What we do with your night
The whole product is other people's faces, so this page is the one that has to be honest. Here's exactly what happens.
Last updated: 10 October 2026.
This notice covers Blink on the website at joinblink.me and in the Blink apps: the iPhone app and its App Clip, widgets and Live Activities, the Apple Watch app if you use it, and the Android app.
When this version applies. It applies to anyone who starts using Blink on or after 10 October 2026. If you were already using Blink before then, it applies to you 14 days after we email you about it.
Blink is operated by Chariot Archive, Inc., a Delaware corporation, 195 East Main Street, Columbus, Ohio 43215, USA. We are the controller of the personal information described here, except as the next paragraph explains. Reach us at support@joinblink.me.
Who is responsible for event photos. When someone hosts a night for themselves, their family and friends, we are responsible for how Blink handles its photos. When a business or other organisation hosts an event, it decides why its event is photographed and who sees the pictures. That includes a venue, a brand, an employer, a school, a planner or an agency. The organisation is the controller of the photos in its roll, and it is responsible for telling you about it and for having a lawful reason to photograph you. Blink stores and shows the roll for it as its processor, under the processing terms in the Terms. Blink stays responsible for everything else this notice describes. You can ask either of us about your photos, and we'll pass on anything that is the host's to answer.
These are commitments about how Blink is built today, not aspirations:
If you're a guest:
We collect no password, no phone number, no contacts, and no precise location. The only exception is when a host turned on arrival check-in on the website and you allowed it. We do see the country your IP address points to.
If you're in a photo but didn't join: the photo itself, and nothing else about you. You can still ask us to take it down; see Report.
If you're a host:
If you buy something:
We never see your card number.
If you use a code: we log every attempt at the "Have a code?" field, on the website or in the apps. The log holds the code, when you tried it, whether it worked, your account and event, the price before and after, the platform, and a one-way hash of your IP address (never the address itself). We use it to stop code guessing, to prevent fraud, and, for a creator's code, to pay that creator their commission.
If you report something or write to us: what you tell us, the photo or guest you report, and the address to reply to.
What you have to give. To take part in an event, the photos and clips you take. To host, an account. To buy, the purchase record. Everything else is up to you: a name in the apps, an email address, notifications, location, the Registry. Leave out an email address and notifications, and you just won't be told when the roll is ready.
Where it comes from: from you, from your device and browser, and from Apple, Google and Stripe (and, for earlier Ghana payments, Paystack) when you sign in or pay through them.
Either way, how Blink is used. We record:
This is tied to a random install ID or to your guest or host ID, which can be linked back to your account. Names, email addresses and IP addresses are kept out of it. We and our analytics provider use it only to understand and improve Blink. We never sell it or use it for anyone else's advertising.
What the night is for. From an event's name we work out what kind of occasion it is: a wedding, a birthday, a dinner. Only that category goes into our analytics. The name itself never does.
How you found Blink. On the website, if you're in the United States, we keep the campaign tags on the link you first arrived by (such as utm_source) in a first-party cookie for 30 days. If you sign up, we save them to your host account and to our analytics provider's record of that account. Visitors outside the United States don't get this cookie.
Diagnostics. Crash and error reports, with the device model and operating system. They're tagged with the event and screen where they happened, but not with your name, email or account. We also keep the basic technical logs (IP address, browser type) that any website receives, to keep the service running and to stop abuse. On the website we also use the country your IP address points to, to show the right prices and whether the website can sell to you.
The apps ask for a permission only when you reach the feature that needs it. You can say no, or change your mind in your phone's settings:
The App Clip lets a guest join and shoot without installing the app. It uses the camera and can ask for an email address. It has no access to your photo library. If you install the full app, your place in the event moves across to it on the phone.
Widgets and Live Activities show an event's name, count and reveal time from a file the app keeps on your phone. They send nothing to us themselves.
The Apple Watch app, if you use it, is a remote shutter for your iPhone. It takes no photos and talks only to your phone. The photo is taken and uploaded by the iPhone app.
On the phone itself, the apps keep your sign-in or guest session in the phone's secure storage, photos still waiting to upload, and usage events waiting to be sent. Deleting the app removes them from the phone.
Cookies on the website:
Our analytics on the website don't set cookies or store anything in your browser. No advertising cookies.
Creators who bring people to Blink are paid a commission on what those people buy. To know whom to pay, we match a purchase to the creator whose link or code brought you. Today that happens one way:
Someone who only ever joins as a guest is never attributed to a creator.
