Privacy notice

Blurbed is operated by Mathew Clayton, based in the United Kingdom. For the purposes of UK data protection law, Mathew Clayton is the data controller of the personal data described in this notice.

You can contact us about anything on this page — including to exercise your rights — at mathewclayton@gmail.com.

Depending on how you use Blurbed, we may hold:

• Account data: email address, hashed password, and role.
• Profile data: pen name, real name, bio, location, social links, optional avatar.
• Manuscript data: the book files, cover images and metadata you upload.
• Endorsements you write on other authors' books.
• Activity logs: which manuscripts you download or read in-browser, with timestamps.
• Technical data: IP address and basic device information collected by our hosting provider for security and abuse prevention.
• Communications you send us by email.

We only process personal data where we have a lawful basis to do so:

• Providing the service (running your account, storing your manuscripts, generating signed download links, showing your profile and books to other signed-in authors) — lawful basis: performance of a contract with you.
• Keeping the platform safe (logging downloads, detecting abuse, enforcing our terms) — lawful basis: legitimate interests in protecting the authors who share their manuscripts with us.
• Essential cookies (keeping you signed in, remembering your cookie choice) — lawful basis: strictly necessary for the service you asked for.
• Non-essential cookies or analytics, if we introduce them — lawful basis: your consent, which you can withdraw at any time.
• Responding to your messages — lawful basis: legitimate interests in providing support.
• Complying with legal obligations (e.g. responding to lawful requests from authorities) — lawful basis: legal obligation.

Manuscripts you upload are stored in a private bucket and are never publicly accessible. When a signed-in author opens or downloads your manuscript we generate a short-lived signed URL (valid for ten minutes) that grants temporary access to that file only.

You can archive or delete your books from your dashboard at any time. Deleting a book removes its metadata and the underlying file from our storage.

We do not sell your personal data. We share it only with the service providers we rely on to run Blurbed, all of whom act as our processors:

• Lovable Cloud (Supabase) — application hosting, database, authentication and file storage.
• Google — only if you choose to sign in with your Google account (OAuth).
• Our domain and DNS provider — to serve the site at blurbed.net.

We may also disclose personal data where we are required to do so by law, or to establish, exercise or defend legal claims.

Some of our processors may store or process your data outside the UK. Where they do, we rely on appropriate safeguards recognised under UK data protection law — such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses — to protect your data to a standard equivalent to UK GDPR.

• Account, profile and manuscripts: for as long as your account is active. Deleted on request or when you delete your account.
• Download and access logs: up to 24 months, then deleted.
• Emails to us: up to 24 months, unless a longer retention is required to resolve an issue.
• Backups: rotated on our provider's schedule (typically up to 30 days) and then overwritten.

Access to database rows is enforced by row-level security policies. Manuscripts are stored in a private bucket and delivered via short-lived signed URLs. Passwords are hashed by our authentication provider and are never visible to us. All traffic is encrypted in transit with TLS.

Under UK GDPR you have the right to:

• be informed about how we use your personal data (this notice);
• access a copy of the personal data we hold about you;
• have inaccurate personal data corrected;
• have your personal data erased ("right to be forgotten");
• restrict or object to our processing of your data;
• data portability (receive a copy in a machine-readable format);
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with the UK Information Commissioner's Office (ICO).

You can exercise most of these rights directly from your dashboard — you can edit your profile, archive or delete your books, export your data, and delete your account. For anything else, email mathewclayton@gmail.com.

You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. We would appreciate the chance to address your concerns before you approach the ICO.

We use a small number of strictly necessary cookies and browser storage items to run the site. See our Cookie policy for the full list and how to change your preferences.

Blurbed is intended for published or soon-to-be-published authors and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this notice from time to time. When we make material changes we will update the date below and, where appropriate, notify you by email or in the app.