Privacy Policy

The essentials, before the detail:

• Your core study data lives in Europe. Your study materials, uploads and progress are stored on our application server within the European Economic Area (EEA). Authentication and AI processing involve the providers explained below.
• We never sell your data and we run no advertising, no third-party trackers, and no profiling for marketing.
• AI processes the content you give it. To generate quizzes, feedback, tutoring and analysis, the relevant text is sent to our AI provider (OpenRouter). We do not use your work to train our own models.
• You can request a copy of your data or delete your account, and you have the full set of GDPR rights described below.
• We collect the minimum we need to run the service — there is no hidden data-broking business behind Blabble.

The “data controller” is the person or organisation that decides how and why your personal data is processed.

Controller

Blabble AI is an independent educational project. It is not yet incorporated as a company; during this pilot it is operated from Italy by its founder, who acts as the data controller for your personal data.

Contact

blabbledevai@gmail.com — use this address for any privacy question or to exercise your rights. A postal contact address is available on request.

Data Protection Officer

Blabble has not appointed a dedicated Data Protection Officer. Privacy requests and questions go to the contact above.

We only collect data that is needed to run the study features you use:

Account & identity

Your email address and name, an optional display name and profile photo, and your role (student or teacher). Sign-in is handled by Firebase Authentication — see “AI & third-party processing” for what that means.

Content you create or upload

Subjects and lessons you set up; study documents you upload (PDF, PowerPoint, Word, images or text) and the text extracted from them; highlights and notes; and any source links you save.

Study activity & progress

Quiz and practice-exam attempts and scores, estimated topic mastery, flashcard reviews, mind maps, study plans, tasks, exam dates, study streaks and goals, and exam-readiness signals derived from the above.

Tutoring & chat

The messages you send to the AI tutor and the responses it gives, so your conversations persist across sessions.

Voice recordings

If you choose to record a study session, the audio and its text transcript. This is always something you start deliberately — we do not listen in the background.

Usage & technical data

Basic device/browser information and IP address (used transiently to operate and secure the service), limited server and error logs, first-party operational event requests, and your AI-credit usage counters. We do not currently maintain a third-party product analytics profile about you.

Teacher & class data

If you join a class, your teacher can see your progress and submitted work. Teachers create classes and rosters linking their account to their students.

Under GDPR we must have a lawful basis for each purpose. Here is the full mapping — nothing happens to your data outside these:

Run the service

Creating your account, storing your subjects, lessons, documents and progress, and generating study materials and tutoring. Basis: performance of our contract with you (Art. 6(1)(b)).

AI features

Sending the relevant content to our AI provider to produce analysis, quizzes, flashcards, mind maps, study plans, practice exams, explanations and tutor replies. Basis: performance of our contract (Art. 6(1)(b)).

Safety & moderation

Screening AI chat for harmful content and protecting younger users. Basis: our legitimate interest in a safe educational service, and our interest in child safety (Art. 6(1)(f)).

Security & abuse prevention

Protecting accounts, enforcing fair-use AI limits, preventing fraud and abuse. Basis: legitimate interest (Art. 6(1)(f)).

Improve the product

Understanding feature usage and fixing problems, using first-party and aggregated data. Basis: legitimate interest (Art. 6(1)(f)); we use anonymised/aggregated data wherever possible.

Optional features & communications

Anything you opt into (for example optional analysis features, or — if we ever offer it — product email). Basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.

Legal compliance

Meeting our legal obligations and responding to lawful requests. Basis: legal obligation (Art. 6(1)(c)).

Blabble’s AI features are delivered through a small, deliberately limited set of providers. Our full AI Use Policy and AI Ethics pages go deeper; here is the data view.

OpenRouter (AI inference)

Generative AI, safety screening, transcription and document OCR run through OpenRouter, which routes requests to model providers. Models may change as quality, safety and availability improve. The content needed for each task — such as document text, chat messages, quiz answers, audio or highlight context — is sent to produce your result.

Firebase Authentication (Google)

Used only to verify your identity at sign-in. Your password is managed by Firebase and is never stored by Blabble. We receive your email, name and a verification status from the sign-in token.

Hosting provider (EEA)

Our application, database and uploaded files run on a virtual server hosted within the EEA. The host provides infrastructure only and does not use your data.

Educational source search (optional)

If you use source-finding features, your search query is sent to academic providers (Wikipedia and OpenAlex always; Exa and YouTube only where configured) to return results.

