Privacy Policy
Last updated: 1 October 2026
This policy explains what information Blab collects, why, who it is shared with, how long it is kept and what you can do about it. It applies to the Blab app for iOS and Android and to this website.
Blab in short
- No ads, no selling. We don’t show ads, we don’t sell your information, and we don’t use it to track you across other apps or websites.
- No AI on your content. We don’t transcribe your voice notes, create voiceprints, analyse your content with AI or use it to train AI.
- Messages expire. Messages are deleted after the expiry time set for the conversation, and no later than 24 hours after they are first opened.
- Not end-to-end encrypted. Your messages are protected in transit and in storage, but Blab is not end-to-end encrypted. Our systems can technically access stored messages. Only a few people authorised by ZINK LABS can do so, and only when needed to investigate a report, keep Blab running or comply with the law.
- You’re in control. You can download a copy of your data and delete your account from the app’s settings at any time.
1. Who we are
Blab is provided by ZINK LABS LTD, a company registered in England and Wales (company number 14100061), registered office 25 Portland Crescent, Feltham, England, TW13 4RY (“we”, “us”). We are the controller of the personal data described in this policy.
Contact our privacy team at privacy@blabtalk.com.
2. The information we collect
Information you give us
| What | Details |
|---|---|
| Account details | First name, surname, username, mobile phone number (verified by text message), email address, password, date of birth and gender. Your password is handled by our sign-in provider and stored only in hashed form. We never see it. |
| Profile photo | Optional. You can add or change it at any time. |
| Your content | Voice notes, text messages, emoji, photos, videos, files, GIFs and stickers, links, reactions, replies, stories, group names and group photos. |
| Location you share | If you choose to send your location in a chat, its precise coordinates and their accuracy. See section 6. |
| Contacts | If you allow access, the phone numbers in your address book, used to find friends. Names from your address book stay on your phone. See section 5. |
| Safety and support | Reports you make (who or what you reported and the reason), people you block or mute, and messages you send to our support or privacy teams. |
| Consent record | Which version of these terms and this policy you accepted, and when. |
Information collected when you use Blab
| What | Details |
|---|---|
| Activity status | Whether you’re online, when you were last active, and whether you’re recording or listening. Your friends can see this. |
| Receipts and views | When each message was delivered to, played by or replayed by each person in a conversation, which everyone in the conversation can see. When someone views your story, which you can see. |
| Device and app information | An app-generated device identifier, a push-notification token, your device platform and operating system, app version, and the installation identifier our infrastructure provider uses to deliver configuration and notifications. |
| Technical and crash data | If the app crashes or hits an error, a report containing your Blab user ID, device model and operating system, the error details, recent app log lines and the screens you visited, which can include conversation and user IDs. These reports are designed not to include message content. |
| IP address | Our own code does not record your IP address. Our infrastructure and crash-reporting providers receive it whenever your device connects to them, and their logs may store it (see section 10). |
Information from other people
- Your phone number in someone else’s contacts. If another user who has your number allows contact access, we use your number to suggest you to each other (see section 5).
- Content and reports about you. Other users may send you messages, mention you, or report you or your content.
We do not collect advertising identifiers, payment information, biometric data or information about your health, beliefs or other special categories of data. We don’t infer your interests or build an advertising profile of you.
3. How we use information and our legal bases
UK and EU data protection law requires us to explain the legal basis for each use.
| Purpose | Information used | Legal basis |
|---|---|---|
| Create and run your account, deliver messages and stories, show your friends, send notifications | Account details, content, activity status, receipts, device information | Performing our contract with you (the Terms of Service) |
| Help you find friends who use Blab | Contacts you choose to share, phone number | Our and our users’ legitimate interest in connecting people who already know each other. You choose whether to grant contact access. |
| Check you are old enough to use Blab | Date of birth | Legitimate interests and compliance with legal obligations that protect children |
| Keep Blab safe: review reports, enforce our Community Guidelines, limit spam and abuse, cooperate with lawful requests | Reports, blocks, the reported content while it still exists, account details, rate-limit counters | Legitimate interests in keeping users safe. Compliance with legal obligations, including online-safety law. |
| Fix bugs and keep Blab reliable | Technical and crash data | Legitimate interests in a working, secure service |
| Respond to you | Support and privacy messages | Legitimate interests, and legal obligations for privacy requests |
| Comply with the law and protect our rights | Any relevant information | Legal obligation and legitimate interests |
Blab only accesses your microphone, camera, photos, contacts and location after you give permission in your device settings. You can withdraw it there at any time. Where we rely on legitimate interests, you can object (see section 12).
