Legal
Privacy policy
Last updated November 13, 2026
This policy explains what personal information BlueBot collects, why, who handles it for us and how long we keep it. We keep the words of your texts for 30 days and then delete them, we never put them in logs, analytics or error reports, and we don’t sell your information or use it for advertising.
1. Who we are
BlueBot is run by [Company name] LLC (“BlueBot,” “we” or “us”), [Mailing address]. We are responsible for the personal information this policy describes. For any question or request about privacy, write to privacy@usebluebot.com.
This policy covers our website, the dashboard, the BlueBot app for Mac, the API, webhooks, the MCP server and our support. It goes with our terms of service.
2. Two kinds of information
We handle personal information in two different roles.
- About you, our customer. Your account, your billing, your Mac and how you use BlueBot. We decide how this is used, and most of this policy is about it.
- About the people you text. Their phone numbers and email addresses, the names you give them, and the words and files in your conversations with them. We handle this on your behalf and on your instructions, to run the service for you. You decide whom to text and which conversations your Mac copies to BlueBot. Section 9 says more.
3. What we collect
Your account
Your email address, your time zone and your settings. You sign in with a link we email you or with a password. If you set a password, our sign-in provider keeps only a hash of it.
Billing
Stripe collects your card details and billing address when you start a trial. We receive facts about your subscription from Stripe and keep them: your Stripe customer and subscription numbers, the plan’s state (in a trial, active, past due or canceled), amounts and dates. We never see or store your full card number.
Your Mac
Each time the BlueBot app checks in, it reports the Mac’s name, its macOS version, the app’s version, the phone number Messages is signed in with, the results of its setup checks (whether Messages is signed in, whether the app has Full Disk Access, whether Text Message Forwarding is on, whether the Mac stays awake and whether FileVault is on) and whether you turned on voice memo transcription.
Your texts
For every text sent through BlueBot or copied from your Mac, we keep its facts: who it was to or from, when, its state, whether it went by iMessage or as a regular text, and what sent it (the API, Zapier, a broadcast and so on). The facts stay for the life of your account so your counts, limits and history are right.
We keep the words of each text, the files on it (pictures, voice memos, documents) and voice memo transcripts for 30 days from when it was sent or received, and then delete them. A text still waiting to go keeps its words until it goes. The same goes for every other copy of words to or from a person: a broadcast’s words and the values its list gave each person (30 days after the broadcast finished), the values given to a sequence for one person (30 days after their run ended), Autopilot’s suggestions and replies, and what a visitor typed into your website widget. We delete once a day, so each goes in the first daily clean-up after its 30th day.
Which conversations your Mac copies to BlueBot is your setting:
- Replies (the default): conversations with people you’ve texted through BlueBot, and group chats in which everyone else is such a person.
- Everything: every conversation in Messages with a phone number or an email address, group chats included.
A copied conversation includes the texts you typed by hand on your Mac or iPhone, not only the ones BlueBot sent, along with the tapbacks, edits and unsends Messages records in it. Conversations with short codes and businesses are never copied. When you first connect a Mac, it also copies those conversations from the 7 days before.
Voice memo transcription is off until you turn it on. When it’s on, your Mac turns voice memos into words with Apple’s speech recognition on the Mac itself, and the transcript comes to BlueBot with the memo.
Contacts and what you build
The contacts BlueBot makes from your texts or that you import (a phone number or email address, and the names, tags and fields you add), your stop list, templates, broadcasts, sequences, keyword rules, Autopilot’s instructions and FAQ, Text Hooks, your website widget, and your notification settings. For each Text Hook we keep the names of the fields in its last 20 posts, never their values, so you can map them; none is kept more than 30 days.
The API, webhooks and connected apps
We keep only hashes of your API keys. For each API request, we log the route, the response’s status and how long it took, never the full address, the query or the body. We keep the events we send to your webhooks and a record of each delivery: its status, how long it took and the first 2 KB of what your server answered, so you can see why a delivery failed. We keep hashes of the tokens that apps you connect through our MCP server use.
AI features
Your conversations with the integration assistant, and a count of each AI request (its size and cost, without its words) so we can keep to daily limits. Section 5 says what goes to Anthropic.
