Blaze Privacy Policy

Effective 28 September 2026

Who this policy covers

This policy explains what Blaze ("we", "us") does with your personal information when you use the Blaze mobile app on iOS or Android. It applies to the app and to the servers behind it, and to nothing else — links out of the app lead to services with their own policies.

For anything in this policy, or to exercise any right described in it, write to us at the address in "How to reach us" below. We are the controller of the personal data described here.

What we collect

Only what the app needs to do its job. Every item below is either something you type in yourself or something the app has to record to work at all.

Account details

Your email address, your display name, the handle you claim, and whether your email address has been confirmed. If you sign in with Google, we receive your name, email address and profile picture from Google. If you sign in with Apple, we receive your name and email address — or, if you choose to hide it, the private relay address Apple creates for you. Passwords are handled by Firebase Authentication and are never visible to us.

Your profile

Anything you choose to add: profile and cover photos, a status line, birthday, a note about yourself, hobbies, love language, dietary needs, clothing and ring sizes, and gift ideas. All of it is optional, and all of it is written for your partner to read.

What the two of you create

Journal entries with their photos and the comments the two of you leave under them, daily mood check-ins, planned dates and their details, answers to the weekly question and the daily question and the comments and reactions under them, appreciation notes, shared goals, special dates, challenges you take on, the bucket list you keep together, arcade matches and duel runs and their results, scores from the weekly quiz about each other, the photo each of you posts to the day, the song you attach to a memory and the one you name as the pair's, pokes, watch parties — what you are watching or listening to, any link you add, where the shared clock is, whether each of you has it open, and the last reaction each of you sent — listening rooms — the songs either of you adds to the queue, where the shared clock is, whether each of you is listening and whether your phone can play whole songs through Apple Music, when one of you last asked the other in, and the last reaction each of you sent — songs you gift each other, with the note you write, whether it has been unwrapped and any heart sent back — messages you send each other in the chat — words, photos, stickers, voice notes, short video clips and files you attach, with any reactions and replies — and glimpses — a photo sent to be looked at once. This is the content of the app, and it is stored so that both of you can open it on any device.

Photos and camera

Only the images and videos you pick, take or record for a journal entry, a glimpse, a chat message, a chat wallpaper, a sticker, an avatar or a cover, and only when you pick them. The chat has a camera of its own, which shows your most recent photos so you can pick one without leaving the app; nothing is read from your library until you tap it. Photos and videos sent in the chat stay in the chat: the app offers no way to save one to your phone or send it anywhere else, and it asks your phone to refuse screenshots and screen recordings of the app. A memory is different in one way: a photo or video you added to one yourself can be saved to your phone's gallery when you tap to save it, which is the one time Blaze adds anything to your library — your partner's pictures stay in the app. Editing in the Studio (filters, crops, words, stickers, trimming a clip, music) happens on your phone, and the music is Blaze's own, carried inside the app. The camera is also used to scan your partner's connection code; those scans are read on the device and never uploaded.

Microphone

Only while you hold the record button to send a voice note in the chat, or hold the shutter in the chat's camera to record a video. The recording is stored so your partner can play it, and it goes when either of you takes the message back or when you delete your account.

Glimpses

A glimpse is stored only until it is looked at or runs out of time. Once opened, it is shown briefly and the photo is then deleted from our servers; an unopened glimpse is deleted when its timer ends. If the recipient's phone reports a screenshot attempt while a glimpse is open, the time of that attempt is recorded and shown to the sender.

Time capsules

A letter or a voice note you seal until a date you choose, stored until then like anything else you write. It is the one thing in the app that not even its author can open early: our servers refuse to record it as opened, and refuse to hand over the recording at all, until the day you named has arrived.

Pause and reconnect

If the two of you use the pause tool, what each of you writes in the "I felt… / I need…" step is stored so the other can read it once you have both finished. The history of past sessions keeps the date and how each one ended and none of the words, and what is said out loud in the repair step is never written down at all. Either of you can delete a session outright.

