Privacy Policy
Last updated: September 2026
1. Introduction
Plumbug Studio Inc. (“we”, “our”, or “us”) operates typeblast, a macOS text expansion application and the website at typebla.st. This Privacy Policy explains how we collect, use, and protect information about you when you use our services.
By using typeblast, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
2.1 Account Information
You can use local Free text expansion without an account. If you sign in for a public pack, a Pro trial, billing, or publishing, authentication is managed through Authon using the sign-in provider you choose. We receive the account identifier, email address, and verification status needed to operate those account-bound services. typeblast does not receive or store your sign-in provider password.
2.2 Snippet Data
Local snippets, local groups, app rules, and local usage counts remain on your Mac; this release does not upload them for personal cloud or multi-device sync. If you publish a public pack, the pack name, description, abbreviations, and snippet content are stored on our servers and made visible to other users. When you subscribe to a public pack, we store the subscription and deliver the publisher's public content and updates to your Mac. Private and team packs are not offered in this release.
2.3 Usage Analytics
We use OpenPanel to understand whether the website and product are working and which features need improvement. Product events are intentionally limited to aggregate signals such as a first successful expansion, active-item milestones, an attempted locked feature, and import counts. We do not include snippet text, titles, abbreviations, group names, or imported filenames in analytics events. Network and browser metadata may still be processed when an event is delivered, so we do not describe these events as incapable of being linked to a device or account.
Collected analytics data includes:
- Pages visited and product actions such as download or upgrade intent
- General geographic region (country-level only)
- Browser and operating system type
- Referral source
- Privacy-minimised app milestones and aggregate import counts
2.4 Payment Information
Subscription payments are processed by Paddle, our Merchant of Record. We do not receive or store your full payment card details. Paddle handles all billing data in accordance with PCI-DSS standards. We receive transaction metadata (subscription status, plan type, renewal dates) from Paddle to manage your account access.
2.5 Technical Data
When you interact with our website or API, we may collect your IP address, browser type, and device identifiers for security, fraud prevention, and debugging purposes. This data is not used for advertising.
3. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve the typeblast service
- Authenticate your identity and protect your account
- Publish, subscribe to, and update public snippet packs
- Process subscription payments and manage your billing
- Send transactional emails (e.g., account confirmation, password reset)
- Respond to support requests
- Understand how our service is used and improve user experience
- Detect and prevent fraud or abuse
We do not sell your personal data to third parties. We do not use your data for targeted advertising.
4. Third-Party Services
typeblast integrates with the following third-party services. Each operates under its own privacy policy.
| Service | Purpose | Data shared |
|---|---|---|
| Paddle | Subscription billing & payments | Email, billing address, payment details |
| Authon | Authentication & account management | Email, hashed password, auth tokens |
| OpenPanel | Product analytics | Anonymised usage data, IP (anonymised) |
5. Cookies and Local Storage
We use the following storage mechanisms:
- Authentication session — maintained with a Secure, HttpOnly first-party cookie; the browser receives only a one-time PKCE login code and authentication tokens are kept encrypted on our server
- Theme preference — stored in localStorage to remember your light/dark mode choice
- Session cookies — short-lived cookies used by our authentication system to manage sessions securely
- Analytics cookies — first-party cookies set by OpenPanel to distinguish unique visitors anonymously
We do not use third-party advertising cookies. You can clear cookies and localStorage at any time through your browser settings. Clearing the session cookie will sign you out.
6. Data Retention
We retain account data while the account is active and for only as long afterward as needed to complete deletion, prevent fraud, resolve disputes, stop future charges, and meet legal obligations. Deleting an account removes its public packs and account-bound community data and revokes sessions and devices. Billing records required by Paddle or law, security and audit records, webhook evidence, and privacy-minimised evidence used to enforce the one-trial policy may be retained or pseudonymised for the applicable retention period.
Aggregated analytics may be retained after identifiers are removed. Contact us for the retention period applicable to a particular category of personal data.
7. Data Security
We implement industry-standard security measures including TLS encryption in transit, encryption at rest for sensitive data, and access controls that limit who within Plumbug Studio Inc. can access user data. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
8. Your Rights
Depending on your jurisdiction, you may have the following rights:
- Access — request a copy of the personal data we hold about you
- Correction — request correction of inaccurate data
- Deletion — request deletion of your account and associated data
- Portability — request an export of your snippet data in a machine-readable format
- Objection — object to specific processing of your data
You can export local snippet data from the Mac app. To request account deletion or exercise another privacy right, contact us from the account email address at privacy@typebla.st.
9. Children's Privacy
typeblast is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately.
10. International Transfers
Our servers and service providers may be located outside your country of residence. By using typeblast, you consent to the transfer of your information to these jurisdictions, which may have different data protection laws than your own.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on our website. The date at the top of this page reflects when this policy was last revised. Continued use of typeblast after changes take effect constitutes acceptance of the updated policy.
12. Contact
If you have questions or concerns about this Privacy Policy or how we handle your data, please contact us:
Plumbug Studio Inc.
privacy@typebla.st