Privacy notice

Reliability Works Ltd is an active company incorporated in England and Wales under company number 16206723.

We are the controller for account, identity, billing, support, security, service operations, and service usage and plan enforcement data. For files and other content a customer places in Blob Yard, we generally act as that customer's processor or service provider. The customer decides why the content is stored and who may access it. We may act as controller for limited processing needed to secure the service, investigate abuse, or comply with law.

• Identity, sign-in, authentication, and chosen GitHub or Google OAuth details.
• Workspace, project, membership, role, invitation, and account settings.
• Stored object metadata, filenames, sizes, checksums, versions, and customer content.
• Share, upload inbox, preview, access-capability, and retention records.
• CLI, API, CI, machine-session, request, and actor-aware audit records.
• Stripe customer, subscription, invoice, plan, seat, and payment-status records.
• Email delivery, support requests, contact messages, and security reports.
• Technical and security logs, including device, browser, network, error, rate-limit, and abuse-prevention signals.
• Anonymous page-view and website performance measurements, including route, referrer, coarse location, device type, browser, operating system, and Core Web Vitals.

We receive data from you, your account or workspace administrators, other people who use upload inboxes or shares, the clients and agents you connect, the service as you use it, and providers such as Stripe, Resend, GitHub, or Google. Identity and payment details needed to create or pay for an account are contractual requirements. Choosing OAuth and providing optional profile or support information is voluntary.

We process data to provide accounts and storage, authorize uploads and downloads, operate shares and inboxes, enforce plans and retention rules, take payment, deliver messages, provide support, secure the service, investigate misuse, recover from incidents, and meet legal obligations.

Our lawful bases are performance of our contract, our legitimate interests in operating and improving a secure developer service, compliance with legal obligations, and consent where the law requires it. We balance legitimate interests against the rights and expectations of the people affected. Blob Yard does not use customer content for advertising.

We disclose data only as needed to operate Blob Yard or meet a legal duty:

• Convex provides the application database, authentication integration, and server functions.
• Cloudflare provides R2 object storage, Workers, DNS, and edge security.
• Vercel hosts the web application and provides anonymous Web Analytics and Speed Insights. Web Analytics does not use cookies or retain a visitor identity across days. Private app, capability, export, and device-activation routes are excluded from page-view analytics.
• Stripe provides payment, subscription, invoice, and customer-portal services.
• Resend delivers service and support email.
• GitHub or Google provides OAuth when you choose that sign-in method.

We may also disclose data to professional advisers, insurers, authorities, courts, or a buyer or reorganised business where lawfully necessary. We do not sell personal data.

Some providers or their support teams may process data outside the United Kingdom. Where a transfer is not covered by UK adequacy regulations, we use an appropriate lawful safeguard, such as the UK International Data Transfer Agreement or the UK addendum to approved standard contractual clauses, and carry out any assessment the law requires. Contact us for more information about the safeguard relevant to your data.

• Customer content remains until an authorised user deletes it or an active retention policy removes it. Deletion marks related records as deleted and queues active object bytes for cleanup, which may take time to finish or retry.
• Expired or revoked capabilities and sessions are kept only while needed to enforce their state, prevent abuse, resolve disputes, or preserve proportionate audit evidence.
• Account and workspace metadata is kept while the account is active, then deleted or minimised according to the account-deletion process and any continuing legal need.
• Billing, invoice, tax, fraud-prevention, and legal records are kept for the periods required by applicable law and legitimate dispute handling.
• Support, email-delivery, and security records are kept according to the issue, risk, legal limitation periods, and the need to prevent repeated abuse.
• Encrypted production metadata recovery artifacts are retained for 30 days. They do not copy R2 object bytes. Deletions may remain in a recovery artifact until that artifact expires.

Account Settings provides controls to prepare an account export and request account deletion. These processes may complete asynchronously, so deletion is not necessarily immediate. Export your data before requesting deletion if you need to keep a copy.

Account deletion does not permit one member to erase content controlled by another owner. Before deletion can start, remove other members and cancel pending invitations from every workspace you own. We may keep limited billing, tax, fraud-prevention, security, and legal records after deletion where required or justified.

Depending on the circumstances, you may ask for access, a portable copy, correction, deletion, restriction, or an objection to processing. You may withdraw consent where processing depends on consent. These rights can have legal limits, and we may need to verify your identity and authority over a workspace before acting.

Send a request to contact@reliabilityworks.co.uk. You can also complain to the Information Commissioner's Office. Please contact us first if you would like us to try to resolve the issue.

Blob Yard does not make decisions based solely on automated processing that produce legal or similarly significant effects for individuals. Automated security and abuse controls may block or flag activity, but a person can contact us to ask for review.

Blob Yard is a developer service for adults and organisations. It is not directed to anyone under 18, and a person must be at least 18 to create or control an account.

We use access controls, scoped and expiring capabilities, encryption in transit, private object storage, redacted logs, audit records, and recovery procedures. No online service can guarantee absolute security. Report a suspected vulnerability privately to contact@reliabilityworks.co.uk.

We may update this notice when the service, providers, or law changes. We will post the revised notice here, change its effective date, and give additional notice where a change materially affects your rights.