What blüp stores, who else sees it, and how to get rid of it.
Last updated 9 November 2026.
When you register, blüp stores:
| Username | Required. It is public — it appears on any track you share and on your profile. |
| Password | Required, and stored only as a hash. Nobody here can read it, including us. |
| Email address | Optional. Only used to send you the messages described below and to get you back in if you forget your password. Give nothing and the account still works. |
| Recovery code | Stored as a hash, so the code shown to you once at sign-up is the only copy. |
| Avatar and bio | Optional, and public if you add them. |
If you give an address, blüp sends: a welcome message, password resets you ask for, and a note when somebody follows you. That last one can be switched off in your account settings. There is no newsletter and no marketing mail.
Mail is sent from blüp's own mail server at mail.blupit.app. It is not handed to a third-party mailing service.
A saved track stores its title, its code, the grid settings behind it, and its cover image. It is tied to your account.
A track is private until you share it. Once you press Share to community it becomes readable by anyone with the link, and it shows your username. Unsharing it removes it from the community page.
A shared track counts how many times it has been played. That is a number on the track, not a record of who played it.
Following someone records that the two accounts are linked, and follower and following lists are public.
blüp sets one cookie, the session cookie that keeps you logged in. There are no advertising or analytics cookies, so there is no cookie banner to click away.
Sessions are stored in the database, and a session row holds your IP address and browser user-agent alongside it. That is how the login works and how an abusive account can be dealt with. Sessions expire and are cleared.
The web server keeps ordinary access logs, and errors are written to an application log. Both can contain IP addresses. They are for keeping the site working and are not used to build a profile of anyone.
If you use Ask AI, the prompt you type and the code of the track you are editing are sent to Anthropic's API to produce the reply. That is the whole point of the feature, but it is worth being explicit about: do not put anything private into that box.
The request is made by blüp's server, so the API key stays here and your browser never talks to Anthropic directly. blüp does not keep a copy of your prompts beyond what is needed to answer them. What Anthropic does with an API request is governed by their privacy policy.
blüp itself runs on a server rented from DigitalOcean. Beyond that, your browser fetches some files directly from other people's servers, and those servers can see your IP address the way any website you visit can:
| jsDelivr | The Strudel engine and the General MIDI instrument samples. |
| GitHub (raw.githubusercontent.com) | Some of the sample libraries — the orchestral instruments and the drum-machine index. |
| Google Fonts | The typeface the site is set in. |
None of these is given your account details, and none of them is an advertising network. The drum samples you hear most are served from blüp's own server rather than fetched from anywhere else.
Your account and your tracks are kept until you delete them. Delete a track and it is gone. Ask for your account to be deleted and it goes, along with the tracks on it.
To delete your account, write to hello@blupit.app from the address on the account, or from the account itself if you did not give an address. Backups roll over, so a copy can survive in a backup for a short period after deletion.
Depending on where you live — the UK and the EU under GDPR, California under the CCPA, and elsewhere — you may have the right to ask for a copy of what is held about you, to have it corrected, to have it deleted, and to object to it being processed. blüp will honour those requests regardless of where you live, because the amount of data involved is small.
blüp is run from the United States, so if you are outside it your information is handled there.
blüp is not intended for children under 13, and accounts are not knowingly created for them.
If this policy changes in a way that matters, the date at the top changes and anyone with an address on file is told.
Questions, or a request about your data: hello@blupit.app.