Privacy Policy

BloggyBox (“we”, “us”) is a publishing workspace for software builders, operated by PPUSSH. This policy explains what data we collect and why. Questions go to our cookie preferences for control over local storage, or contact us through the workspace.

We authenticate through PPUSSH OAuth — BloggyBox never sees your password. When you sign in, PPUSSH shares your email address, display name, and profile picture URL with us. We store exactly that, and use it solely to identify your account, show authorship on your content, and operate your workspace.

How PPUSSH itself handles your data is governed by their own policies, which you accept when you create your PPUSSH account: PPUSSH Privacy Policy and PPUSSH Terms of Service. If you delete your PPUSSH account or revoke BloggyBox's access there, you will no longer be able to sign in here.

Everything you create in BloggyBox belongs to you:

• Publications, articles, and drafts — including titles, markdown, excerpts, tags, and banner images.
• API keys and MCP credentials — stored hashed; only you ever see the full key, once, at creation time.
• Newsletter subscribers — email addresses collected through your publication forms, used only to deliver your newsletter.
• Publication settings — names, bios, social links, domains, branding, and notification preferences.

Agent-drafted content arrives through the Model Context Protocol as ordinary drafts. Your coding agent runs on your machine — only the draft it sends (title, markdown, excerpt, tags) reaches our servers.

We use a minimal set of first-party storage, nothing third-party:

• access_token / refresh_token — HttpOnly cookies that keep you signed in. The refresh token rotates automatically and is scoped to authentication endpoints only.
• Theme preference— stored in your browser's localStorage so the site remembers light or dark mode.
• Ephemeral flags — short-lived localStorage entries used during login (popup handshake) and cross-tab session coordination. They contain no personal data.

Manage preferences anytime on the Cookie Preferences page.

• No third-party analytics. No trackers, pixels, or fingerprinting scripts run on BloggyBox.
• No advertising. We do not serve ads and do not share data with ad networks.
• No data sale. Your identity, content, and subscriber lists are never sold, rented, or shared except as described here.

We disclose data only when required: to operate the service (hosting infrastructure), to comply with applicable law, or to protect rights and safety. We will never sell personal data. Subprocessors are listed on the Security page.

We keep your data only as long as your account is active and as needed to operate the service:

• Workspace content (publications, articles, drafts, settings) persists until you delete it. Deleting a publication removes its articles, drafts, API keys, and subscriber lists.
• API keys stop working the moment you revoke them; revoked key records are retained briefly for security auditing, then purged.
• Session tokens expire automatically — access tokens in 15 minutes, refresh tokens on a rolling 30-day window. Logging out invalidates them immediately.
• Account deletion removes your identity record and, on request, all workspace content. Backups rotate out on a rolling basis.

You are in control of your data, and can at any time:

• Access and export — view everything in your workspace; published articles are additionally available any time through the public reader API and feeds.
• Correct — edit your profile, bio, publication settings, and any draft or article directly in the workspace.
• Delete — remove individual articles, subscribers, API keys, publications, or your entire account as described above.
• Object and withdraw consent — newsletter subscribers can unsubscribe in one click from any dispatch; optional cookies can be switched off on the Cookie Preferences page.

To exercise a right that isn't self-serve, contact us through the workspace and we will respond within 30 days.

We protect your data with controls proportionate to a publishing platform:

• Authentication delegated to PPUSSH OAuth — no passwords stored by us, ever.
• Session cookies are HttpOnly (invisible to page scripts) and refresh tokens rotate on every use with automatic reuse detection.
• API keys are stored hashed, shown once at creation, and scoped to the minimum capability needed (drafts, reading, or subscribing — never publishing or admin).
• All traffic is encrypted in transit (HTTPS); databases are not publicly exposed.

No system is perfectly secure. If you discover a vulnerability, please report it instead of exploiting it — see responsible disclosure.

BloggyBox is a professional tool for software builders and is not directed at children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect data from children; if we learn otherwise, we delete it promptly.

Data questions, requests, or complaints: contact us through the workspace or via PPUSSH support channels. For anything concerning PPUSSH authentication itself, their privacy policy applies.

Material changes will be reflected in the “Last updated” date above, and for significant changes we will announce them in-product before they take effect.