Privacy Policy

Version 2026-10-20.2 · Effective October 20, 2026

This is an earlier version, kept for the record. Read the current Privacy Policy.

This policy explains what personal information Craft Collective LLC, doing business as Boundary Layer Labs (“we”, “us”), collects through BLOM and this website, how we use it, and who we share it with. BLOM is in beta, and this policy describes the beta as it runs today.

What we collect
How we use it
Signing in with Google or GitHub
Who we share it with
Cookies and Do Not Track
How long we keep it
Your choices
Security
Children
Where we process it
Changes

1. What we collect

When you sign in

You sign in with GitHub or Google. They send us your email address, name, and profile picture, and your account ID with them; GitHub also sends your username. Our sign-in service keeps a log of each sign-in, with the time, your IP address, and your browser.

Your phone number

Before you create an organization, BLOM asks for a mobile number and texts it a code. We keep the number, and whether and when it was checked. Only you and your organization's Administrators can see the number. Others who can see your profile see only whether it's checked, and when.

What you and your organization put into BLOM

Your profile and memberships, and your organization's records: its products, items, standards, process and its versions, tasks, briefs, next actions, claims, approvals, and agents, each agent with its accountable owner. BLOM keeps a history of every change, with who made it, when, and why. Agent credentials and sign-in sessions are stored only as one-way hashes.

Technical information

When you use BLOM, our hosting provider logs each request: the address requested, which can include your organization's ID, your IP address, your browser, and the time. BLOM's own logs record what kind of request it was and how it ended, never your content.

What we don't collect

BLOM uses no analytics, advertising, or tracking tools, and it takes no payments.

2. How we use it

To run BLOM: sign you in, check your phone number, show you and your organization's members what each is allowed to see, and keep the history.
To keep BLOM and the people using it secure, prevent misuse, and fix problems.
To contact you about BLOM, your account, or these policies.
To follow the law and protect our rights.

We don't sell your personal information, share it for advertising, or use it to train AI models.

BLOM asks Google or GitHub only for your basic profile: your email address, name, picture, and account ID, and on GitHub your username. We use it only to sign you in and to show who you are to the members of your organizations. We store it with your BLOM account, in the United States. We don't sell it, use it for advertising, or use it to train AI models, and we share it only with the services below that run BLOM. You can remove BLOM's access in your Google or GitHub account settings, though you then can't sign in to BLOM with that account. Removing that access doesn't delete your BLOM account or anything in it.

Services that run BLOM, each only for its own job:
- Supabase, which hosts our database and our sign-in service, in the United States (AWS, Virginia);
- Vercel, which runs BLOM's servers near Washington, D.C., and delivers its pages through a worldwide network;
- Twilio, which texts your phone code and checks that a number is a mobile line, in the United States.
Other providers that help us build, run, and support BLOM, under duties to keep the information safe and use it only for that work.
Your organization. Members see what their roles allow, such as names, tasks, and the history of who did what.
Tools your organization connects. AI tools such as Claude Code or Codex get only what your organization's agent credentials let them read, under your organization's own accounts with them. BLOM sends them nothing on its own.
When the law requires it, or to protect the rights and safety of people and of BLOM.
In a business transfer, such as a merger or sale, under the same protections.

5. Cookies and Do Not Track

BLOM sets two cookies, both needed to sign you in:

__Host-blom-session keeps you signed in, for up to 30 days.
__Host-blom-flow holds a sign-in that's in progress, for 5 minutes.

This website sets no cookies. Neither BLOM nor this website uses analytics or advertising cookies, so there's nothing to opt out of.

Do Not Track. BLOM doesn't track you across other websites, and it lets no one else do so. It works the same whether or not your browser sends a Do Not Track signal.

6. How long we keep it

During the beta, we keep your account and your organization's records, and we don't delete them on a schedule.
Backup copies of our database are kept for about 7 days.
Our providers keep their own logs and records, such as request logs and text-message records, for the periods their services set.
The history of who changed or approved what stays with your organization's records.

When the beta ends, we'll update this policy to say how long we keep information after it.

7. Your choices

To ask what personal information we hold about you, or to ask us to correct it, email service@boundarylayerlabs.com.
If a privacy law gives you rights over your information, we'll respond as that law requires.
We handle your organization's records on its behalf, to run BLOM for it, and its Administrators manage them and your membership. Questions about an organization's records go to them first.
We decide ourselves how we handle your account, sign-in, and security information, as this policy describes.
You can stop using BLOM at any time, and remove BLOM's access in your Google or GitHub account.

8. Security

We protect information with measures suited to an early beta: encrypted connections, sign-in through GitHub or Google with a fresh sign-in before sensitive steps, each organization's records kept apart from every other's, and credentials stored only as hashes. No system is perfectly secure, and the beta's limits are listed in our Terms of Service.

9. Children

BLOM is for people 18 and older. It isn't meant for children, and we don't knowingly collect their information. If you think a child has given us information, email us.

10. Where we process it

Our database and servers are in the United States. Requests travel through Vercel's worldwide network, so they may be handled outside the United States on the way, and our providers may support their services from other countries.

11. Changes

We'll post any update here, with a new version and date. If a change matters, we'll tell you in BLOM and, where needed, ask you to agree again.

Contact

Craft Collective LLC, doing business as Boundary Layer Labs · service@boundarylayerlabs.com