Your wishlist

The things you add to your own wishlist, with any link, note and rough price. The app never shows your partner the list, and never tells you which item it surfaced to them as a gift hint in the fortnight before a birthday or an anniversary — the hint is worked out on their phone and not written down anywhere. Be clear about the limit of that: the list is stored inside your pair, so it is the app keeping it back rather than the database, and anyone able to reach the raw data could read it.

When you are reachable

If you set quiet hours, the days and times you chose are stored on your profile, together with any "do not disturb until" or "open until" you set, so your partner's app can tell them when you are free rather than letting a message land in a silence. Your phone also publishes the name of its time zone — "Europe/London", not a position — so your partner can see your local time and the app can count down to a visit. A zone is a band of the world, not a location.

What you're listening to

Only if you turn on Profile › Now playing, which stays off until you do. While it is on, your partner can see the song you are listening to — its title, artist and album, which music app it is playing in, how long it is and how far through it you are — or a song you choose yourself, with any link you paste. On iPhone, Blaze can see only the song playing in Apple's Music app, and only while Blaze is open, using the Apple Music permission you grant. On Android, it sees which song a music app on your phone is playing — Spotify, Anghami, SoundCloud, YouTube Music, Apple Music, Deezer, TIDAL, Amazon Music or Samsung Music, and you can switch any of them off — including while Blaze is closed, through the notification access you grant in your phone's settings; Blaze uses that access only to see what is playing, asks for no notifications, and does not read, keep or share them. Blaze does not connect to your account on any music service and receives nothing from one. Only the song showing now is kept — never a history of what you listen to — and it is deleted when the song ends (at the latest about an hour afterwards), when you hide it, pause sharing or turn it off, and when you delete your account.

How much the two of you use it

One tally per day for your pair, counting things like messages sent, photos uploaded and capsules sealed. It is what the free plan's daily allowances are measured against, and what stops a bug or a faulty client running up a bill nobody meant to spend. It counts events; it records nothing about what was in them.

Activity and the relationship score

The time you were last active, and the running score shown on Home — a total worked out on our servers from the things the two of you do in the app, such as writing a memory or finishing a challenge. It counts actions; it does not read what you wrote.

Notifications and device

A push notification token for your device, the platform it runs on (iOS or Android), and which categories of notification you have switched on. The token is what lets us tell you that your partner wrote something; it identifies the device, not you personally.

Calendar

If you add a planned date to your calendar, the event is written to the calendar on your own device. We do not read your calendar and nothing from it reaches our servers.

Support messages

If you email support from inside the app, the draft includes your account identifier, the app version and your device platform so we can reproduce what you are seeing. You can delete any of that from the draft before sending it. Your email address reaches us because you are the one sending the email.

On your device only

A few things are kept on your phone and never sent to us: your language and appearance choices, whether you have seen the introduction, which of the week's love-language ideas you have ticked off, a local copy of your notification preferences, and photos waiting to upload while you are offline.

We do not collect your location. Nothing in the app reads your phone's position, and there is no location permission in either build. The one thing that sounds like it — the name of your device's time zone, described above — is a band of the world rather than a place, and you can see it in your own settings.

We do not use advertising identifiers, and we do not track you across other companies' apps or websites. Blaze contains no third-party advertising, analytics or crash-reporting SDKs.

Why we use it

To run the app

Signing you in, connecting you to your partner, and storing and syncing everything the two of you write so it is there on every device you use.

To notify you

Sending the push notifications you have switched on — a new memory, a date reminder, an answered question, your partner's check-in, a poke, a glimpse, a chat message. If you use Blaze on more than one phone, each one you have allowed notifications on is sent to. Every category can be turned off individually in Profile → Notifications, and all of them can be turned off in your phone's settings.

To keep accounts safe

Detecting and preventing abuse, and enforcing our Terms of Use. If you report your partner or one of their messages from the chat, the report — who filed it, who it is about, which message if any, the reason and anything you wrote — is stored where only we can read it, and your partner is not told. Security rules on our database confine every read and write to the account that owns the data and the partner it is shared with.

To support you

Answering the messages you send us and fixing what they report.

