Privacy Policy

Version 2026-11-03 · Effective November 3, 2026 · Earlier versions: 2026-10-20.2 and 2026-10-20

This policy explains what personal information Craft Collective LLC, doing business as Boundary Layer Labs (“we”, “us”), collects through BLOM and this website, how we use it, and who we share it with. BLOM is in beta, and this policy describes the beta as it runs today.

1. What we collect
2. How we use it
3. Signing in with Google or GitHub
4. Who we share it with
5. Cookies and Do Not Track
6. How long we keep it
7. Your choices
8. Security
9. Children
10. Where we process it
11. Changes

1. What we collect

When you sign in

You sign in with GitHub or Google. They send us your email address, name, and profile picture, and your account ID with them; GitHub also sends your username. Our sign-in service keeps a log of each sign-in, with the time, your IP address, and your browser.

Your phone number

Before you create an organization or hold its Administrator role, BLOM asks for a phone number that can receive texts, a mobile, landline, or fixed VoIP number, and texts it a code. We keep the number, and whether and when it was checked. BLOM shows the number only to you. Others in your organization, and our staff, see at most whether it's verified.

What you and your organization put into BLOM

Your profile and memberships, and your organization's records: its products, items, standards, process and its versions, tasks, briefs, next actions, claims, approvals, designs, webhook endpoints, and agents, each agent with its accountable owner. BLOM keeps a history of every change, with who made it, when, and why. Agent credentials and sign-in sessions are stored only as one-way hashes.

People you invite

When an Administrator invites someone, BLOM keeps the name and email address they enter, with the role offered, who sent the invitation, and when. BLOM sends no invitation email: the Administrator shares the invitation's link. The organization's Administrators see its invitations.

Help requests and feedback

When you send feedback or ask for support from BLOM's Help menu, we keep what you send, with your name and email address, the organization you sent it from, the page you sent feedback from, and the replies. An agent connected to your organization can send feedback for its person, which we keep the same way. Our staff read your requests and answer them in BLOM.

Technical information

When you use BLOM, our hosting provider logs each request: the address requested, which can include your organization's ID, your IP address, your browser, and the time. BLOM's own logs record what kind of request it was and how it ended, never your content.

What we don't collect

BLOM uses no analytics, advertising, or tracking tools, and it takes no payments.

2. How we use it

• To run BLOM: sign you in, check your phone number, show you and your organization's members what each is allowed to see, and keep the history.
• To answer your Help requests and feedback, and to support your organization.
• To keep BLOM and the people using it secure, prevent misuse, and fix problems.
• To contact you about BLOM, your account, or these policies.
• To follow the law and protect our rights.

We don't sell your personal information, share it for advertising, or use it to train AI models.

3. Signing in with Google or GitHub

BLOM asks Google or GitHub only for your basic profile: your email address, name, picture, and account ID, and on GitHub your username. We use it only to sign you in and to show who you are to the members of your organizations. We store it with your BLOM account, in the United States. We don't sell it, use it for advertising, or use it to train AI models, and we share it only with the services below that run BLOM. You can remove BLOM's access in your Google or GitHub account settings, though you then can't sign in to BLOM with that account. Removing that access doesn't delete your BLOM account or anything in it.

4. Who we share it with

• Services that run BLOM, each only for its own job:
  • Supabase, which hosts our database and our sign-in service, in the United States (AWS, Virginia);
  • Amazon Web Services (AWS), which keeps locked backup copies of our database in an account of our own, apart from Supabase and Vercel, in the United States (Ohio);
  • Vercel, which runs BLOM's servers near Washington, D.C., and delivers its pages through a worldwide network;
  • Twilio, which texts your phone code and checks what kind of line a number is, in the United States.
• Our staff. Boundary Layer Labs' staff run BLOM and answer Help requests. Across BLOM they see account facts only: each organization's name, its members' names, email addresses, roles, and status, when each joined and last used BLOM, whether each verified a phone number, and counts of records and use. They keep their own notes on the organizations they support, such as whom to contact there. To help an organization, a staff member can open support access to it: read-only, one organization at a time, for a stated reason and for at most 12 hours. They then see that organization's records as a Viewer would, and BLOM logs every read.
• Other providers that help us build, run, and support BLOM, under duties to keep the information safe and use it only for that work.
• Your organization. Members see what their roles allow, such as names, tasks, and the history of who did what.
• Tools your organization connects. AI tools such as Claude Code or Codex get only what your organization's agent credentials let them read, under your organization's own accounts with them. BLOM sends them nothing on its own. Webhook endpoints your organization's Administrators set up receive notices of its events, with identifiers only, never names or content.
• When the law requires it, or to protect the rights and safety of people and of BLOM.
• In a business transfer, such as a merger or sale, under the same protections.

5. Cookies and Do Not Track

BLOM sets two cookies, both needed to sign you in:

• __Host-blom-session keeps you signed in, for up to 30 days.
• __Host-blom-flow holds a sign-in that's in progress, for 5 minutes.

This website sets no cookies. Neither BLOM nor this website uses analytics or advertising cookies, so there's nothing to opt out of.

Do Not Track. BLOM doesn't track you across other websites, and it lets no one else do so. It works the same whether or not your browser sends a Do Not Track signal.

6. How long we keep it

• During the beta, we keep your account, your organization's records, and your Help requests, and we don't delete them on a schedule. The one exception is a webhook's delivery history, which we delete after 30 days.
• Our database provider keeps a daily backup for about 7 days. We also copy the whole database every hour, our sign-in service's records of your account included, to our locked copies at AWS. We keep each hourly copy about 5 days and each day's first copy about 40 days, so a copy can hold your information for up to about 45 days. No one can delete a copy before then, not even us, so something deleted from BLOM stays in the copies until they expire.
• Our providers keep their own logs and records, such as request logs and text-message records, for the periods their services set.
• The history of who changed or approved what stays with your organization's records, after you leave the organization too.

When the beta ends, we'll update this policy to say how long we keep information after it.

7. Your choices

• To ask what personal information we hold about you, or to ask us to correct it, email service@boundarylayerlabs.com.
• If a privacy law gives you rights over your information, we'll respond as that law requires.
• We handle your organization's records on its behalf, to run BLOM for it, and its Administrators manage them and your membership. Questions about an organization's records go to them first.
• We decide ourselves how we handle your account, sign-in, and security information, as this policy describes.
• You can leave an organization from Your profile, and an Administrator can remove you from it. Its records of what you did there keep your name.
• You can stop using BLOM at any time, and remove BLOM's access in your Google or GitHub account.

8. Security

We protect information with measures suited to an early beta: encrypted connections, sign-in through GitHub or Google, each organization's records kept apart from every other's, credentials stored only as hashes, and backup copies locked in an account of their own. Our staff's access to an organization's records is read-only, limited in time, and logged. No system is perfectly secure, and the beta's limits are listed in our Terms of Service.

9. Children

BLOM is for people 18 and older. It isn't meant for children, and we don't knowingly collect their information. If you think a child has given us information, email us.

10. Where we process it

Our database, its backup copies, and our servers are in the United States. Requests travel through Vercel's worldwide network, so they may be handled outside the United States on the way, and our providers may support their services from other countries.

11. Changes

We'll post any update here, with a new version and date. If a change matters, we'll tell you in BLOM and, where needed, ask you to agree again.

Contact

Craft Collective LLC, doing business as Boundary Layer Labs · service@boundarylayerlabs.com