We keep only what the studio needs to work, and each writer’s work can be read only by their own account. If you find a way to break something, please tell us privately first.
How Buildblur is built
- Your writing is kept in your account. Every document is created with permissions that let only your account read, change or delete it.
- There are no passwords for us to lose: you sign in with Google or a one-time code sent to your email.
- Signing out clears the copy in that browser, and a browser’s copy is never merged into a different account.
- The site is served over HTTPS. Service keys live on the server and are never sent to your browser.
- The AI endpoint is rate-limited per user to keep it available.
Reporting a problem
Email preetham@buildpov.com with “Security” in the subject. Include what you found, how to reproduce it, and what someone could do with it. We’ll acknowledge your report, keep you updated, and credit you if you’d like when it’s fixed.
Please
- Only test against your own data. Don’t access or change other people’s share links or data.
- Don’t run denial-of-service, spam or load tests, or burn through the shared AI endpoint.
- Give us reasonable time to fix a problem before you talk about it publicly.
If you act in good faith and follow these rules, we won’t pursue legal action against you for your research.
Out of scope
- Problems that need physical access to someone’s unlocked computer.
- Missing security headers without a demonstrated impact.
- Rate-limit or AI-output quirks with no security impact.
- Social engineering.
Questions about this page: preetham@buildpov.com. See also the legal centre.