Support
The emails you send to support@usebluebot.com or through the dashboard’s contact form, our replies, and the notes our support agent keeps on how it decided. These have no 30-day limit, because an answer often depends on an earlier one; anything you paste into a support email is kept with it.
Emails we send you
For each email or Slack message we send you, such as a new-text notification or the daily digest, we keep who it went to, when, what kind it was and its subject, which can name the person who texted you. We don’t keep its body, which can carry the words of a text.
How you use BlueBot
We use PostHog to see which pages and features are used and to catch errors. What goes to PostHog never includes phone numbers, email addresses or the words of texts, and error reports have the words removed before they are sent.
Cookies
We use cookies to keep you signed in, to remember where to send you after you sign in, to keep the Mac app’s window signed in, and, through PostHog, to count visits and sessions. We use no advertising cookies and no third-party ad trackers.
Records our providers keep
Like any website, our hosting and sign-in providers record the IP address and browser of the requests they handle, to keep the service secure and working.
4. How we use it
- To run the service: send and read your texts, show your inbox, run your automations and deliver your webhooks.
- To bill you and to answer your support requests.
- To keep BlueBot secure and enforce the acceptable use policy, for example by watching the share of people who reply with a stop word.
- To email you about your account: sign-in links, your Mac going offline, a webhook that stopped working, reaching the daily limit, changes to these policies and the notice that your account is being deleted.
- To understand which parts of BlueBot are used, so we can make it better.
- To follow the law.
We don’t sell personal information. We don’t share it for cross-context behavioral advertising, we don’t use it for advertising of any kind, and we don’t train AI models on your texts.
Our admin tools show staff a text’s facts and never its words, and every staff action on an account is recorded with who did it and why.
5. AI features and Anthropic
Our AI features use Anthropic’s API. Words go to Anthropic only when a feature is used:
- The integration assistant: what you type to it, and the parts of your setup it reads to answer you, such as your Mac’s state, your webhook and Text Hook settings, and your API keys’ names (never the keys themselves).
- Autopilot: only if you turn it on. The incoming texts it answers, and your instructions and FAQ.
- The support agent: emails sent to support@usebluebot.com, and facts about the sender’s account (plan, Mac state, recent failures and webhook health), never the words of their texts. Our support inbox is answered first by this AI agent. It hands a conversation to a person when it should, and it says it is an AI when asked.
Your integration assistant conversations are kept 30 days, like the words of texts.
6. Who handles it for us
These companies process personal information for us, only to provide their service to BlueBot:
| Company | What it does for us | What it receives |
|---|---|---|
| Stripe | Payments, invoices, sales tax and the billing portal | Your card details, billing address, email address and payment history |
| Supabase | Our database, sign-in and file storage | Everything BlueBot keeps |
| Vercel | Hosts the website, the dashboard and the API | Every request as it passes through, and request logs |
| Resend | Sends and receives our email | Your email address, the emails we send you, and emails sent to our support |
| Anthropic | The AI features | What section 5 lists |
| PostHog | Product analytics and error reports | Which pages and features are used, and errors, without phone numbers, email addresses or words |
[Owner: before launch, sign each company’s data processing terms with BlueBot’s own accounts, choose US regions where they’re offered, and confirm that each keeps data as this section says.]
Apps you connect. When you connect Zapier, Make, n8n, Pipedream, Slack, an AI assistant through our MCP server, or your own webhook endpoint, we send it what you set it up to receive, which can include the words of texts. Its own privacy policy then applies.
Apple and carriers. Your texts travel through Messages on your Mac, Apple’s iMessage service and your carrier. Our servers don’t send texts to Apple; your Mac does, from your own Apple Account.
Other disclosures. We disclose personal information when the law requires it, for example in answer to a valid subpoena or court order, and when it’s needed to protect someone’s safety or our rights. If BlueBot is sold or merged, your information goes to the new owner under this policy, and we’ll tell you before it does.