Where the GDPR applies, our legal basis is performance of the contract between us for everything needed to run the app, your consent for push notifications, for access to your photos, camera, microphone and calendar, and for sharing what you are listening to with your partner (Now playing) — each of which you can withdraw at any time in the app or your phone's settings — and our legitimate interest in keeping the service secure and answering your support requests.

Who can see it

Your partner

The person you are connected to can read your profile and everything shared into your joint story. That is the purpose of the app. Nobody else using Blaze can see any of it.

What your partner is not shown

A few things are deliberately held back from the person you are connected to: your wishlist, their photo of the day until you have posted yours, the title of a surprise date until the evening arrives, and each other's answers in the pause tool until you have both written. Where the database itself can enforce that, it does — a sealed time capsule cannot be opened early by anyone, its author included, and neither can its recording be fetched. Everywhere else on that list it is the app exercising restraint rather than the database refusing, because the two of you are allowed to read your shared space. We would rather write that down than let you believe otherwise.

Us

The small team that runs Blaze can technically reach the data on our servers, because Blaze is not end-to-end encrypted — see "How it is protected". We look only when we have to: to answer a support request you made, to investigate abuse or a safety report, or when the law requires it. Never to read your story out of curiosity, and never to build a profile of you.

Google (Firebase)

Blaze runs on Google's Firebase platform — Authentication, Firestore, Cloud Storage, Cloud Functions and Cloud Messaging. Google processes this data on our instructions, under Google's own security and privacy commitments, and does not use it for its own purposes.

Google Sign-In and Sign in with Apple

Only if you choose one of them, and only to verify who you are at sign-in. Apple or Google learns that you signed in to Blaze; neither sees anything you write in it.

Apple or Google (purchases)

If you subscribe to Blaze Plus, the payment is taken by the App Store or Google Play under their own terms. We receive confirmation from the store that a subscription is active — which plan, and until when — so we can unlock it for you and the partner you are connected to. We never see your card details.

Apple or Google (checking the app is genuine)

Before it talks to our servers, Blaze asks Apple's App Attest service or Google's Play Integrity service to confirm that the copy making the request is a genuine, unmodified Blaze running on a real device, and attaches that confirmation to what it sends. It is how we keep scripts and repackaged copies of the app away from the data of people who use the real one. Apple or Google is told about the device and the app; it is told nothing about you, and nothing you have written.

Apple (the thirty seconds of a song)

When you tap a song the two of you have saved, Blaze plays a thirty second preview inside the app instead of handing you to Spotify, Apple Music or YouTube. To find that clip it asks Apple's public iTunes Search service for the recording, sending the song's title and artist — or, for an Apple Music link, the track's own id — and your store country. Nothing that identifies you goes with it: no account, no name, no Blaze identifier, and the request carries no sign-in of any kind. If no clip comes back, tapping the song opens the original link in the service it came from, and that service's own terms and privacy policy take over there. In a listening room the same service is asked for what you type into the room's search, with your store country and nothing else, and the clips are played straight from Apple. Before you type anything, the room shows Apple's public chart of the most-played songs in your store country, fetched with that country and nothing else. If you both choose whole songs from Apple Music, Blaze first asks your permission, then plays them through Apple's MusicKit on your own Apple Music subscription: Apple sees that as your own listening, under Apple's privacy policy. When your partner shares the song they are listening to, your phone asks the same service for that song's cover and clip, sending its title, artist and your store country. Blaze never reads your library, your playlists or your listening history. The one exception is Now playing, and only if you turn it on: on iPhone, while Blaze is open, it reads which song Apple's Music app is playing at that moment, to show your partner — see "What you're listening to".

YouTube (videos you watch together)

When a watch party is on a YouTube link, the video plays inside Blaze through YouTube's own embedded player, on each of your phones. That player is YouTube's, loaded from YouTube: it plays the video as YouTube serves it, with any ads YouTube shows, and Google receives what any embedded YouTube video sends it — the video, your device and connection, and YouTube's own cookies — under Google's privacy policy. Blaze sends it nothing about you: no account, no name, no Blaze identifier. To fill in the video's title when you paste its link, Blaze asks YouTube's public oEmbed service about that link and nothing else. A link to a plain video file plays in Blaze's own player, straight from wherever the link points. You can also search YouTube without leaving Blaze: the search opens YouTube's own mobile website in a sheet, signed out, and what you type there goes to YouTube as it would in any browser. Blaze only notices which video you tap, to put it on for the two of you, and remembers the last few you put on in a list kept on your phone alone.