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Messages, voice notes and privacy
Who can see your messages. Only the people in the conversation see your messages in the app. Stories are shown to the friends you share them with.
Expiry. Each conversation has an expiry setting: 5 minutes, 1 hour or 1 day. Older conversations may still use an earlier setting of up to 30 days. An unopened message is deleted when its expiry time passes, and never kept unopened for more than 30 days. Once a message has been opened, it is deleted at its expiry time or 24 hours after it was first opened, whichever comes first. After expiry, the message and its media are removed from our database and file storage automatically, usually within a day. Deleted files can remain in our storage provider’s recovery area for up to 7 days.
Encryption. All traffic between the app and our servers is encrypted in transit, and our infrastructure provider encrypts all stored data. Voice notes are additionally encrypted on your device before upload. The key is stored with the message on our servers so the people in the conversation can play it. Blab is not end-to-end encrypted, so our systems can technically access stored messages, including voice notes. Only a small number of people authorised by ZINK LABS can access our production systems, and they only access content when needed to investigate a report, keep Blab running or comply with the law.
Notification previews. Push notifications can include the sender’s name and the first part of a text message. They are delivered through Apple’s and Google’s push-notification services.
Copies others make. Blab cannot stop the people you message from taking screenshots, recording their screen or keeping copies in other ways. Expiry only controls what Blab stores.
Photo and video metadata. Photos and videos you choose from your gallery can contain information your camera added, such as where they were taken. Blab does not currently remove this information, so the people you send them to may be able to see it. Photos taken with Blab’s own camera do not include your location.
We don’t use your content for: advertising, recommendations, AI analysis or AI training. We don’t transcribe voice notes or create voiceprints.
5. Contacts and finding friends
If you allow access to your contacts, Blab checks your address book automatically and again later to find new matches:
- The app reads the phone numbers in your address book. Names and other contact details stay on your phone.
- The numbers are sent over an encrypted connection to our server. The server converts each one into a keyed hash (a scrambled code made with a secret key) and compares it with the hashed numbers of Blab users. The plain phone numbers are not stored.
- Contacts already on Blab are suggested as friends.
- For numbers that aren’t on Blab yet, we keep the keyed hash together with your user ID, so we can tell you if that person joins later. At the moment this information is not deleted automatically, even when you delete your account. We’re changing this so it’s deleted when that person joins Blab, when you delete your account, and in any case 12 months after the number was last found in your contacts. Until then, you can ask us to delete it at any time.
If you don’t use Blab and a user who has your number shares their contacts, we hold only a keyed hash of your number linked to that user. We never hold your name or any other detail from their address book. You can ask us to delete it by emailing privacy@blabtalk.com with your phone number. We’ll use the number only to find and delete the matching records.
You can stop contact matching at any time by turning off contact access in your device settings. To stop other people finding you through their contacts, turn off Discoverable by phone number in Settings › Privacy.
6. Location
- Blab only uses your location when you tap to send it in a chat. It is a one-time reading and is never collected in the background.
- The precise coordinates and their accuracy are stored with that message, shown to the people in the conversation and deleted when the message expires.
- Tapping a shared location opens it in a maps app or website, such as Google Maps, under that provider’s privacy policy.
- We don’t work out your location from your IP address, and we don’t use location for recommendations or advertising.
- Photos and videos can carry location metadata. See section 4.
7. What other people can see
| Who | What they can see |
|---|---|
| Any Blab user | Your name, username, profile photo and gender (if set). People can find you by your username, by your phone number if it’s in their contacts, or by scanning your QR code. |
| Your friends | Your activity status (online, last active, recording or listening) and the stories you share with them |
| People in a conversation with you | Your messages, reactions, any location you send, and when you received, played or replayed their messages |
| Nobody else | Your phone number, email address and date of birth are visible only to you and to us |
In Settings › Privacy you can choose who can message you and whether people can find you by your phone number or username.
If you block someone, you stop seeing each other in Blab: they can’t message you or find you, and they are removed from your friends.
8. Who we share information with
- Service providers that host and run Blab for us. They may only use the information to provide their service to us. The current list is on our Sub-processors page.
- Other users, as described in section 7 and by your own choices.
- Apple and Google, which deliver push notifications and run the app stores.