7. How long we keep it
| What | How long |
|---|---|
| The words of texts, their files and voice memo transcripts | 30 days |
| A broadcast’s words, and the values its list gave each person | 30 days after it finished. A draft keeps its words until you delete it. |
| The values given to a sequence for one person | 30 days after their run ended |
| Autopilot’s suggestions and replies, and what visitors type into your website widget | 30 days |
| Integration assistant conversations | 30 days from each message |
| The facts of each text: who, when, its state, its service and what sent it | The life of your account |
| Contacts and the stop list | The life of your account. A contact you delete is hidden, but its number stays with the facts of its texts. |
| Settings, templates, sequence steps, broadcast drafts, rules, Text Hooks and the rest of what you build | Until you delete them or your account |
| Events and webhook deliveries | 30 days |
| The API request log | 30 days |
| What a Text Hook received | The field names of the last 20 posts to each hook, never their values, and none older than 30 days |
| Emails and Slack messages we send you | Who, when, what kind and the subject, for the life of your account. Never the body. |
| Support emails, our replies and our support agent’s notes | No set end, since an answer often depends on an earlier one. They stay after your account is deleted, as below. |
| A file you upload and never send | A day |
| A data export | Its download link lasts a week |
| Your account and everything in it, after you delete it | Deleted within 30 days |
A few records stay after your account is deleted, no longer linked to it: billing records, the record of staff actions on your account, the facts of emails we sent you or received from you, and support emails. Stripe also keeps its own payment records under its own policy. [Owner and lawyer: set how long each of these is kept, since today they have no end date, and state how long the database provider’s backups keep deleted data.]
8. Your choices and rights
- See and export your data. The account page in the dashboard makes a file of your data and gives you a link to download it.
- Correct it. Change your details and settings in the dashboard, or write to us.
- Delete it. Delete your account from the account page, and everything in it is deleted within 30 days, except as section 7 says.
- Choose what reaches us. Choose which conversations your Mac copies, and turn Autopilot and voice memo transcription on or off.
Residents of California and several other states, including Colorado, Connecticut, Oregon, Texas, Utah and Virginia, have rights under state privacy laws: to know what personal information a business has about them and get a copy, to correct it, to have it deleted, to opt out of its sale, its sharing for targeted advertising and certain profiling, to limit the use of sensitive information, and not to be treated differently for using these rights. We give these rights to everyone, whether or not a law requires it of a company our size. We don’t sell or share personal information, we don’t use it for targeted advertising or profiling, and we use sensitive information only to run the service.
To make a request, write to privacy@usebluebot.com from the email address on your account, so we know it’s you. Someone you authorize in writing can make a request for you. We answer within 45 days. If we turn down a request, you can appeal by replying to our answer, and if we turn down the appeal, you can contact your state’s attorney general.
9. The people you text
When you text people through BlueBot, we handle their phone numbers, email addresses, the names you give them and the words of your conversations on your behalf, only to run the service for you. You’re responsible for having their consent and for telling them about your use of their information as the law requires.
A person who replies STOP, STOPALL, UNSUBSCRIBE, CANCEL, END or QUIT is put on your stop list automatically, and BlueBot won’t send them another text from your account. The words of your conversations with them are deleted after 30 days, and everything about them is deleted with your account.
If someone you text asks us about their information, we’ll pass the request to you, since you decide what happens to it, and help you answer it.
Visitors who send a question through your website widget give their name, number and question, which become a contact and a text from your number. To stop spam, we keep a hash of the visitor’s IP address, not the address itself.
10. Children
BlueBot is for adults. You must be 18 or older to have an account. BlueBot isn’t directed at children under 13, and we don’t knowingly collect their personal information. If we learn that we have, we’ll delete it.
11. Security
We encrypt every connection with TLS, keep only hashes of keys and tokens, keep each account’s data apart from every other’s, and show staff the facts of texts, never their words. Our security page says more. No system is perfectly secure. If a breach affects your personal information, we’ll tell you as the law requires.
12. Where your information is kept
BlueBot is offered only in the United States, and we process and keep personal information in the United States.
13. Changes to this policy
We’ll change the date at the top of this page whenever we change this policy. When a change matters, we’ll email you at least 30 days before it takes effect.
14. Contact
[Company name] LLC
[Mailing address]
Privacy: privacy@usebluebot.com