Privacy Policy

Last updated: 2026-06-02 · Effective: 2026-06-02

Blarg LLC ("Blarg", "we", "our") operates the blarg.studio website and the Blarg Hub web application (collectively, the "Services"). This policy describes what we collect, why, and your rights.

The Services include a suite of LLMs & frameworks and the Blarg Portal explainer surface ; accessible after account creation. Additional paying-tier products and research tools are available to subscribers on our gated tier and are governed by the same privacy practices described below. Our card game Enmity is a separate application hosted at enmity.com and has its own published privacy policy.

1. Information we collect

• Account information: email address (required to create an account), and an optional phone number if you opt into SMS communications.
• Authentication options: you may sign in with (a) email + password or (b) a GitHub OAuth connection. Both methods store only what is required to verify the next sign-in: for email/password, a scrypt-salted password hash; for GitHub, the GitHub user ID and an opaque link record (no GitHub access token stored at rest beyond the OAuth handshake). We never store GitHub passwords, OAuth scopes are limited to read:user and user:email, and the OAuth callback strips any returned tokens from the URL before any browser history retention.
• Authentication tokens: a session cookie set by our backend (httpOnly, SameSite=Lax, Secure). The cookie identifier links to your server-side session; it does not contain personal data.
• Payment information: handled by our payment processor (Stripe). Blarg does not see or store card numbers, CVVs, or full bank details. We retain a payment-confirmation reference (charge ID, last-4 of card, billing email) for receipts and dispute resolution. Optional donations through the same checkout flow are processed identically and may be made one-time or recurring; donations are non-refundable except where required by law.
• Usage information: page views, feature interactions, and server logs (IP address, user-agent, timestamps) used for security, abuse prevention, and product diagnostics.
• Newsletter subscribers: if you sign up for our newsletter, we store email, optional phone, opt-in timestamp, and the source page.
• Game progress: if you play games on the Hub (for example, the Blarg Match Game), we store per-mode scores linked to your account so progress carries across devices. Anonymous play stores scores only in your browser's local storage.
• Game-play records: when you play interactive games on the Hub against our AI or against other members (for example, chess), we store the moves, game state, and results linked to your account. These records let you resume games, view your history, and play across devices.

2. How we use it

• Provide and operate the Services (account login, paywall, gated content).
• Send transactional email from customer.service@blarg.online (account verification, password resets, purchase receipts).
• Send marketing email or SMS only with your prior consent (double opt-in for newsletter; explicit opt-in for SMS).
• Detect and prevent abuse, fraud, and security incidents.
• Improve and train our own AI systems. Game-play records (such as the moves from chess games) are used to develop and improve Blarg's own game-playing AI. This training is performed internally by Blarg; we do not sell game data or share it with third-party advertisers or external AI providers.
• Comply with applicable law.

3. Legal basis (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we process your data on the following bases:

• Contract: to provide an account, paywall access, and purchased services.
• Legitimate interest: security, fraud prevention, basic product analytics, and improving our Services, including training our own game-playing AI on game-play records.
• Consent: marketing email, SMS, and any optional features that require it. You can withdraw consent at any time.
• Legal obligation: tax records and compliance with lawful requests.

4. How we share it

• Payment processor (Stripe) for billing, refunds, and donation processing.
• Identity provider (GitHub) only when you choose GitHub sign-in. We receive the GitHub user ID and verified email address; GitHub does not receive any data we hold about you.
• Cloud hosting and database (Render) for application hosting and storage.
• Email delivery (transactional SMTP) to send account email and opted-in marketing email.
• Law enforcement or legal counsel if required by valid legal process.

We do not sell personal data. We do not share data with third-party advertisers.

5. Your rights

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to fix inaccurate data.
• Deletion: request account deletion; we remove personal data subject to legal retention requirements.
• Portability: receive your data in a machine-readable format.
• Withdraw consent: unsubscribe from email at any time via the link in every marketing message; reply STOP to opt out of SMS.
• Lodge a complaint: with your local data-protection authority.

Contact customer.service@blarg.online to exercise any right.

6. CAN-SPAM and TCPA (United States)

We honor CAN-SPAM Act requirements: every marketing email includes a working unsubscribe link, our postal address, and a clear sender identity. We process unsubscribe requests within 10 business days, typically within minutes.

SMS communications (where applicable) follow TCPA: we only send to numbers that have given prior express written consent. Reply STOP to opt out at any time; reply HELP for help. Message and data rates may apply.

7. Retention

• Account data: retained while your account is active and for 12 months after closure.
• Newsletter list: retained until you unsubscribe, plus 30 days of opt-out evidence.
• Transaction records: retained per tax-law requirements (typically 7 years in the U.S.).
• Server logs: 90 days, then deleted or aggregated.

8. Security

We use industry-standard safeguards: TLS for data in transit, encryption at rest for backups, row-level security on personal-data tables, separated authentication credentials and payment-provider keys, rate-limited login and checkout endpoints, and signed payment-provider webhooks. No system is perfectly secure; if you suspect a breach, contact customer.service@blarg.online.

9. Children

The Services are not directed to children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us data, contact customer.service@blarg.online and we will delete it.

10. International transfers

Our hosting and processors are located in the United States. If you access the Services from outside the U.S., you consent to the transfer and processing of your data in the U.S. We use Standard Contractual Clauses or equivalent safeguards where required for cross-border transfers.

11. Changes to this policy

We may update this policy. When we do, we update the "Last updated" date above and, for material changes, notify account holders by email.

12. Contact

Blarg LLC ; customer.service@blarg.online