Privacy

What blastbeat collects, and why.

blastbeat keeps your Tasks, Notes and everything else you write to yourself. This page says what blastbeat.app keeps about you, why, who else handles it, and how to take it with you or delete it. blastbeat.app is run by Zakk Tapp; questions go to [email protected].

It covers this website, the Site; the blastbeat app at app.blastbeat.app; and the blastbeat desktop and iOS apps while they use it. An account is one person’s: blastbeat has no teams or shared workspaces.

An Instance someone else hosts, including one you run yourself, is theirs: its Admin decides what it keeps and for how long, and this page does not cover it. The Site belongs to blastbeat.app alone; a self-hosted Instance has none.

Last updated 23 October 2026.

Your account

To run your account, blastbeat keeps:

your email address, which you log in with and which blastbeat writes to;
your password, only as a one-way hash, never the password itself;
your Second factors: an authenticator app’s secret, encrypted; a Passkey’s public key; and your Recovery codes, only as one-way hashes;
the name, photo and timezone you set, and your preferences;
your sessions: each device’s kind, such as “Firefox on Linux”, and when it was last used, so you can see and log out your devices.

What you write

Your Tasks, Projects, Labels, Filters, Notes, Folders, Goals and Habits live in a database of your own, which only your account opens. blastbeat uses what you write only to show it back to you: it isn’t read by people, used for advertising or used to train AI models.

Email to Inbox

If you turn on your Inbox address, at in.blastbeat.app, mail sent to it becomes a Task in your Inbox. To make the Task, blastbeat reads the message: the Task gets the message’s own text, without its quoted history and signatures, and who sent it. Attachments are left out. Cloudflare delivers the mail.

The message itself is kept only until its Task exists, then deleted. blastbeat also keeps a one-way hash of each message, so one that arrives twice makes one Task, and counts the messages your address receives by the hour and day, to refuse a flood.

Google Calendar and Gmail

If you connect a Google account, blastbeat asks Google only for what each feature needs: your account’s email and ID; for Calendar, your calendars and permission to read and change their events, so Tasks and Events can share the grid; and for Mail, permission to read and change your messages and labels, so you can triage, archive, snooze and reply to a Thread from blastbeat. It keeps:

the access Google grants, encrypted and kept apart from your data, so your export never carries it;
for Calendar, a copy of your calendars and their events, so they show and stay in sync;
for Mail, your labels, the Threads you snoozed, and which Threads you made into a Task or Note. Messages themselves are read from Google when you open them, not stored.

blastbeat’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. That data is used only to show your calendars and mail in blastbeat and to do what you ask with them. It isn’t sold, used for advertising or used to train AI models, and no one reads it unless you ask for help with it, it’s needed for security, or the law requires it.

Disconnect the account in Settings › Integrations to withdraw blastbeat’s access at Google and delete the copy blastbeat keeps; your Tasks and Notes stay. Deleting your account disconnects every account you connected the same way. You can also remove blastbeat in your Google Account’s security settings.

Where blastbeat.app offers it, a calendar (CalDAV) or mail (IMAP) account from another provider works the same way: blastbeat keeps its password encrypted, and Disconnect deletes the connection and the copy.

This website

The Site has no account and no Login, and sets no cookies. It loads no scripts, fonts or images from other sites, and shows no advertising. Cloudflare carries every connection to it, as it does to the app.

Pages you open here may count as an anonymous page view, described under Analytics on this website. Links to the app, to Google and to other sites leave this one; their own policies apply from there.

Telemetry: errors and performance

Telemetry and Analytics stay on blastbeat’s own server: neither goes to a third party, and neither sets a cookie.

When something breaks or runs slowly in the API, the web app, the desktop app or the iOS app, blastbeat records:

the error’s type, a cleaned-up message and where in the code it happened;
how long requests, app start-up, page loads and screen changes take, how quickly the app responds to a click or key press, how much a page shifts while it loads, and the connection’s speed class, such as “4G”;
the app version, the kind of device, operating system and browser, and the screen it happened on, as a template such as “a Task” and never which Task.

Records from a logged-in account carry a Pseudonym: a code computed from your account with a secret key. It shows how many people one error affects, without saying who they are. Error messages are scrubbed of email addresses, links and anything that looks like a token before they’re stored.

From the same records and the account list, blastbeat counts how many accounts there are, how many people used blastbeat in the last day, week and 30 days, how many people use each part of it, and how many accounts sign up, finish Onboarding, create their first Task or are deleted. These counts name no one.

Telemetry is needed to run the service, so it has no switch. Logs and traces are kept for 30 days, and performance metrics for up to 90 days.

Analytics: what gets used

If you allow it, blastbeat counts:

which screens are opened, by template, never with the names or IDs of what’s on them;
a fixed list of actions, such as “a Task was created with Quick add”, “a Habit was logged” or “the Command palette was opened”;
the app version, your language setting, and the country, region and city the connection comes from, worked out from its IP address.

