News · Security at Blackbear

What Our Servers Can See

Every cloud service holds metadata about you. Most bury that fact on page nine of a privacy policy. We would rather publish the ledger.

This is what Blackbear's servers store, checked against our actual database schema as we published this post. Not the marketing version. The columns.

Your account

You can sign in with email, phone, Google, or Apple. Whichever you choose, the identifier is stored encrypted at rest and looked up by keyed hash. We can decrypt your email when we need to send you a magic link, and it never appears in our logs unredacted.

Phone sign-in uses Twilio Verify to deliver codes. We never store the codes; Twilio necessarily sees your number to deliver the text.

If you pay for sync, Stripe holds your payment details. We hold a customer reference, your plan, and your subscription state. We never see your card.

Sync

For every change you sync, the server records: the kind of thing it is (a file, a task, a calendar event), its ID, version metadata for conflict resolution, a timestamp, which of your devices pushed it, and its size in bytes. The payload itself is ciphertext, sealed on your device as described in Part 1.

So yes: we could see that you sync more spreadsheets than notes, and that you are active on weekday mornings. That is real metadata, and we will not pretend otherwise. What we cannot see: titles, text, tags, folder names, or anything inside your files.

Media rows are leaner still: an opaque storage key ending in .enc, a byte count, and the broad kind of file from upload validation. Your filenames never enter the storage key or the database.

Messaging

The mailbox is a relay, not an archive. A message row holds the sender account, the recipient account, a conversation ID, timestamps, and the sealed envelope. We can see who talks with whom, and when. We cannot see what is said.

Retention is mechanical: delivered messages are deleted after 24 hours. Undelivered messages wait up to 30 days for their recipient, then are deleted.

Shared spaces

For collaboration, the server stores group membership by key fingerprint, signed roles, key epochs, and encrypted updates. It can tell that five fingerprints share a document and how actively they edit. It cannot read a word of it. Part 3 walks through this in detail.

Devices

Your device list shows a platform, a last-sync time, and a sync cursor per device. Device names are stored today as you typed them — name a device “MacBook” rather than something you would mind us seeing.

Security logs

We keep an audit trail of security events: sign-ins, failures, sensitive operations, with IP address and user agent. It exists to catch abuse, and it does not stay raw. After a bounded hot window, each record is minimized: the IP is masked, the user agent is reduced to a platform name, and your account ID is replaced with an opaque privacy ID. The minimized records are encrypted into cold storage and the raw rows are deleted.

Even our own logs get their identifying details stripped on a schedule.

Analytics

Our website (this one) answers a single pageview ping to our own API. No cookies, no fingerprinting, and Do Not Track is honored. Identifying values are hashed with a salt that rotates daily, the raw values are discarded, and rows are deleted on a rolling window. The app is never tracked. No telemetry, no SDKs, no third-party scripts. We cannot A/B test you. We find out about bugs when you tell us.

What this adds up to

We built Blackbear so the honest answer to "what do you know about me?" stays short. An encrypted identifier. Ciphertext with shapes and timestamps. A relay that forgets in hours. Logs that forget on purpose.

A privacy promise you cannot check is a vibe. A ledger you can hold us to is a public commitment. This one is ours, verified line by line against the schema shipping on August 15, 2026.