Privacy

Last updated: 27 August 2026 · Operated from Canada

BLIP is a music guessing game. It has no advertising and no third-party analytics or tracking. This page describes exactly what data exists and where it goes.

If you create an account

Accounts are optional. You can play everything except the ranked daily leaderboard without one. If you create one, this is stored:

• Your email address — used only to identify the account and sign you in. It is never shown to other players, never sold, and never used for marketing.
• Your display name — shown publicly on the daily leaderboard, so pick accordingly.
• Your password — stored only as a scrypt hash. It cannot be read back, by us or by anyone who obtained the database.
• Your daily results — the date, your score, how many you identified, and which clip you solved each round on.
• Playlists you import — the playlist name, the link you imported it from, and the matched track titles and artists. These are private to your account and are not shown to other players.

Signing in sets one cookie. It holds a random session token, is httpOnly (unreadable by JavaScript), and expires after 30 days. Only a hash of it is kept server-side, so a database leak would not hand over live sessions. There are no tracking or advertising cookies.

When you sign up, the email domain is checked for mail servers and compared against a list of disposable-inbox providers. That check is a DNS lookup made from this server; no third party is involved and no message is sent to you.

Deleting your account

You can delete your account yourself at any time: sign in, click your name in the top bar, then Delete account. This permanently removes your email, display name, password hash, daily results and saved playlists from the database. It is immediate and cannot be undone. If you would rather ask, email [email protected].

You can also ask for a copy of the personal information held about you, or ask for a correction, at the same address.

What is stored on your device

Everything the game remembers about you is kept in your browser's localStorage. It never leaves your device, and clearing your browser data deletes it permanently. That covers:

• Your settings (volume, round count, clip start mode).
• Your progress and result for the current day's Daily puzzle.
• Your best Gauntlet run.
• The nickname you last used in Versus.

What the server holds

Versus rooms — players, nicknames and scores — are held only in memory while a match is running, and are discarded when the room empties. They are never written to disk, and do not survive a restart.

Accounts, daily results and imported playlists are stored in a database file on the server (see above), alongside the anonymous daily counters described below. Nothing else about you is stored.

Your chosen nickname is visible to everyone else in that room. Do not use your real name if you would rather not share it.

Counting how many people play

BLIP keeps a small set of counters so it is possible to tell whether anyone is using the site at all — things like how many pages were loaded today, how many runs were started, and how many rounds were played. That is the whole of it.

These are totals per hour and per day. There is no session, no stored IP address, no cookie and no device fingerprint. Nobody outside this site ever sees them: there is no Google Analytics, no advertising network, no third-party script of any sort. The counters live in the same database as everything else, on the same server.

Counting people rather than page loads

One number needs a little more than a tally: unique visitors. Telling a returning visitor from a new one requires some way to recognise them, so this is the only place where anything is held per person. It is done in the way that keeps the least:

• Your IP address and browser user-agent string — both of which your browser sends with every request anyway — are combined with a secret key that is generated fresh each day and run through a one-way cryptographic function.
• Only a short fragment of the result is stored. Your IP address and user agent are discarded immediately and never written down.
• The daily key exists only in the server’s memory and is never saved to disk. When the day ends it is replaced and the old one is gone forever, so today’s marker cannot be connected to yesterday’s — not by us, and not by anyone who obtained a copy of the database.
• Once a day is over, its markers are counted and deleted. What survives is a single number: how many people visited that day.

The practical effect is that a marker is meaningless the moment the day turns over, cannot be reversed into an IP address, cannot follow you to any other website, and is gone within about a day regardless. Nothing is stored on your device for this, which is why BLIP has no cookie banner — there is nothing to consent to storing.

It is an approximation, and honestly so. Several people sharing one network can count as one visitor; the same person on a phone and a laptop counts as two; and if the server restarts partway through a day the key changes, so a returning visitor may be counted twice.

One more counter records which site a visitor arrived from — so that it is possible to tell whether posting a link somewhere brought anyone here. Only the sending site’s hostname is kept, such as reddit.com or twitch.tv, and everything else is discarded before it is stored: never the page, never the address you came from, never anything after the domain. Arrivals with no referring site are counted as “direct”, and searches are grouped together as “search”. As with the rest, this is a tally — two people arriving from the same site are one row with a 2 in it.

Because the counting happens on the server rather than in your browser, there is nothing to opt out of and nothing stored on your device for it.