We use each piece of information for the reasons below. The GDPR and UK GDPR legal basis for each is in brackets.
During the event, nobody but the person who took it. Not the other guests, not the host, not us browsing for fun. You can see your own photos. Everyone else's are hidden until the reveal time the host set. That's the entire point of the product. A host may be shown a photo held back for review, so they can keep it hidden or include it.
After the reveal, the roll is visible to the people who joined that event, and to anyone the host shares the album link with. The reveal email goes to every person who joined, left an address and asked to be told.
Staff access is limited to what's needed to operate the service, such as debugging a broken upload or acting on a report. We don't browse galleries.
Photos and clips: about a year after the event ends, then permanently deleted. A host can set a shorter window, not a longer one. We try to email everyone with photos at stake before a gallery comes down. Blink is not a backup service: download the roll when it is revealed. See the terms.
If a host deletes an event: it disappears immediately, and there is a 30-day window in which it can be restored. After 30 days, the photos and the files behind them are permanently removed.
If you delete your account: we permanently delete:
Any Sign in with Apple token is revoked. What we keep is anonymised: a record of each purchase (what was bought, when, for how much and on which platform), and counts in our analytics and logs with everything that identified you removed. We need the purchase records for tax and to reconcile payments with Apple, Google, Stripe and Paystack. Those companies keep their own records of a payment under their own policies.
Deletes finish. If a deletion is interrupted, it is retried until it completes, so no files are left orphaned in storage.
Acceptance records, code logs and analytics. While your account exists we keep:
For guests, who have no account, we keep the acceptance record and code log as long as the event's roll exists, then delete them with it.
When you delete your account, everything in them that identifies you is removed. The cookie that remembers how you first arrived expires after 30 days. Crash reports and server logs are kept for a short period set by the provider and then deleted.
Deleted means deleted from our storage. We cannot recall a copy someone else downloaded before the deletion.
What the law makes us keep. Some things the law requires us to keep, and that overrides the deletion periods above. For example: material we have reported to the National Center for Missing & Exploited Children, which US law requires us to preserve, currently for one year after the report, or information needed for a legal claim. We keep only that, in restricted storage that only a few named people can reach, and only for as long as the law requires. Then we delete it.
We use a small number of service providers, each doing one job and none of them permitted to use your data for their own purposes except where noted:
We will also disclose information where the law requires it — a valid legal process — or where it is necessary to protect someone from harm, including reporting child sexual abuse material to the National Center for Missing & Exploited Children.
Blink is run from the United States, and most of our providers store data there. If you use Blink from the EEA, the UK or Switzerland, your information is transferred to the United States. Where that happens, we rely on the European Commission's Standard Contractual Clauses and the UK addendum in our providers' data processing terms, or on the EU–U.S. Data Privacy Framework where a provider is certified under it. Ask us for a copy of the relevant safeguards.
The same is true wherever else you use Blink, including Morocco, Ghana, Nigeria, Kenya, South Africa, Brazil, Canada, Australia, India, Türkiye and the Gulf states. Your information is stored and processed in the United States, by us and by the providers listed above. Some countries require a particular safeguard, contract, filing or authorisation for that. Ask us which one applies to your country and we will tell you.
Data is encrypted in transit, and our storage providers encrypt it at rest. No system is perfectly secure. If a breach affects you, we will tell you as the law requires.
Take my photo down. Anyone can ask, whether or not they were at the event and whether or not they took the photo: joinblink.me/report. In the apps, open the photo and choose Report. This is also how you object to appearing in a roll.
If it's an intimate image of you shared without your consent, choose "Intimate image of me" at joinblink.me/report. We remove it within 48 hours of a valid request, and usually sooner, and make reasonable efforts to find and remove identical copies. We keep you updated on its status until it's done.
Delete my own photo. During an event you can delete a photo you took, from the camera screen.
If you're under 18 and live in California, you can remove any photo, clip or note you posted, at any time, by deleting it in the app or asking us at support@joinblink.me. Removal takes it out of our storage; it may not remove copies others already downloaded.
Stop emailing me. Every email except a purchase receipt carries an unsubscribe request, and you can always write to us. You can also simply not give an address; the night still works. Notifications can be turned off in your phone's settings.
The Registry. The Registry remembers you across events by the email address you chose to give us, never by your face. It is off by default and only turns on if you tick the box yourself. You can turn it off from your session at any time.
