Privacy Policy — b-mobile for Blipfoto

Last updated: 11 October 2026

Who is responsible

b-mobile for Blipfoto is an open-source project, part of b-oss and led by Ian Stevenson. It is published on the Google Play Store on behalf of the development team by Salient Point Consulting Ltd. It is an independent app built on Blipfoto's public API, and is not affiliated with or endorsed by Blipfoto. Questions about this policy can be sent to b-oss@salientpoint.co.uk or through the contact page, whose form is delivered by Web3Forms.

What stays on your device

• Your Blipfoto access tokens, held in Android's secure storage (the Keystore). They are used to talk to Blipfoto and are never shown or logged.
• Your app settings, the list of members you have hidden, drafts, and photos queued for upload.
• A cache of pictures you have looked at, which is refreshed after 15 minutes and which Android can clear at any time.
• A record of the last request that failed, for troubleshooting. It stays on the device.

None of this is sent to the developer. Uninstalling the app removes it. On Android 10 and later, photos you download from your own entries are saved to your phone's Pictures folder (Pictures/b-mobile) and stay there after uninstalling, like any other saved picture.

What is sent to Blipfoto

The app is a client for Blipfoto, so everything you do in it goes to Blipfoto's servers under Blipfoto's own privacy policy: signing in, browsing, posting and editing entries, uploading photos, comments, stars, favourites, follows and reports. If you add a location to an entry, or use the Nearby tab, the coordinates are sent to Blipfoto as part of that request. The developer does not receive a copy.

Entry photos are uploaded unchanged, including the details stored in the image file (EXIF data, such as the camera model and settings). For a photo taken with your phone's camera this can include the location where it was taken, if location tagging is turned on in your camera settings. That location goes to Blipfoto with the photo, whether or not you add a location to the entry.

Permissions the app asks for

• Camera — only when you choose to take a photo for an entry.
• Location (approximate or precise) — only when you tap my-location on a map, open Nearby, or add your current location to an entry. Your position is used for that request. A location you add to an entry is kept with the draft, on your device, until the entry is posted; otherwise the app does not store it.
• Notifications — optional; to alert you to new comments and activity, and to remind you to post.
• Internet — to reach Blipfoto and the services below.

The app does not ask for access to your photo library; you pick photos with Android's own photo picker, which shares only the ones you choose.

Maps

Map screens load map tiles from MapTiler. When you open a map, MapTiler receives your device's IP address and the map area you are viewing, under MapTiler's privacy policy. If you tap my-location, the map moves to your position, so the area MapTiler receives is the one around you. Nothing is sent to MapTiler until you open a map.

Notifications (optional)

If you turn notifications on, the app registers with b-push, a small service run by the developer on Cloudflare Workers. To check for new activity it stores:

• your Blipfoto user ID;
• a read-only Blipfoto access token, encrypted at rest (it can read, but not post, change or delete anything);
• your device's push token and platform, which Google's Firebase Cloud Messaging issues so a message can reach your phone;
• which kinds of notification you chose, how often to check, and the last counts of unread comments and notifications.

b-push only reads counts of unread items from Blipfoto, never their content, and never writes to Blipfoto. The push messages it sends are delivered via Google's Firebase Cloud Messaging and contain no comment or notification text, only which kind of activity occurred, how many new items there are, and your Blipfoto user ID. Push delivery relies on Google's Firebase Cloud Messaging. The Firebase code in the app gives your device a Firebase installation ID and push token, and Google may log technical data about the device, its IP address and message delivery, under Google's own policies and outside the developer's control. Cloudflare, as host of b-push, likewise processes technical data such as IP addresses under its own policy.

Deleting it: turning notifications off for an account, or disconnecting the account in the app, deletes its b-push record immediately. If you uninstall the app or clear its data without first turning notifications off or disconnecting your account, the record is deleted automatically the next time b-push tries to reach your device and Google reports it gone.

If your access to Blipfoto is revoked, the notification record is deleted as soon as the service notices.

Logs and monitoring

b-push writes operational logs, kept in Cloudflare's Workers Logs, which the developer reads for fault-finding and performance monitoring. They record:

• a summary of each check (how many registrations were checked, how many notifications were sent, how many errors);
• when a check for a registration fails, or a registration is removed: a random registration ID that b-push generated, plus an error code and message;
• the method and path of requests that failed.

Workers Logs keeps them for up to 7 days. They never contain access tokens, request bodies, your Blipfoto username or user ID, or the text of any notification. A registration ID is a pseudonym: the developer can match it to your b-push record while that record exists, so in that sense a log line can be tied to a user, but it identifies nothing else about you, and it stops meaning anything once the record is deleted. Cloudflare may also keep its own standard request data (such as time, URL and IP address) for the Worker, under Cloudflare's policy and for a period set by its plan. The developer does not share b-push logs with anyone else, and cannot see what Google keeps.

What the app does not do

No advertising, no analytics, no tracking, and no crash-reporting service of its own. Google Play may report crash and performance data (Android vitals) to the developer for devices where you have allowed that, under Google's policies. The developer does not sell or share your data. Apart from the optional notification service above, the app has no server of its own.

Children

The app is not directed at children. Use of Blipfoto is subject to Blipfoto's own terms and age requirements.

Your rights

Everything the app holds is on your device and under your control, apart from the optional b-push record described above, which you can delete yourself at any time by turning notifications off or disconnecting the account. Data held by Blipfoto is managed through Blipfoto. Step-by-step instructions, including where to delete a Blipfoto account, are on the data deletion page.

Changes to this policy

If this policy changes materially, the updated version will be published at this URL with a revised date at the top.