Privacy Policy
What we collect about you
| Data | Why | Where it lives |
|---|---|---|
| Name / handle you register | It is the search term for monitoring | Our tenant registry (AWS, us-east-1) |
| Email + password | Login, password reset, and alert emails when something needs your attention | Amazon Cognito (password is hashed; we never see it) |
| The mentions we find about you | To build your summary and answer your questions | Per-account storage and a per-account search index, isolated from other accounts |
| Which alerts we already sent you | So we don't repeat them | Per-account storage |
| Request logs (IP, time, path) | Abuse prevention and debugging | AWS logs, retained for a limited period |
| App error reports: the error type, where in our code it happened, the app version and your phone's OS version | To find and fix crashes | AWS logs, kept 90 days. No account, name, email or monitored content is ever attached, and no third party receives them |
What we read about you — and what we don't
We only read public sources through their official interfaces: news publishers’ and blogs’ own RSS feeds, the public Wikipedia edit stream, the YouTube Data API, and — when enabled — Reddit and Twitch public search. We respect each site’s robots.txt. In September 2026 we stopped reading two sources we had previously used: Google News, because its robots.txt does not permit the search endpoint we were using, and GDELT, because it carried almost no coverage of creators. We never read your direct messages, private comments, or anything behind a login; we do not scrape Instagram or TikTok; and we do not use facial recognition or any biometric matching.
Data from YouTube
Bluefin uses YouTube API Services. Data we receive from YouTube is also covered by the Google Privacy Policy, and using Bluefin means you agree to the YouTube Terms of Service.
- What we access: public data only, through our own API key: titles, short descriptions, links and publish dates of public videos that mention the name you registered; and the name, description, link and profile picture of public channels that may be impersonating you. When you declare your own channel, we look up its public name, handle and link to confirm it exists.
- What we do not access: you never sign in to YouTube or Google through Bluefin to grant us access, and we never read your YouTube account, private videos, watch history or subscriptions. We do not download or re-host videos; results link back to YouTube.
- How we use it: to show you new videos about you, to flag possible impersonation for your review, and to write your summary. We do not share it with anyone else.
- How long we keep it: no longer than 30 days. YouTube data older than that is deleted or refreshed.
- How to delete it: deleting your account (see below) removes it immediately, including stored copies.
If you connect your Instagram account
Connecting Instagram is optional, and happens only when you choose it and approve it on Facebook. We use Meta’s official Instagram API through Facebook Login, which requires your Instagram professional account to be linked to a Facebook Page you manage. With your permission we read:
- public posts by other accounts that tag or @mention your account, and comments that @mention it;
- comments on your own posts;
- your account’s username, so we can match it to the account you declared.
We do not read your direct messages, post anything, or read accounts that aren’t yours. What we keep: the access token Facebook gives us, encrypted and usable only for your account; which Instagram account and Facebook Page it is; and the identifiers of new mentions until your next scan reads them. Mentions we find are treated like every other mention in your report. You can disconnect at any time under My channels, or by removing Bluefin in your Facebook settings. When you do, or when Facebook sends us your deletion request, we delete the token and those identifiers immediately. Deleting your Bluefin account deletes them too.
If you connect an AI assistant
Connecting an AI assistant (such as Claude) over MCP is optional, available on paid plans, and happens only when you sign in to Bluefin from that assistant and choose Allow. The assistant can then read the results shown in your dashboard for the creators on your account, and, only when you ask it to, record the same two decisions the dashboard offers: your review of a possible impersonation, and marking a listed channel as yours. It cannot change your plan or settings, start a scan, or contact anyone.
What the assistant reads is sent to it, and from then on is handled by that assistant’s provider (for example Anthropic, for Claude) under their own terms and privacy policy, not ours. What we keep: which apps you allowed and when, the app’s name and web address, and sign-in records for each connection (only one-way hashes of its tokens, never the tokens themselves). Sign-in records expire after at most 30 days, or 7 days unused. You can disconnect an app at any time under Manage my data; its access stops within about a minute and its records are revoked. Deleting your Bluefin account disconnects and deletes all of them.
Other people who appear in your report
The mentions we show are public posts by other people. We store the post's title, link, and our automated read of it. We do not build profiles of those people, and impersonation flags are shown only to you, as proposals for your review.
Automated analysis
Summaries, sentiment, and impersonation scoring are produced by AI models run inside our cloud account (Amazon Bedrock). Your data is not used to train those models.
We email the address you registered when something about you needs your attention (an alert). Every email has a one-click unsubscribe link. Bounces and complaints are handled automatically so we stop mailing an address that rejects us.
Sharing
We do not sell your data. We share it only with Amazon Web Services, our processor for hosting, email and AI models, and with Google: the searches we run on YouTube go to Google under the YouTube API Services terms, and they contain the name being monitored, not your email or account details. If you connect Instagram, requests for your own account go to Meta, as described above. If you connect an AI assistant, the results it reads go to that assistant’s provider, as described above. We disclose data otherwise only if legally required.
Retention and deletion
Your data is kept while your account exists. You can delete your account yourself, instantly, from the dashboard footer (Manage my data) — this removes your registry entry, login, stored mentions, search index entries, alert history, and any phones registered to receive push notifications immediately, not in 30 days. You can also download a copy of everything we hold about you from the same place before deleting it. If you cannot access your account, email support@bluefin-app.com from your registered address and we will do it for you within 30 days.
Legal basis for monitoring
Bluefin processes two kinds of subject:
- You, monitoring yourself. The basis is your consent — you created the account and named yourself as the subject.
- A third party, monitored by a Brand/Agency account. This is a public figure acting in a public role. We do not ask them for consent because we have no relationship through which to ask, and the product design deliberately keeps this narrow to make a legitimate-interest basis defensible: we read only what that person or their team already made public, we apply no biometric or facial-recognition processing, impersonation and image-exposure findings are shown to the paying tenant as proposals for review — never auto-published or auto-acted — and the third party's own data-subject rights (access, objection, deletion of what we hold about the mentions of them) can be exercised through the same contact as any other request.
This is a product-level statement of the basis we believe applies, not a legal opinion. It has not yet been reviewed by a lawyer (see the draft notice at the top of this page). One feature is explicitly walled off from this reasoning rather than covered by it: our NCII/deepfake-exposure signal is restricted to self-subjects only and is not yet built — it is not available for third-party monitoring at all, regardless of this section.
Your rights
Depending on where you live (including under the GDPR and Brazil's LGPD), you can ask to access, correct, export, or delete your data, or object to processing. Use the contact above; we answer within 30 days.
Controller
Bluefin is operated by Signals, LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States, which is the controller of the personal data described above. Data is processed in the United States (AWS us-east-1). If you email support@bluefin-app.com, that message is stored for up to 12 months so we can answer it, then deleted automatically.