What we do with your night
The whole product is other people's faces, so this page is the one that has to be honest. Here's exactly what happens.
These are commitments about how Blink is built today, not aspirations:
If you're a guest:the display name you type, the photos and videos you take, when you took them, and — only if you choose to give it — an email address so we can send you the night when it's revealed. We record the fact that you agreed to these documents, with the time, your IP address and your browser's user agent, as evidence of that consent. That's it. No account, no password, no phone number, no contacts, no location unless the host turned on arrival check-in and you allowed it.
If you're a host: your email address, the events you create and their settings, and — if the event is paid — a payment record held by Stripe. We never see your card number.
Either way: basic technical logs (IP address, browser type, error reports) that any website receives, used to keep the service running and to stop abuse.
During the event, nobody— not the other guests, not the host, not us browsing for fun. Photos are hidden until the reveal time the host set. That's the entire point of the product.
After the reveal, the roll is visible to the people who joined that event, and to anyone the host shares the album link with. The reveal email goes to every person who joined and left an address.
Staff access is limited to what's needed to operate the service — debugging a broken upload, acting on a report. We don't browse galleries.
Photos: about a year after the event ends, then permanently deleted. A host can set a shorter window, not a longer one. We try to email everyone with photos at stake before a gallery comes down.
While Blink is in testing, treat that year as a ceiling rather than a guarantee. We are running an unfinished product and we do not take on an obligation to store or preserve anything — content can be deleted earlier, including if we end the test. Download the roll when it is revealed. See the terms for the full version of this.
If a host deletes an event: it disappears immediately, and there is a 30-day window in which it can be restored. After 30 days the photos and the files behind them are permanently removed.
Consent records: we keep the record that you agreed to these documents after the photos are gone, because it is the only evidence that we asked. It contains no photos.
Deleted means deleted from our storage. We cannot recall a copy someone else downloaded before the deletion.
We use a small number of service providers, each doing one job and none of them permitted to use your data for their own purposes:
We will also disclose information where the law requires it — a valid legal process — or where it is necessary to protect someone from harm.
Take my photo down. Anyone can ask, whether or not they were at the event and whether or not they took the photo: joinblink.me/report.
Delete my own photo. During an event you can delete a photo you took, from the camera screen.
Stop emailing me. Every email has an unsubscribe. You can also simply not give an address — the night still works.
The Registry. Cross-event recognition is off by default and only turns on if you tick the box yourself. You can turn it off from your session at any time.
Access or deletion of your data. Write to support@joinblink.meand we'll do it.
Blink is not directed at children under 13 and we don't knowingly collect their information. If you believe a child's photo or information is on Blink, report it at joinblink.me/report and we will remove it.
Blink is operated by Chariot Archive, Inc., a Delaware corporation, which is the data controller for the information described here. Reach us at support@joinblink.me.
When this notice changes materially we change the version date and ask you to agree again the next time you join or host a night. If we ever intend to do something this page says we don't do, we will say so here first, in plain words, before doing it.