- Authorities, where the law requires it. We may also share information to protect someone’s life or safety, or to report child sexual exploitation and abuse to the relevant authorities.
- Professional advisers such as lawyers and auditors, under confidentiality.
- A buyer or successor if our business or Blab is reorganised, sold or transferred. They must continue to protect your information as this policy describes.
We do not sell personal information, and we do not share it with advertisers or data brokers.
9. International transfers
We are based in the UK. Our main database and servers are in the European Union (Belgium and the Netherlands). Some information is processed in the United States: photos, videos, voice notes and other files, sign-in data, crash reports and GIF search. Apple and Google may process push notifications in other countries.
When information leaves the UK or the European Economic Area, we rely on adequacy regulations or decisions, including the UK–US data bridge and the EU–US Data Privacy Framework where the recipient is certified. Otherwise we rely on the standard contractual clauses approved by the European Commission together with the UK International Data Transfer Addendum. You can ask us for more details.
10. How long we keep information
| Information | How long |
|---|---|
| Account and profile | Until you delete your account. Edits replace the earlier version. |
| Messages and their media | Until expiry, as described in section 4 (never more than 30 days unopened) |
| Stories | Shown for 24 hours, then the story is deleted. At the moment its photos, videos and voice, and its views, reactions and replies, are kept until the author deletes their account. We’re changing this so they’re deleted together with the story. |
| Friends, requests, blocks and mutes | Until you remove them or delete your account |
| In-app activity feed | Until you delete your account |
| Contact-match data | See section 5 |
| Reports | At the moment, until we delete them. We’re introducing automatic deletion 6 months after a report is made, unless we need it for longer to deal with an appeal, a legal claim or a request from the authorities. |
| Data exports you request | Download link valid for 7 days. The file is deleted when you delete your account. |
| Device and push information | Until the push token stops working or you delete your account |
| Server logs | 30 days |
| Crash reports | Up to 90 days |
| Backups | We don’t currently keep separate database backups. Deleted files may stay in our storage provider’s recovery area for up to 7 days. |
11. Security
We use encryption in transit and at rest, extra encryption for voice notes, access controls and rate limiting. Only a small number of people authorised by ZINK LABS can access production systems. No system is perfectly secure, and Blab is not end-to-end encrypted. If a security incident affects your personal data, we will notify you and the regulator where the law requires.
12. Your rights
Wherever you live, you can ask us to:
- Access your information and get a copy. In the app, go to Settings › Data & privacy › Export your data. The export covers your account and message data. It doesn’t yet include media files, so email us if you want a copy of those.
- Correct it. You can edit your profile in the app.
- Delete it. In the app, go to Settings › Delete account, or see Delete your account.
- Object to uses based on legitimate interests, or ask us to restrict them
- Port your data to another service
- Withdraw permissions at any time in your device settings
To exercise these rights, email privacy@blabtalk.com. We may need to confirm it’s you. We reply within one month. The law allows us to extend this by up to two more months for complex requests, and we’ll tell you if we do.
Complaints. If you’re unhappy with how we handle your information, please tell us first at privacy@blabtalk.com. We’ll acknowledge your complaint within 30 days and investigate it. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk/make-a-complaint). In the EU, you can complain to your local data protection authority (list of EU authorities).
United States. We don’t sell or share personal information for cross-context behavioural advertising, and we don’t use sensitive personal information to infer characteristics about you. You can ask to know, correct or delete your information as described above. We won’t treat you differently for doing so.
13. Children and teenagers
You must be at least 13 to use Blab. We check your date of birth when you sign up. If we learn that someone under 13 has an account, we will delete it. If you think a child under 13 is using Blab, please tell us at privacy@blabtalk.com.
For everyone, including teenagers: there are no ads, no profiling and no content recommendations. Location is shared only when you choose to send it, and your phone number, email address and date of birth are never shown to other users.
14. This website
blabtalk.com is a static website hosted by Cloudflare. It uses no cookies, analytics, tracking or scripts. Cloudflare processes your IP address and basic request information to deliver the site and protect it from attacks.
15. Changes to this policy
We’ll update this policy when the way we handle information changes, and change the “Last updated” date above. If a change is significant, we’ll let you know in the app and ask you to review it before you continue using Blab.
16. Contact us
- Privacy questions and requests: privacy@blabtalk.com
- Everything else: support@blabtalk.com
- By post: ZINK LABS LTD, 25 Portland Crescent, Feltham, England, TW13 4RY