Legal

Privacy Policy

Last updated: August 6, 2026

This policy explains what blogcms collects, why, and who else touches it. There are two groups of people to keep separate: customers (you, with an account) and readers (people visiting blogs published with blogcms).

1. What we collect from customers

  • Account details — your email, display name, and profile picture if your sign-in provider supplies one.
  • Your content — posts, pages, media, settings, and the subscriber emails your blog collects.
  • Billing details — plan, status, and invoice history. We never see or store your card number; payments are handled entirely by Stripe.
  • Product usage — such as how many AI posts and images you have generated this month, so we can apply plan allowances.
  • Referral source — if you arrived through a tracked link, we store the visitor identifier so we know which channel led to your signup.

2. Cookies

The blogcms dashboard sets a single session cookie to keep you signed in. That is the only cookie we set. We do not run advertising or cross-site tracking cookies.

3. Analytics on published blogs

Blogs published with blogcms include a small, cookieless analytics beacon. It is designed so no consent banner is needed:

  • It records the page viewed, the referring site, and coarse device, browser, and country information.
  • No cookies, no cross-site identifiers, no fingerprinting. Visitors are not tracked between sites or across sessions.
  • A visitor’s IP address is used momentarily to derive a country, then discarded — we do not store raw IP addresses from blog readers.
  • Blog owners can switch this off entirely in Settings → Advanced and use their own analytics instead.

If you publish a blog with blogcms, you are the controller of your readers’ data and we process it on your behalf.

4. AI features

When you use the AI helper, slug suggestions, or image generation, we send the relevant inputs — your keyword, any context you type, the post’s title and text, and your blog’s name — to our AI providers so they can return a draft, suggestion, or image.

We do not use your content to train models, and our providers act as processors under their API terms. Research features may also perform web searches based on your keyword.

5. Who processes data for us

We keep the list short and use established providers:

  • Google Firebase — authentication and sign-in.
  • MongoDB — the primary database.
  • DigitalOcean — application hosting, blog hosting, and media storage.
  • Stripe — payments and subscription billing.
  • Amazon SES — transactional email.
  • Anthropic and Google — AI text and image generation.
  • MaxMind — offline IP-to-country lookup for analytics.
  • Google Search Console — only if you connect it, and only with read-only access to your own search data. You can disconnect at any time, which revokes our access.

6. How long we keep things

Account and content data is kept while your account is open. When you delete a blog or your account we remove it from active systems; residual copies may remain in encrypted backups for a short period before rotating out. Aggregated analytics counts may be retained without identifying anyone.

7. Your rights

You can access, correct, export, or delete your data at any time — most of it directly from the dashboard or the API. Depending on where you live, you may also have rights to restrict or object to processing, or to lodge a complaint with your data protection authority. Contact us and we will help.

8. Security

Traffic is encrypted in transit with TLS. API keys are stored hashed, never in plain text, and shown only once at creation. Access to production systems is limited to people who need it. No system is perfectly secure, but we take this seriously and will notify you promptly about any breach affecting your data.

9. International transfers

Our providers operate globally, so your data may be processed outside your country, including in the United States. We rely on those providers’ standard contractual protections for such transfers.

10. Children

blogcms is not intended for people under 16, and we do not knowingly collect their data.

11. Changes

We will update this page when our practices change, and revise the date above. Material changes will be announced by email or in the dashboard.

12. Contact

Questions, or want your data removed? Use the contact page and we will respond promptly.