Privacy Policy

1. Who runs LookBlog

LookBlog is run by Kristiqn Zainelov, in Bulgaria, who is the controller of your personal data (the one who decides why and how it is used). Write to us at any time through the contact form — you don’t need an account — or, when you’re logged in, Menu → Help → Still need help?. We answer privacy requests within one month.

2. What we collect

• Account details: your name, @username, email, password (stored only as a secure hash), and when you agreed to these rules and confirmed your age.
• What you post: posts, photos, videos, songs, comments, messages, stories, notes, events, group content, stickers and sounds.
• Activity: follows, likes, Cools, reactions, views, watch time, plays, searches on the site, and when you’re online and when you were last online.
• Technical data: your browser and device type and IP address, used for security and to stop abuse (for example, limits on how often you can try a password).
• Messages to the team: what you send us through Help or the contact form, and the email you give us there.

3. Why we use it, and on what legal basis

• To run LookBlog for you — your account, showing your content, delivering messages and calls, keeping you logged in. Basis: our contract with you (the Terms).
• Trending searches — under the search box we show what many people searched in the last 7 days: only words that at least 2 different people searched, counted together, never who searched them. Remove a search from your recent searches and it stops counting. Basis: our legitimate interest in a useful service.
• “For you” recommendations based on what you follow, watch and like, and analytics for creators about their own content (numbers, and for their biggest fans only public profile names — never your private messages). Basis: our legitimate interest in a useful service; you can pause or clear your watch history.
• Safety: fighting spam, abuse and illegal content, including automatic checks of photos and text when they’re posted. Basis: legitimate interest and legal obligations.
• Answering you and the law: replies to your messages, and requests from authorities when the law requires it. Basis: legal obligation / legitimate interest.

We don’t sell your data, we don’t show ads, and we don’t use your data to make decisions that have legal or similarly significant effects on you.

4. Who can see what

• Public posts and your profile can be seen by other LookBlog users; shared links show a preview to people without an account. Private accounts show posts only to approved followers.
• Direct messages are visible to the people in the conversation. Group messages are visible to the group (or anyone, for public groups).
• Activity status: people can see a green dot when you’re online and “Last online …” when you’re not. You can hide it in Settings → Activity status.
• Calls go directly between browsers, so the other person’s browser sees your IP address. If a direct connection isn’t possible, the sound goes through a relay server. LookBlog doesn’t record calls.

5. Services that help us run LookBlog

These companies process data for us, only to provide their service:

• Vercel — hosting the website (our servers run in Frankfurt, Germany; Vercel is a US company).
• Supabase — the database, file storage and live updates (in Frankfurt, Germany).
• Link previews: when a post or message has a link, our server fetches that page and its picture to make the preview card, so the other site sees our server, not you.
• YouTube / Google — when you play a YouTube song or video, it plays in YouTube’s player from youtube-nocookie.com, and YouTube receives your IP address and what you play.
• GIPHY — GIF searches go to GIPHY through our server; the GIF pictures load from GIPHY, which sees your IP address.
• Other sites’ players (TikTok, Instagram, Spotify, SoundCloud, Vimeo) — only after you tap “Load” on a link to them.
• Google Translate and MyMemory — only the text of a message or post you choose to translate.
• OpenStreetMap — the map and place search for events.
• A TURN relay — passes call audio when a direct connection isn’t possible.

Fonts and everything else are served by LookBlog itself. Your account data is stored in the EU (Frankfurt). Some of these companies are in the USA. When data goes outside the EU, it is protected by the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses that these providers offer.

6. How long we keep it

• Your account and what you post: until you delete them or your account.
• Stories: shown for 24 hours, then kept in your private archive for 30 days and then deleted — unless you put them in a highlight, which stays until you remove it.
• Uploads that were never posted: deleted after a day.
• Login sessions: up to 30 days.
• Messages to the team: kept while needed to answer you; when you delete your account they stay without your name or email. When you delete your account we keep only the reason you gave, without who you are.
• Deleted things disappear from the site straight away and from our storage soon after, unless the law requires us to keep them.

7. Your rights

• See and download your data — Settings → Your data → Download my data.
• Correct it — edit your profile, posts and settings.
• Delete it — delete any post, or your whole account in Settings → Delete account.
• Object or restrict — pause or clear your watch history, make your account private, hide your activity status, or write to us.
• Take your data elsewhere — the download is a JSON file.
• Complain — you can complain to the Bulgarian data protection authority, the Commission for Personal Data Protection (КЗЛД, cpdp.bg), or to the authority where you live. We’d like the chance to help first, so please write to us.

8. Children

LookBlog is for people who are 14 or older (the age at which you can agree to this on your own in Bulgaria). Agreeing to the Terms of Service when you sign up confirms that you are 14 or older. If we learn that an account belongs to someone younger, we close it — anyone can report this from the ⋯ menu on a profile.

9. Security

Passwords are stored only as secure hashes, connections are encrypted (HTTPS), logins are protected against guessing, and you can turn on two-step verification and keep recovery codes. If a security problem ever puts your data at risk, we will tell the authority within 72 hours and tell you when the law requires it.

10. Changes

If we change this policy in an important way, we’ll tell you on the site and ask you to agree again. Earlier versions are kept in our public code history on GitHub.