Privacy Policy

Last updated October 20, 2026

1. Who we are

Blobstash ("we", "us") is operated by Blobstash. This policy explains what we collect on blobstash.com and in the Blobstash app, why, and the choices you have. Contact us at privacy@blobstash.com.

2. Information we collect

Information you give us

• Account: a username and a password. Passwords are stored only as a secure one-way hash (bcrypt). We ask players not to use their real name as a username.
• Teacher setting: whether an account is a teacher account.
• Things you make: stashes (question sets), class names, and trade or market offers.
• Guest nicknames: guests can join a live game with a nickname only. Guest nicknames aren't saved to an account. They appear in the host's game report.
• Teacher payments: teachers who buy Blobstash Plus pay through Stripe. Stripe collects the payment details and billing email. We receive and store only a Stripe customer ID and whether the subscription is active. We never see or store card numbers.

Information created when you play

• Your collection (blobs, banners, tokens), packs opened, trades and market activity, daily streaks, friends, and game scores.
• Answers to stash questions. These are used to award tokens, and for students in a class, to show the teacher homework and live-game results.
• When you were last active and how long you played. This is used for "online now" and for service statistics.

Technical information

• Sign-in cookie: one essential cookie that keeps you signed in. See the Cookie Policy.
• IP address: used briefly to keep the service secure, for example to rate-limit sign-in attempts and block abuse. Our hosting provider may keep it in short-lived server logs. We don't store IP addresses in our database.
• Analytics: we count visits ourselves, with no third-party analytics and no analytics cookies. We record which page was viewed, the website you came from (domain only), and the device type (phone, tablet or computer). To count unique visitors, we use a code made from your IP address, your browser type and a secret that changes every day. The code is deleted after 2 days, can't be used to identify you, and can't track you across days or websites. You can turn analytics off with the cookie banner, and we honor Global Privacy Control and Do Not Track signals automatically.

What we don't collect

We don't collect email addresses from students, real names, birthdays, photos, voice recordings, precise location, contacts, or advertising IDs. We don't use third-party ad networks, social media plugins or tracking pixels. Our fonts are hosted on our own servers.

3. How we use information

• To run Blobstash: accounts, collections, trading, stashes, live games, and teacher classes, homework and reports.
• To keep it safe and fair: preventing cheating, spam, fraud and abuse, and enforcing our Terms and Community Guidelines.
• To understand and improve the service, using aggregate statistics.
• To process teacher subscriptions and school licenses.

We don't use student information to build profiles for advertising, and we don't use it for any purpose other than providing and improving the educational service.

4. Who can see what

• Other players can see your username, avatar, banner, collection, and public stashes.
• Teachers can see the usernames of students who joined their class. They also see those students' homework progress and results in live games the teacher hosted. Teachers can't see students' passwords, trades or friends.
• Site administrators can see account information to provide support and keep the service safe, for example to reset a password or remove inappropriate content.

5. How we share information

We share information only with these service providers, and only as needed to run Blobstash:

• Hosting and databases: Render (web hosting) and Neon (database), in the United States.
• Payments: Stripe, for teacher subscriptions only.

We may also disclose information if the law requires it, to protect someone's safety, or as part of a merger or sale of the service. In a merger or sale, this policy, or one at least as protective, will continue to apply to student information. We do not sell personal information, and we don't "share" it for cross-context behavioral advertising.

6. Children's privacy (COPPA)

Blobstash is designed for students, including children under 13. We collect only what's needed to make the game work. That means a username, a password, and the in-game activity described above, plus a sign-in cookie used to support the service's internal operations.

• At school: when a teacher or school uses Blobstash in class, the school may give consent on parents' behalf. This applies only to the educational use of the service, as the FTC allows. Teachers should follow their school's rules for online tools.
• At home: kids under 13 should have a parent's or guardian's permission to create an account.
• Parents' rights: a parent or guardian can ask to review their child's information, ask us to delete it, or tell us to stop collecting it. Email privacy@blobstash.com with your child's username. We'll take reasonable steps to confirm you're the parent. Students can also delete their own account in Settings.
• If we learn that we collected information from a child in a way this policy doesn't allow, we'll delete it.

7. Students and schools (FERPA and state student-privacy laws)

When a school uses Blobstash, we act as a "school official" under FERPA. We use student information only for the school's educational purposes, and the school stays in control of it. We will:

• not sell student information, or use it for targeted advertising or non-educational profiles;
• delete a student's information when the school or a parent asks, or when the account is deleted;
• protect it with reasonable security; and
• consider signing a student data privacy agreement (DPA) with schools and districts that need one. Contact privacy@blobstash.com.

8. Cookies and local storage

We use one essential cookie to keep you signed in, plus your browser's local storage to remember choices like your cookie-banner answer. We don't use advertising or cross-site tracking cookies. Details are in the Cookie Policy.

9. How long we keep information

• Accounts: kept until the account is deleted. When you delete your account, your collection, stashes, trades, friendships, class memberships and homework progress are deleted right away. Your username is replaced with "Deleted player" in teachers' game reports.
• Backups: our database provider keeps backups for a short period (usually up to 30 days) before they are overwritten.
• Sign-in sessions: expire after 30 days.
• Analytics: the daily visitor codes are deleted after 2 days. Aggregate counts, such as "120 visits today", are kept.
• Live games: live games exist only in memory while they're running. The host's report is kept until the host deletes it. We keep up to 200 reports per host.

10. Security

Blobstash only works over HTTPS (encrypted connections). Passwords are hashed. Sign-in attempts are rate-limited, requests are protected against cross-site attacks, and every action is checked on our servers. No system is perfectly secure. If a breach affects your information, we'll notify affected users and schools as the law requires. To report a security issue, see security.txt.

11. Your choices and rights

• You can see and change your username and password in Settings, and delete your account there.
• You can turn off analytics with the cookie banner, Global Privacy Control, or Do Not Track.
• Depending on where you live (for example California, Colorado, Virginia, or the EU/UK), you may have rights to access, correct, delete or move your information, and to object to some uses. To make a request, email privacy@blobstash.com. We won't treat you differently for using these rights.

12. Where information is stored

Blobstash is run from the United States, and information is stored there.

13. Changes to this policy

If we make important changes, we'll post them here and show a notice in the app. If we ever want to use children's information in a materially different way, we'll first get any consent the law requires.

14. Contact

Blobstash · privacy@blobstash.com