Privacy
Last updated 27 July 2026
Blackbird is run by DEX, an individual, on a server DEX operates. This page describes what that server holds and who can reach it. It is written plainly rather than defensively, and it describes the software as it actually behaves.
What is stored
To run an account and deliver messages, the server holds:
- Your username, and your email address if you signed up with one or added one later.
- A hash of your password, if you set one. The password itself is never stored and cannot be recovered from the hash.
- Your messages and any files you send, until you or the other person deletes them.
- Which accounts you have chats with, and when each message was sent, delivered and read.
- One-time sign-in codes, which are deleted once used or expired.
If you allow Blackbird to read your contacts, the phone numbers on your device are checked against accounts on the server so existing contacts can be found. Numbers that do not match an account are not kept. This permission is optional and the rest of the app works without it.
What is not collected
- No advertising identifiers, and no advertising of any kind.
- No analytics or crash-reporting SDK is compiled into the app.
- No location data.
- No profiling, and nothing is sold or shared with a data broker.
Where it lives
Everything is stored on a single server rented from a hosting provider in Germany. Connections between the app and that server use HTTPS, so traffic is encrypted in transit. The hosting provider necessarily has physical access to the machine, as any host does.
Messages are encrypted in transit but are readable on the server. Blackbird does not currently offer end-to-end encryption, and this page will not claim otherwise. Whoever administers the server is technically capable of reading stored messages. Please judge the app on that basis.
Other services involved
- Email. Sign-in codes and account emails are sent through an email provider, which sees your address and the message sent to it.
- DNS. Cloudflare answers DNS queries for this domain and therefore sees the fact that a lookup happened.
- Calls. If a direct connection between two devices cannot be made, call audio and video are relayed through the same server.
How long it is kept
Messages stay until deleted. Deleting your account removes your messages and your account record from the live database. Server backups are taken for recovery and are held for a limited period, so a copy of deleted data can persist in a backup for a short time after deletion.
What you can ask for
You can ask for a copy of what the server holds about you, ask for it to be corrected, or ask for your account and its data to be deleted. Write to buildsevaa@gmail.com from the email address on the account, or from the app if you have access to it.
Children
Blackbird is not intended for children under 13, and accounts are not knowingly created for them.
Changes
If this page changes in a way that affects what is collected or who can reach it, the date at the top changes and the change is described in the app's release notes.