Legal requests

We will disclose information if the law compels us to, and no further than the law compels.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. There is nobody else in this list.

How it is protected

Everything in transit is encrypted with TLS. Everything stored on our servers is encrypted at rest by Google Cloud, which encrypts all Firebase data on disk by default. Every read and write is checked against security rules that confine data to the account that owns it and the partner it is shared with, and a new account is asked to confirm its email address.

Requests that reach our servers also carry a check that they came from a genuine, unmodified copy of Blaze on a real device, described under "Who can see it". It is aimed at scripts and repackaged apps rather than at you, and it tells us nothing about what you write.

Blaze is not end-to-end encrypted, and we will not describe it as such. Your entries are not encrypted with a key that only the two of you hold, so our systems — and the people who operate them, as described above — are technically able to read what is stored. That is the trade that makes account recovery and Export Our Story work. If it changes, this policy and the Privacy & Encryption screen in the app will say so.

No system is perfect. If a breach ever affects your data, we will tell you and the relevant regulator as the law requires.

Where it is stored

Your data is stored on Google Cloud infrastructure and may be processed in countries other than your own, including the United States. Where data leaves the European Economic Area or the United Kingdom, the transfer relies on the European Commission's Standard Contractual Clauses as incorporated into Google's data processing terms.

How long we keep it, and how to delete it

We keep your account and its content for as long as your account exists. There are three exceptions. A glimpse's photo is deleted once it has been looked at or its timer runs out, and the record of it is removed about a day later. And if you or your partner turn on disappearing messages in the chat, every message sent from then on is deleted — words, photos and files alike — once the length you chose has passed, from both of your phones and from our servers. And a song you share through Now playing is kept only while it is showing: it is deleted when it ends — at the latest about an hour afterwards — or as soon as you hide it or turn sharing off.

You can delete your account at any time from Profile → Delete Account, inside the app. It asks you to confirm it is you, then removes your profile, disconnects you from your partner and releases your handle for someone else to claim. Our servers then delete the memories, photos, comments, questions, glimpses and other content you authored, together with your notification token. It cannot be undone, so export your story first if you want to keep a copy — Profile → Export Our Story.

One thing to be clear about: entries in a shared story belong to whoever wrote them, so deleting your account does not delete the memories your former partner wrote, nor their answers to questions you asked — a question you asked stays only if they answered it, because the answer is their writing. If you believe something associated with you has been left behind, email us and we will remove it.

Your rights

See and correct

Your profile is editable in the app at any time, in Profile → Your Profile.

Take a copy

Profile → Export Our Story produces a readable or JSON copy of your shared story, handed to your phone's share sheet so you decide where it goes.

Delete

Profile → Delete Account, as described above.

Withdraw permission

Notifications, photos, camera, microphone and calendar access can each be withdrawn in your phone's settings without affecting the rest of the app.

If the GDPR or UK GDPR applies to you, you also have the right to object to or restrict processing, the right to data portability, and the right to complain to your local supervisory authority. If you are in California, you have the right to know, delete and correct, and the right not to be discriminated against for exercising them — and, as stated above, we do not sell or share your personal information. Write to us and we will answer within the time the law allows, and never later than one month.

Children

Blaze is made for adults in a relationship and is not intended for children. You must be at least 18 years old to use it. We do not knowingly collect personal information from anyone under 18; if we learn we have, we delete the account and its data. If you believe a child has created an account, write to us and we will act on it. Our published child safety standards, including how to report a concern, are at https://blaze-journal.web.app/child-safety.

Changes to this policy

If we change this policy we will update the effective date at the top and publish the new version at the address below. If a change materially affects how we handle your information, we will tell you in the app before it takes effect, so you can decide what to do about it.

How to reach us

Questions about this policy, requests about your data, or anything else: email us and a person will read it.

lowkey9.ai@gmail.com