1. General
This Policy describes the processing of personal data when you use bloop.wtf and the Bloop service. The data controller is Individual Entrepreneur Esembekov Chyngyz Esembekovich (ИП Есембеков Чынгыз Есембекович), referred to as “Bloop”, “we”, or “us”.
This Policy reflects the applicable requirements of the Digital Code of the Kyrgyz Republic and other mandatory rules. Where a specific operation requires consent, Bloop asks for it separately.
2. Data we process
The data involved depends on whether you use the editor as a guest, sign in, synchronize a project, or send feedback.
- Account data: internal ID, selected sign-in provider, Google, Apple, or Telegram account ID, first and last name, username, email address, email verification status, avatar URL, and a local avatar copy when the provider supplies an image. Bloop does not receive your provider password.
- Project data: project name, animation and styling settings, project revision, modification dates, and the last active project selection.
- Motion projects, scenes, and media currently stay in the browser and do not sync across devices. For signed-in users, the server separately records Motion sessions and browser-reported completed image and video exports, without project contents.
- Gallery publications: the preview you choose, title, description, public author name, a snapshot of template settings, and copy count. Original project media is not included in a publication.
- Media: synchronized images and selected background files. Original videos in the project media strip remain in local browser storage and are not uploaded during project synchronization.
- Feedback: category, message, optional screenshot, associated account, and delivery or review status.
- Technical data: IP address, request date and time, browser and device information, and authentication, security, and administrative logs.
- Voluntary support data: payment amount, currency, identifier and status. Bloop does not store full payment card details.
3. Why we use data
- Create and maintain accounts and handle sign-in and sign-out.
- Save, synchronize, load, and protect projects from conflicting edits.
- Remember the last active project and interface preferences.
- Receive feedback, display it in the admin area, and respond to reports.
- Prevent abuse, rate-limit suspicious requests, investigate errors, and maintain security.
- Comply with legal requirements and protect the rights of Bloop and its users.
4. Local projects and user content
Drafts, source videos, and some media may be stored in IndexedDB directly on your device. Language, theme, onboarding state, and cookie choices are stored in browser storage. Local storage alone does not make this data available to Bloop.
The exported video is created in your browser and is not automatically uploaded to the server. Bloop does not use your projects or media to train machine-learning models.
You determine what your uploads contain and must have a lawful basis to process personal data of other people that may appear in those materials.
5. Cookies and browser storage
- session — an essential HttpOnly authentication session lasting up to 30 days and removed on sign-out.
- oauth_nonce — a short-lived security cookie for Google or Apple sign-in lasting up to 5 minutes.
- bloop_language — your interface language choice lasting up to 1 year.
- localStorage and IndexedDB — interface preferences, cookie choice, projects, and local media; retained until you delete the project or clear site data in your browser.
- Bloop does not use advertising cookies or third-party web analytics. Anonymous, self-hosted visit analytics is enabled only after separate consent.
6. Legal bases
Depending on the circumstances, Bloop processes data to provide the service you request and perform contractual obligations, based on your consent, to comply with law, or for Bloop's legitimate interests, such as protecting accounts, preventing abuse, and resolving errors. Where applicable law gives you the right to withdraw consent or object, you may contact us using the details below.
7. Who may receive data
Bloop does not sell personal data or disclose it to advertising networks. Access is limited to what is needed for each function.
- AlphaVPS — server infrastructure and backups in Germany.
- FreedomPay — processing voluntary one-time payments to support the service on its secure payment page. Bloop does not receive the full bank card number.
- Google, Apple, and Telegram — the sign-in provider you choose; each provider processes data under its own policy.
- Telegram — delivery of feedback text and, where delivery is available, an attached screenshot to Bloop's private administrator group.
- Public authorities or other parties — only where required by law or a court order, or necessary to protect lawful rights.
8. International processing
Bloop's primary server infrastructure is located in Germany. Google, Apple, and Telegram may also process data in other countries. For international processing, Bloop uses available contractual, organizational, and technical measures and limits disclosure to the data required.
9. Retention
- Authentication sessions are retained for no more than 30 days and OAuth security codes for no more than 5 minutes.
- Account data and synchronized projects are retained while the account is in use or until a valid deletion request, unless law requires some data to be kept longer.
- Feedback and screenshots are retained for as long as needed to review the report, maintain security, and document action taken.
- Local projects and media remain on the device until you delete them or clear site data.
- Deleted server data may remain temporarily in restricted backups until routine rotation.
10. Security
Bloop uses HTTPS, HttpOnly and Secure cookies, hashed session tokens, access controls, origin checks, request rate limits, backups, and administrative audit logs. No transmission or storage method provides an absolute guarantee, so these safeguards are reviewed regularly.
11. Your rights
Subject to applicable law, you may request information about processing, a copy of your data, correction, deletion, restriction, portability, or withdrawal of consent. We may need to verify your identity before acting to protect your account.
Send requests to [email protected]. You may also complain to the Personal Data Protection Agency under the Cabinet of Ministers of the Kyrgyz Republic or bring a claim before a competent court.
12. Children's data
Bloop is not specifically directed to children and does not knowingly request age information. If you believe a child submitted data without any consent required from a legal representative, contact us so we can review the situation and delete data where appropriate.
13. Changes and contact
If processing practices materially change, we will update this page and its revision date. Send privacy questions and personal data requests to the controller: Individual Entrepreneur Esembekov Chyngyz Esembekovich (ИП Есембеков Чынгыз Есембекович), [email protected].