Blindfold

Privacy Policy

Last updated: 2026-10-24

Blindfold is built so that your browsing stays yours. Blocking runs on your device, there is no account, and there is no Blindfold server that watches what you read. This policy explains that in plain terms.

The short version

  • Blindfold has no user accounts and asks for no personal information to work.
  • Ad and tracker blocking happens entirely on your device, in Safari and, if you turn on Blindfold Everywhere, system-wide.
  • The on-device AI that learns new ads runs locally. Nothing it analyzes is uploaded. (A rule it wrote can be part of a site report, but only if you choose to send one.)
  • Two things are sent to us only when you choose to: a site report, and feedback you write in the app. Both are described below.
  • If a site looks broken or still shows an ad, you can send us a site report. It goes only when you tap Send report, you see what it contains first, including the main request headers Safari adds, and it is not tied to any account (Blindfold has none).
  • We don’t track you, sell data, or run advertising of any kind.

What stays on your device

Filter lists, the rules the AI writes, your custom rules, your allowlist, and your blocking statistics all live on your device. Blindfold does not send your browsing history, the pages you visit, or your stats to us or anyone else. The one exception is a site report you choose to send (below), which contains the address of that one site.

What leaves your device, and why

  • Filter-list updates. Blindfold downloads updated blocking lists over HTTPS from a public rules repository. These are ordinary file downloads; like any web request they expose your IP address to the host, but they carry no account or identifier for you.
  • Blindfold Everywhere (optional). This feature runs on Apple’s URL Filter API and needs iOS 26. Checking an address against the blocklist uses private information retrieval: the query leaves your device encrypted so that the service answering it cannot work out which address was asked about. Blindfold operates that service, alongside an Oblivious HTTP gateway that hides your device’s network address from it. Blindfold does not receive, store, or log your browsing history at any point.
  • iCloud sync (optional). If you turn on sync, your settings and custom rules are synchronized through your own iCloud account by Apple. They are not sent to us and we cannot read them.
  • Feedback (only if you send it). If you write to us from inside the app, your message is sent so we can read it and reply. See “Feedback from the app” below.
  • Purchases. Subscriptions and the lifetime purchase are handled by Apple. We never see your payment details.

Site reports (only if you send one)

Blindfold’s Safari extension lets you tell us about a site: “I still see an ad”, “Page looks broken”, the button on a site you paused, and the report buttons while “Show what’s blocked” is on. Nothing is sent unless you tap Send report, and the extension shows you what will be sent before you do: the report itself and the main request headers. Reports from Private Browsing tabs are off unless you turn them on for that report.

A report contains:

  • The site’s name. The page’s path is included only if you turn on “Include the page path”; it is off by default. We try to remove personal parts of the address: the part after “?” or “#”, settings after “;”, any user name, password or port number, and the rest of a search are left out, and parts of the path that are not plain words (numbers mixed with letters, long numbers, email addresses, IDs, tokens, or a name after a part such as /user/) are replaced with “:id”. For sites on platforms that give each person their own address (such as substack.com or github.io), only the platform’s name is sent. This is a best attempt, so check the preview before you send. We try not to send addresses that look local or internal (a router, a printer, a company intranet) or that are only numbers (an IP address): the extension tells you instead. This check goes by the address’s name, so it can miss some.
  • What kind of problem it is (an ad got through, or the page looks broken), which of the extension’s quick fixes you tried, and whether Blindfold was paused on that site.
  • If you report from “Show what’s blocked”, the blocking rule or the blocked address you tapped. This can be a rule Blindfold’s on-device AI wrote, but never one of your own custom rules.
  • Your Blindfold version and build, the date your filter lists were last updated, whether you use macOS, iOS or iPadOS and its major version, and which of Blindfold’s blocking lists are switched on.
  • A short note, only if you write one (up to 280 characters).

A report never contains the page’s content, screenshots, cookies or your other tabs. Like any web request, it also carries the standard headers Safari adds, such as your Safari and system version and the address of Blindfold’s Safari extension; we don’t store or log them. If your device is offline, the report waits on your device and is tried again up to three times in all, then deleted. A report from a Private Browsing tab is tried once and never kept on your device.

Reports go to reports.getblindfold.app, a service we run on Cloudflare. Like any internet connection, it reaches the service with your IP address. We never store or log that address. We use it, scrambled with a random secret that changes every day, to limit how many reports one connection can send, and for that we keep a count for the day under the scrambled value. We also keep a scrambled form of your network (the first part of your address, which many devices share) with the site you reported for up to 7 days, only to count how many different networks report a site on the same day (which decides what we look at first and stops one network from flooding us with sites) and, for a site we have marked as fixed, how many still see the problem. Each day’s secret is deleted within about a day; after that, these scrambled values can no longer be matched to any address. Cloudflare, as the network operator, handles connections the way it does for any website it serves.

We keep reports for up to 90 days, and any note for up to 30 days. After that we keep only per-site totals (how many reports a site received and whether we fixed it), and we delete those too for sites with fewer than three reports and none in 90 days, unless we fixed the problem or decided to leave the site as it is. We use reports only to find and fix problems in Blindfold’s filter lists. A fix, when we can make one, reaches everyone in a filter-list update.

Feedback from the app (only if you send it)

The app’s “Send feedback” form lets you write to us. Nothing is sent until you tap Send. Feedback contains:

  • The message you write and the topic you pick (General, Bug, Idea or Other).
  • Your email address, only if you enter one. Leave it empty if you don’t need a reply.
  • Your Blindfold version, and your system and its version (for example, iOS 26.1).

Feedback contains nothing about your browsing. It goes to HeardKit (api.heardkit.com), a feedback service run by Blindfold’s developer on Cloudflare. Like any internet connection, it reaches the service with your IP address; HeardKit does not store that address with your message. We use feedback only to read it, answer you if you gave an email address, and improve Blindfold. To help us sort messages and write replies, we may use AI tools (Cloudflare Workers AI and Anthropic’s Claude); a person reads every reply before it is sent. Replies are emailed through Freesend, our own sending service, using Amazon SES.

There is no fixed deletion date for feedback yet. We keep it while we need it to answer you and follow up on what you raised, and we try to delete messages we no longer need. You can ask us to delete your feedback at any time (see “Deleting a report or feedback” below).

Service providers

We don’t sell or share what you send us with anyone except the providers that help us run these services:

  • Cloudflare runs the site-report service (reports.getblindfold.app) and HeardKit, so it processes reports and feedback on our behalf.
  • Anthropic may process the text of feedback when we use its Claude AI to help draft a reply.
  • Amazon SES, through Freesend, delivers our email replies and promo emails.

We commit to using only providers whose contracts or terms require them to protect this information at least as carefully as this policy describes, and to use it only to provide their service to us.

Deleting a report or feedback

Write to support@getblindfold.app and we will try to delete it promptly.

  • Feedback: tell us the email address you used, or roughly when you sent it and what it said, so we can find it.
  • A site report: reports are not linked to you or to any account, so we may not be able to tell which one is yours. Tell us the site, roughly when you sent it, and any note you wrote, and we will try to find it and delete it. Reports are deleted automatically after 90 days in any case.

Analytics on this website

This website uses Abner, a cookieless, privacy-friendly analytics tool. It sets no cookies and does not track individuals across sites.

Children

Blindfold is not directed at children and does not knowingly collect information from them.

Changes

If this policy changes, we’ll update the date above and post the new version here.

Contact

Questions about your privacy: support@getblindfold.app