Privacy policy

The app has no accounts, no sign-in and no forms. It never uses the camera or the microphone, and it does not read contacts, photos or any other file on the tablet.

To show the right ads and to keep them working, the tablet sends us: a pairing token we issued to that tablet, its model, the app version, the screen size, and a count of how many times each slide was shown and for how long.

While the slideshow is running, the app can note roughly where the tablet is — rounded to about 100 metres before anything is stored — every few minutes, and send those readings with the slide counts. The driver sees which parts of town riders scan in, and an advertiser sees which areas their slide ran in.

The tablet asks the driver before it starts, and the driver can switch it off at any time in the app's settings. Readings are taken only while slides are on screen: never in the background, never when the car is off, and never when the app is closed. A reading says where a screen was, not who was in the car — nothing about a rider is recorded with it, and we do not try to work out who a rider is.

We keep these readings for 90 days and then delete them. A driver who removes a tablet removes its readings with it.

A driver signs in with an email address and a one-time code. We store the email, the name the driver chooses to show riders, their time zone, and everything they create: ads, pictures and videos they upload, store pages and their affiliate links.

Sign-in codes are sent by Postmark, our email provider. We do not use the address for anything else.

Scanning is optional and needs no account. When a QR code is scanned we record the time, which ad and which tablet it was, the country our CDN reports, the browser's user agent, and a salted one-way hash of the IP address — the address itself is never stored. The hash lets a driver see that two scans came from the same phone during a ride; it cannot be turned back into an address and is not shared.

The pages a rider lands on set no cookies, run no analytics and do not track anyone across other websites.

Many ads lead to a merchant such as Amazon or Ticketmaster, and the driver may earn a commission. Those links carry the driver's affiliate tag. Once a rider leaves for the merchant's site, that company's own privacy policy applies; we receive no purchase details, only whether the button was pressed.

Nobody buys or receives this data. We use a small number of providers to run the service: a server host, Postmark for sign-in emails, Google Safe Browsing to check that ad links are not malicious, and Ticketmaster's public event API when a driver turns on event slides. Each sees only what it needs to do that job.

To have your BlumeTab account and everything in it deleted, email support@blumetab.com from the address you sign in with, with the subject “Delete my account”. No form and no phone call: we reply to confirm and delete within 30 days.

What is deleted: the account and its email address, the name shown to riders, every ad with the pictures and videos uploaded for it, the driver's store pages and affiliate links, the paired tablets and their tokens, and the impression and scan records belonging to that account, including the salted IP hashes.

What is kept, and for how long: encrypted database backups hold the data for up to 30 more days before they expire on their own. Records we must keep by law, such as an affiliate network's own commission records, are held by that company under its policy, not by us — we hold no payment data at all.

A driver can also delete any single ad from the dashboard at any time; that deletes its pictures and videos with it. Deleting the app from a tablet stops it collecting anything further, and removing the tablet in the dashboard revokes its token.

The service is for rideshare drivers and is not directed to children under 13.

If this policy changes we update this page and the date above. Questions: support@blumetab.com. The service is operated from the United States at blumetab.com.