Where your data is stored

BLIP is operated from Canada, but the server and its database run in the United States (Virginia), on infrastructure provided by Fly.io. Your account information is therefore stored outside Canada and may be accessible to US authorities under US law. If that is not acceptable to you, please do not create an account — every game mode except the ranked daily leaderboard works without one.

How long information is kept

Nothing is kept "just in case". These are the actual retention rules, and they are what the code does rather than an aspiration:

• Your account (email, display name, password hash) — kept until you delete it. There is no inactivity expiry, so an account you abandon stays until you remove it or ask us to.
• Daily results and saved playlists — kept for as long as the account exists, and deleted with it.
• Login sessions — expire 30 days after sign-in. Expired rows are purged automatically every hour, and signing out deletes the session immediately.
• Versus rooms — held in the server's memory only for the length of a match and discarded when the room empties. They are never written to disk and do not survive a restart.
• Server logs (including IP addresses) — short-lived and handled by our hosting provider, Fly.io, under their retention policy. BLIP does not archive, export or analyse them.
• Daily counters and referring-site counters — kept indefinitely. They are totals with nothing personal in them, so there is nothing in them to expire.
• Hourly counters — kept 30 days, then deleted. They exist to show recent activity, and the daily totals are the longer record.
• Unique-visitor markers — kept only until the day they belong to is over, then counted and deleted. In practice a marker exists for at most about a day. The key needed to make sense of one is discarded even sooner, and is never written to disk at all.
• Music lookup caches — held in memory for 8 minutes (preview links) and 24 hours (search results). These contain track information only, never anything about you.

If there is a data breach

BLIP is run by one person, so it is worth being straightforward about what would happen if the database were exposed.

What an attacker would get: email addresses, display names, daily scores and saved playlists. What they would not get: usable passwords or live sessions. Passwords are stored only as scrypt hashes and cannot be reversed into the original password, and session tokens are stored hashed, so the stored value cannot be replayed to sign in as you.

If a breach affecting personal information is discovered, we will:

• assess what was exposed and who is affected, and close the hole first;
• notify affected people by email as soon as feasible, describing what was taken and what to do about it;
• report the breach to the Office of the Privacy Commissioner of Canada where it creates a real risk of significant harm, as PIPEDA requires, and to other regulators where their law applies;
• keep a record of the breach for at least two years, as PIPEDA requires.

Because notification is by email, an account whose address no longer works cannot be warned. If you no longer use the address you signed up with, the safest step is to delete the account.

If you believe you have found a security problem, please report it to [email protected] before disclosing it publicly. Reports made in good faith are welcome and will not be pursued.

Your choices and rights

An account is optional. Where the law gives you rights over your personal information — including under Canada's PIPEDA, the EU/UK GDPR, and various US state privacy laws — you can exercise them by emailing [email protected]. That covers access, correction, deletion and withdrawing consent. Deletion is also self-serve, as described above.

BLIP is run by an individual as a non-commercial hobby project. It does not sell personal information, does not use it for advertising, and does no profiling or automated decision-making.

Logs

Like any web server, this one records requests — including IP addresses — for security and debugging. The app also reports client-side JavaScript errors (the error message, and which screen it happened on) so faults can be found and fixed. Error reports contain no personal data and no playlist contents. Logs are short-lived and are not used to build any profile of you.

Other services your browser contacts

• Deezer — album artwork and the 30-second preview clips are loaded directly from Deezer's servers, so they receive your IP address and the requests your browser makes for that media.
• Google Fonts — the site's typeface is served from fonts.googleapis.com and fonts.gstatic.com.

These services have their own privacy policies, which this site does not control.

Playlist imports

Importing requires an account. When you import a playlist by link, the URL is sent to this server, which fetches that public page and reads the track names from it. The resulting playlist — its name, the source link and the matched tracks — is saved to your account so it is there on any device you sign in on. Deleting a playlist removes it from the server, and deleting your account removes all of them.

Children

You must be at least 13 years old to create an account. This site is not directed at children under 13 and does not knowingly collect personal information from them. If you believe a child under 13 has created an account, email [email protected] and it will be deleted.

Contact

Questions, requests or complaints about privacy can be sent to [email protected].

If this policy changes, the date at the top of this page changes with it. If a change materially affects how your personal information is used, account holders will be told by email before it takes effect.

If you are in Canada and are not satisfied with the response, you can contact the Office of the Privacy Commissioner of Canada.