Blabble uses automated processing to make studying useful: it scores quizzes and practice exams, estimates how well you know each topic, calculates an exam-readiness picture, flags your weaker topics, and — for teachers — highlights students who may be falling behind.

We do not sell your personal data and we do not share it for advertising. We share data only with the processors that make the service work, and only as needed:

• Service providers (processors) acting on our instructions: OpenRouter (AI inference, moderation, transcription, OCR), Google Firebase (authentication), and our EEA hosting provider.
• Your teacher or school, if you are a member of a class — they can see your progress and the work you submit to them.
• Authorities, where we are legally required to disclose information under applicable law.
• A successor, if the service is ever transferred as part of a merger or acquisition — you would be notified, and this policy would continue to protect you.

We put data-processing terms in place with our processors requiring them to protect your data and use it only to provide their service to us.

Your account, study content and uploaded files are stored in our PostgreSQL database and on the filesystem of our server, both hosted within the EEA. Keeping the primary store in Europe is a deliberate choice.

Some processing necessarily happens outside the EEA. In particular, AI inference (OpenRouter) and authentication (Firebase) are operated by providers based in the United States, and optional search providers may be outside the EEA. OpenRouter's zero-data-retention control limits retention; it does not by itself guarantee that processing happens inside Europe.

• Google makes Firebase Data Processing and Security Terms and EU Standard Contractual Clauses available for covered transfers.
• For other providers, the safeguard depends on the provider and destination and may include an adequacy decision or the European Commission Standard Contractual Clauses.
• We minimise transfers by sending only what the requested task requires, rather than your whole account.

You can contact us for more information about the safeguard applying to a particular transfer and, where available, a copy of the relevant terms.

We keep personal data only as long as we need it for the purposes above:

Account & content

Kept while your account is active. A successful in-app account deletion removes your live Blabble database records, uploaded files and Firebase sign-in identity. Residual encrypted backups and provider recovery systems expire on their normal limited cycles, unless a longer period is legally required.

Uploaded files & recordings

Kept until you delete them using an available in-app control or close your account.

Study activity & progress

Kept while your account is active so your progress is meaningful over time.

AI-usage counters

Kept for the current allowance period plus a short window for fair-use and support.

Security & server logs

Kept for a limited operational period needed to diagnose incidents, secure the service and meet legal obligations, then deleted or rotated.

Aggregated & anonymised data

Data that no longer identifies you may be kept to understand and improve the service.

Legal holds

Some data may be kept longer where we are legally required to retain it.

• Encryption in transit (HTTPS/TLS) for everything between your device, our servers and our providers.
• At-rest protection on our EEA server, with access restricted to the systems and people that need it.
• Authentication handled by Firebase — we never store your password.
• Role-based access controls separating student, teacher and administrator capabilities.
• Restricted logging around AI calls, and least-privilege access to production systems.

No online service can promise perfect security, but we take proportionate technical and organisational measures and keep them under review. If a breach ever affects your rights, we will notify you and the relevant authority as GDPR requires.

You have the following rights over your personal data. Requests are normally free. GDPR permits a reasonable fee or refusal only in limited cases, such as a request that is manifestly unfounded or excessive.

Blabble is built for secondary-school students, many of whom are minors, so we treat this seriously.

• You must be at least 13 years old to use Blabble.
• Blabble's terms require permission from a parent, guardian or school where a young person cannot agree to the service on their own.
• The GDPR's “digital age of consent” matters when an online service relies on consent as its legal basis for a child's data. In Italy that age is 14. For an optional feature based on consent, we require authorisation from the person who holds parental responsibility for users under 14. Other processing may rely on a different lawful basis, as listed above.
• Where a school provides Blabble, it must give students and families the information and permissions required for that arrangement. Responsibility is explained in “Who is responsible for your data”.
• We do not knowingly collect personal data from children under 13. If you believe a child under 13 has given us personal data, contact us and we will delete it.

Blabble is deliberately light on tracking. We use only what the app needs to function:

• Essential storage: a sign-in session token, your theme preference, onboarding state and role, stored in your browser so the app works and remembers your settings.
• First-party operational events:the app can send basic navigation, performance and error events to Blabble's own API. We do not currently build a retained behavioural analytics profile from those event payloads.
• No advertising or third-party tracking cookies, and no Google Analytics, Meta Pixel or similar. We don’t share your behaviour with ad networks.

We may update this policy as the service evolves or the law changes. We’ll revise the “last updated” date above and, for material changes, give you prominent notice in the app or by another appropriate channel. If a change requires consent, we will ask for it; a privacy notice is not treated as consent by itself.