Delete my account. In the apps: You → Settings → Delete account. On the website: your dashboard profile. That permanently deletes the account, the events you made and every photo and clip in them (your guests' too), and the photos you took as a guest at other events. Guests without an account can ask us.
See, correct, delete or take a copy of what we hold. Write to support@joinblink.me. We answer within 30 days, usually much sooner. If the law lets us take longer for a complicated request, we will tell you why within those 30 days. We may ask a question or two first to be sure you're you, and someone you authorise can ask for you. A copy comes in a form you can open and move somewhere else, and the photos come as photos.
What deletion leaves behind. Only two things:
If you're in the EEA, the UK or Switzerland, you also have these rights:
We'd like the chance to fix it first.
If you're in California or another US state with a privacy law, you have the right to know what we collect and why, to get a copy, to correct it and to delete it. In the last twelve months we have collected:
We use them only for the purposes above, and disclose them only to the companies listed above for those purposes. If we turn down a request, you can appeal by replying to our answer, and we will explain the outcome of the appeal in writing.
Sensitive information. The only sensitive information we set out to collect is precise location, and only where a host turned on arrival check-in and you allowed it. We use it only for that check-in, never to work out anything about you. Location embedded in photos is removed on upload. Photos can show things about the people in them; we don't analyse them for that.
No decisions by machine alone. We don't make decisions about you with legal or similarly significant effects by automated means alone. An automatic safety check can hold a photo back, but only a person can release or remove it.
We do not sell your personal information, and we don't share it for cross-context behavioral advertising or targeted advertising. We don't send creator attribution data to GoMarketMe or any other company.
Asking changes nothing. None of this costs money, and none of it costs you the product. No worse price, no worse service, nothing quietly switched off because you asked.
Blink is run from the United States. What we collect is stored and processed there and with the companies listed above, wherever you use Blink (see where it is stored). The choices on this page apply wherever you are.
If you’re in Morocco, Law 09-08 on the protection of individuals with regard to the processing of personal data gives you the right to access the information we hold about you, to have it corrected, and to object, on legitimate grounds, to our using it. To use these rights, write to support@joinblink.me; we answer within 30 days. You can also complain to Morocco’s data protection authority, the CNDP (Commission nationale de contrôle de la protection des données à caractère personnel).
Wherever you live, you can ask us for a copy of the information we hold about you, to correct it, to delete it, to stop using it for a purpose you object to, and to take you out of a photo. Write to support@joinblink.me; we answer within 30 days, or sooner where the law where you live sets a shorter time, and we act on intimate images within 48 hours, and usually sooner (see Report). If the law where you live gives you other rights, we answer your request under that law.
You can also complain to the data protection authority where you live — for example your national authority in the EEA, the ICO in the UK, the FDPIC in Switzerland, the CNDP in Morocco, the Data Protection Commission in Ghana, the NDPC in Nigeria, the ODPC in Kenya, the Information Regulator in South Africa, the ANPD in Brazil, the Office of the Privacy Commissioner in Canada (or the Commission d’accès à l’information in Quebec), the OAIC in Australia, the Data Protection Board in India, the KVKK Authority in Türkiye, SDAIA in Saudi Arabia, and the UAE Data Office.
If you’re in India, our grievance officer for the Information Technology Rules 2021 and the Digital Personal Data Protection Act 2023 can be reached at support@joinblink.me. We acknowledge a complaint within 24 hours and resolve it within 15 days, or within 72 hours if you are asking us to remove something, and we act within 24 hours on a complaint about an image that shows someone’s private areas, nudity or a sexual act, or that impersonates them.
Blink is for people aged 13 and over. Where the law where you live sets a higher age, up to 16, for agreeing to uses of your information that rely on consent, you must be that age to turn on the Registry or arrival check-in. This applies in some countries of the EEA. Children under 13 may not use Blink. The age rule covers guests as well as hosts: a guest agrees to it by joining an event.
We don't knowingly collect information from anyone under 13. If we learn that someone under 13 has used Blink, we delete their account or guest pass and the information they gave us.
If you believe a child's photo or information is on Blink, report it at joinblink.me/report and we will remove it.
Chariot Archive, Inc., 195 East Main Street, Columbus, Ohio 43215, USA. Email support@joinblink.me for anything on this page.
When this notice changes materially, we change the version date and tell hosts, and guests who gave us an address, by email at least 14 days before the change applies to them. If we ever intend to do something this page says we don't do, we will say so here first, in plain words, before doing it.