Privacy Policy

Blogee ("we", "us") runs a hosted blogging platform at blogee.tech. This policy explains what personal data we handle, why, and what choices you have. It covers the marketing site, the admin dashboard at app.blogee.tech, and the blogs and embeddable widgets we host for our customers.

We act in two roles. For the people who run a blog (account holders) we decide how their data is used. For the readers, subscribers and commenters of a blog, the blog owner decides what is collected, and we process that data on the owner's behalf to run the service.

Depending on how you use Blogee, we collect the following.

• Account holders: name, email address and password (stored only as a hash), plus the time you verified your email and your sign-in sessions.
• Blog content you create: posts, translations, images, branding, menus, widget settings and the other settings of your blog.
• Commenters: when a reader signs in with Google to reply to a post, we receive and store their name, email address, profile picture and Google account identifier, together with the reply they write.
• Newsletter subscribers: email address, language, subscription status and a record of consent (when, where and how they subscribed).
• Reader analytics, when the blog owner turns them on: described in the next section.
• Security and anti-abuse data: IP addresses and email addresses are used as keys to limit sign-in, sign-up, password reset, reply and subscription attempts. The IP address recorded to limit replies is stored with a counter.
• AI usage records: which feature ran, with which provider and model, and when. They never contain prompts or content.
• Messages you send us, such as emails to support.

If a blog owner enables analytics, we measure reading of that blog without cookies and without storing IP addresses or raw user agents.

• Each visit gets a visitor code: a one-way hash of the IP address, the browser's user agent and the blog, mixed with a secret that changes every day. The same person cannot be recognized from one day to the next.
• We store the country and region (from the hosting provider's location headers), the referring site, campaign tags, device, browser and operating system type, the page language, active reading time and scroll depth.
• Visits that send a Do Not Track or Global Privacy Control signal are not counted.
• Page-level records are kept for 90 days, visitor-day records for 3 days, and daily totals without personal data are kept longer. The blog owner can switch analytics off and delete all analytics data at any time.

• To host and run your blog, serve your content to readers and keep the service secure.
• To send account emails, such as email verification and password reset.
• To send newsletter confirmations and issues on behalf of blog owners who use that feature.
• To run the AI features and content imports that an owner chooses to use.
• To limit abuse, investigate problems and keep the service reliable.

We do not sell personal data and we do not use it for advertising.

AI features run only when the blog owner adds their own key from OpenAI, Google Gemini or DeepSeek, and only when a person or an agent connected to that blog asks for them. The data goes to the provider the owner selected, under the owner's account with that provider.

• SEO metadata: the post title and the first 2,000 characters of the text.
• Translation: the post title, content and meta fields.
• Image generation: the prompt that was written.
• Newsletter copy: the post title, an excerpt, the first 4,000 characters of the text, the language and the blog name. Replies and subscriber data are never included.

Provider keys are stored encrypted. The providers handle the data under their own terms and privacy policies.

We use these providers to run Blogee. They process data only to provide their service to us.

• Vercel: hosting.
• Amazon Web Services (S3, United States): storage of uploaded and generated images. Images are publicly readable by their web address, because they are shown on public blogs.
• Resend and SendGrid: email delivery. SendGrid sends newsletters, with open and click tracking turned off, and sends account emails when Resend is not available.
• Google: sign-in for commenters and subscribers, and fonts for Chinese, Japanese and Korean text on generated social images.
• OpenAI, Google Gemini and DeepSeek: AI features, only as described above.
• GitHub and public feed hosts: when an owner connects a release feed or RSS feed, we fetch that public address.

We do not use advertising, tracking or social-media scripts. A blog owner can choose a custom stylesheet for a widget, which loads from the address they pick.

We set no advertising or cross-site tracking cookies. The cookies and storage we use are:

• blogee_session: keeps an account holder signed in. HttpOnly, lasts 1 day, or 30 days if you choose to stay signed in.
• blogee_visitor_identity: remembers a commenter or subscriber who signed in with Google on a blog. HttpOnly, lasts 30 days.
• blogee_oauth_session: a short-lived cookie (a few minutes) used during the Google sign-in.
• blogee_ui_locale and blogee_blog_locale: remember your language. They last 1 year.
• blogee_sidebar: remembers whether the dashboard sidebar is collapsed. It lasts 1 year.
• Local storage: keys starting with blogee: remember that a reader already subscribed, so the subscribe prompt is hidden; blogee_ignore is set only if a blog owner chooses to exclude their own visits from analytics.

• Every blog's data is separated: queries are scoped to the blog, and the database enforces row-level security on the blog's tables.
• Passwords are stored as hashes. AI provider keys are stored encrypted. API keys for agents are stored only as a hash and are shown once when created.
• Connections use HTTPS, and sign-in cookies are HttpOnly.
• Requests are rate limited. No system is perfectly secure, so we cannot guarantee absolute security.

• Account and blog data is kept while your account is active.
• When a post is deleted it is removed immediately, together with its replies, translations and analytics.
• A reply removed by moderation is hidden from the blog. The stored record can remain until its post is deleted or you ask us to erase it.
• Newsletter subscribers can be erased by the blog owner: the email address is removed and only a one-way hash is kept so that the address is not added again.
• AI usage records are kept for 13 months. Raw feed items imported by a content connection are deleted after 30 days.
• Sign-in and sign-up attempt records are short-lived. The IP address kept to limit replies stays until we clear it, and you can ask us to erase it.
• Records of administrative actions are kept so we can audit them.

You can do these things yourself:

• Edit or delete your content in the dashboard and update your settings.
• Get your content out through the RSS feed of each language, a CSV of your newsletter subscribers and a CSV of your analytics.
• Erase newsletter subscribers, delete all analytics data, remove AI provider keys, revoke API keys and sign out everywhere.
• Unsubscribe from any newsletter using the link in every email.

Deleting your whole account or blog, and receiving a complete copy of your data, are handled by request: email us and we will confirm your identity, answer within 48 hours and complete the deletion within 30 days.

Depending on where you live (for example under the GDPR, the LGPD or California law) you may have the right to access, correct, delete, restrict or object to the use of your data, to data portability, to withdraw consent, and to complain to your data protection authority. If you are a reader, subscriber or commenter, contact the blog owner first; you can also write to us.

Our providers operate in several countries. Our file storage is in the United States, so your data can be processed outside the country where you live. We rely on our providers' safeguards for these transfers.

Blogee is not intended for children under 13, and we do not knowingly collect personal data from them. If you believe a child has given us data, contact us and we will remove it.

We may update this policy. We change the date at the top, and we email account holders about material changes before they apply.

For questions or requests about this policy or your data, email us at hello@blogee.tech. We reply within 48 hours.