last portion is zeroed) and never used for geolocation.
• We record page views with path, referrer, browser and device type, and — if you arrived through a campaign-tagged link — which channel referred you.
• Known bots and prefetch requests are excluded.

4. Communications

If you email support, submit feedback, or receive email from us, we keep that correspondence and a log of the email we sent you. Transactional email is delivered through Resend, our email provider, which processes recipient addresses and message content in order to deliver it.

5. Service providers

We share data only with providers needed to run the service, and only what each needs:

• Resend — delivers our email (your email address, message content).
• Google — only if you choose Google sign-in (Google tells us your email; we tell Google nothing about your activity here).
• Stripe — only if and when you buy a paid plan; payment details go directly to Stripe, and we never see or store card numbers.

We do not sell personal information. We do not share data with advertising networks. We disclose data to authorities only when legally required, and we would read the requirement carefully first.

6. Security

Transport is encrypted (HTTPS with HSTS). Passwords are stored as bcrypt hashes. Computation runs in a network-isolated sandbox. The strongest protection, though, is structural: the sensitive artifacts never arrive, so a breach of our servers cannot expose what we never had.

We make no compliance certifications on this page. The verifiable guarantees live in the threat model and certificates, which you can check without trusting us.

7. Retention and deletion

Account data is kept while your account exists. Analytics rows are first-party and stay on our servers. To access, correct, or delete your personal data, email support@blindmachine.org — deletion is currently handled by us on request rather than by a self-serve button, and we will confirm when it is done.

One honest caveat: Computation Certificates are content-addressed and may have been copied by anyone who verified them. We can delete our copy; we cannot recall a hash the world already holds.

8. Children

The service is not directed to children, and accounts require you to be 18 or older.

9. Changes

When this policy changes, we update the date at the top. Material changes to what we collect will be described here, not hidden in a diff.

10. Contact

Privacy questions or requests: support@blindmachine.org.