Once you log in, Analytics carry your Pseudonym, so blastbeat can see how one person uses the app across their devices and over time. The Pseudonym isn’t your name or email, but blastbeat’s operator can match it to your account. Before you log in, visits are grouped only by an anonymous hash whose salt changes every month. Analytics are kept for 13 months, then deleted, and an account’s Analytics are deleted within an hour of the account.

Real User Monitoring: how a visit goes

If you allow Analytics, the web and desktop apps also record how a visit goes, so blastbeat can find what is slow or broken for the people using it:

each screen you open, by its address without the part after “?” or “#” and with IDs blanked, and how long it took to load and to respond;
the requests it made, by the same kind of address, how long they took and whether they failed, and the errors that happened;
the buttons and links you clicked, never by the words on them, and how long the page was busy;
for some visits, and for a visit where an error happened, a Session Replay: a recording of the page’s layout, scrolling and clicks in which every word, number, image and field is replaced by a placeholder, so it shows where you clicked but never what the page said or what you typed.

Pages whose address carries a code or a link’s token, such as resetting a password or logging in from the desktop app, are never recorded. These records carry your Pseudonym, the kind of browser and operating system, and a random visit ID the app keeps in your browser’s local storage, which a new one replaces after 15 minutes idle or 4 hours. They stay on blastbeat’s own server and are kept for 30 days. Turning Analytics off turns them off too.

Analytics on this website

When you open a page of the Site, your browser sends the blastbeat app (app.blastbeat.app) an anonymous page view: which page it was, as a template (“a docs page”, never which one), the time, your browser’s language, the Site’s version, and either the page you came from on the Site or, for the first page you open, the address of the site that sent you there, without its path. It names no one: the Site stores no identifier in your browser, and the page view goes without cookies or any sign-in, so it is never tied to an account or a Pseudonym.

Like any request, it carries your IP address and browser details. The Analytics service uses them to tell the browser, system and kind of device, and to work out the country, region and city, and it never stores the address itself. Visits are grouped only by an anonymous hash whose salt changes every month, so one browser’s views within a month can be counted as one visitor, and no longer. Page views are kept for 13 months, then deleted.

The Site sends nothing when your browser sends Do Not Track or Global Privacy Control, or when you turn the switch below off. The choice is kept on this device only and takes effect at once.

Share usage analytics

On: this website sends an anonymous page view as you move around it.

What blastbeat never collects

The names or contents of your Tasks, Notes, Projects, Labels, Filters, Folders or Goals.
Your IP address, with two exceptions: the Audit log keeps the address an Admin acted from, for 365 days, and an email sent before you log in, such as a password reset, keeps a one-way digest of it for a day, so one client can’t send too many. Analytics uses it only to work out the anonymous monthly hash that groups a visit and where the connection comes from, and never stores it.
Search text or what you type: a Session Replay masks every field, and nothing records a heatmap.
Cookies or identifiers for advertising.

Turning Analytics off

In the app, turn off Share usage analytics in Settings › Account on the web and desktop, or Settings › General on iOS. The choice follows your account to every device. Before you log in, a device remembers its own choice. On this website, use the switch under Analytics on this website; it is separate, and stays on this device.

If your browser sends Do Not Track or Global Privacy Control, Analytics and Real User Monitoring stay off whatever the switch says.

Cookies and storage on your device

The app sets one cookie, which keeps you logged in; it is needed for the app to work, and nothing else reads it. The apps also keep your preferences, unsent drafts, the random visit ID of Real User Monitoring and, before you log in, your Analytics choice on your device. blastbeat uses no advertising or tracking cookies.

This website sets no cookies. It keeps these two items in your browser’s local storage, which never leaves your device:

bb-site-theme: whether you chose the light or the dark theme, set when you use the theme button.
bb-site-analytics: whether you turned Share usage analytics on or off, set when you use the switch above.

Who else handles it

blastbeat doesn’t sell or share your personal information. These services handle it on blastbeat’s behalf, only to run it:

DigitalOcean hosts the server, in New York, and its backups, in San Francisco.
Cloudflare carries every connection to blastbeat.app and app.blastbeat.app, and delivers mail sent to your Inbox address.
Resend sends blastbeat’s email, such as codes and reminders.
Google, only for an account you connect.

blastbeat will disclose information only when the law requires it, and tells you first when allowed to.

How long it’s kept

Your account and what you write are kept until you delete them. Backups keep each change for 7 days. Telemetry logs and traces, Real User Monitoring and Session Replays are kept for 30 days, and performance metrics for up to 90 days. Analytics, including the Site’s page views, are kept for 13 months. The Audit log of Admin actions is kept for 365 days.

Taking it with you, or deleting it

Export everything in your account at any time in Settings › Account, and download your Tasks or Notes as files in Settings › Import. Change your email, name or photo in Settings. Delete your account in Settings › Account too: it is removed from the server at once, its Analytics within an hour, and from the backups within 30 days. Ask at [email protected] to see, correct or delete anything else blastbeat keeps about you; you’ll get an answer within 30 days.