Blasts & Deals — Privacy Policy

Screen Alerts + Local Savings · Chrome & Edge Extension · v12.0.18

1. What This Extension Does

Blasts & Deals is a lightweight browser extension that delivers two things directly to your screen:

Screen Blasts — A person reaches you by an accepted Invite Code, tapping Add for an organization, a colleague at the same verified company whose company turned on automatic approval, an introduction by another Blasts user, or a SNAP alert from the directory. You can block or revoke the person who introduced you. You can stop anyone who reached you with an Invite Code (Settings, People who can message me). A colleague at your company can be cut off in the browser extension. These alerts include delivery notifications, appointment reminders, account updates, and other announcements.
Savings Sites Deals (Blasts & Deals edition) — Local deals, coupons, and savings from businesses near you, browsable on your own schedule.

A person reaches you by an accepted Invite Code, tapping Add for an organization, a colleague at the same verified company whose company turned on automatic approval, an introduction by another Blasts user, or a SNAP alert from the directory. You can block or revoke the person who introduced you. You can stop anyone who reached you with an Invite Code (Settings, People who can message me). A colleague at your company can be cut off in the browser extension. This extension does NOT perform any B2B prospecting, lead generation, data scraping, or contact enrichment. It delivers screen alerts and local deals — not a sales-intelligence tool.

2. Data We Collect

We do not collect, store, or transmit your browsing data for advertising or lead generation. The extension does not scrape the websites you visit, does not inject scripts into LinkedIn or Gmail, and does not monitor your browsing for prospecting.

To display a Blast on whatever page you happen to be viewing, the extension shows a small on-screen alert surface. That surface only renders the Blasts sent to you — it does not read, collect, or transmit the content of the pages you visit. Optional CRM page helpers (Salesforce/HubSpot) only add a "log this Blast" action on your own CRM record pages when you choose; they do not read or export your CRM's contact data.

3. What Runs Automatically

Inbox polling — The extension periodically checks for new Screen Blasts sent to you. This communicates only with the Blasts delivery servers.
Badge notifications — When new alerts arrive, a badge count appears on the extension icon. No popup ads or intrusive notifications.
FIND ME relay — Optional. It can copy a Screen Blast to your own email, phone, or webhook so you notice it. The switch starts on, and nothing is copied until you add a destination. You choose the destinations.

4. What Runs Only When You Act

Opening the side panel — Shows your Blasts inbox or Savings Sites Deals. No data is collected from the page you are viewing.
Browsing deals — Loads available local deals. Your ZIP code (city/zip level) is used to pick the local directory and sort nearby businesses. No precise GPS tracking.
SNAP alerts — If you turn SNAP on (per category, subcategory, or business), the extension stores those choices on your device and syncs them to Savings Sites servers so matching local businesses can send you deal alerts. You can turn SNAP off at any time.
Deals sign-in — Claiming deals, saving SNAP choices, or using Free $5 may sign you in with your existing Blasts account, or with an email code. A short-lived sign-in token (about 30 days) stays on this device only.
Sending a Blast — Message content is transmitted through the Blasts delivery network. A person reaches you by an accepted Invite Code, tapping Add for an organization, a colleague at the same verified company whose company turned on automatic approval, an introduction by another Blasts user, or a SNAP alert from the directory. You can block or revoke the person who introduced you. You can stop anyone who reached you with an Invite Code (Settings, People who can message me). A colleague at your company can be cut off in the browser extension.
Voice messages and voice-to-text. If you press Record in the browser extension, your browser asks to use your microphone. Recording stops when you press Stop or after 3 minutes. The clip is encrypted on your computer before it is sent, with keys that stay on the two devices, so our servers keep only an encrypted file that we cannot play. A voice message goes to one person you are connected with. Each account can send one voice message a month. The voice slot is free (one a month). The send also counts as a text Blast, at the normal text price. The phone app can record and play voice messages. A voice message you send from the phone is encrypted on the phone before it is sent. On the phone, microphone permission is requested when you record a voice message or use voice-to-text.
Managing subscriptions — Block senders, unsubscribe, or set quiet hours at any time.
Connecting to M365 Cockpit (optional, office users) — If you also run our M365 Cockpit desktop add-in on the same PC, the extension can check whether Cockpit is running by calling http://localhost on your own computer, and can connect to it with one click after you approve a 6-character code shown inside Cockpit. The connection token is stored encrypted on your device. Nothing about this leaves your PC, and the extension works without Cockpit.

Copying a Screen Blast into your own Gmail. That copy is FIND ME. It does not decide who may message you.

Who may send to you: A person reaches you by an accepted Invite Code, tapping Add for an organization, a colleague at the same verified company whose company turned on automatic approval, an introduction by another Blasts user, or a SNAP alert from the directory. You can block or revoke the person who introduced you. You can stop anyone who reached you with an Invite Code (Settings, People who can message me). A colleague at your company can be cut off in the browser extension. Following an organization is a separate choice, described in Newsletters & Organizations, and does not use an Invite Code.
A copy in your Gmail (gmail.insert): If you connect Gmail under FIND ME, that connection adds the Gmail address as a FIND ME e-mail destination and turns FIND ME on (unless your destination list is full), and the Blasts server keeps the sign-in token Google gives us. The Blasts server places a copy, or for an encrypted or voice Blast a notice that one arrived, in your own Gmail. The extension does not place that copy. The default is All senders: every sender who can message you can trigger that copy. Choose Selected senders only to narrow it. Disconnect removes our copy of the token and stops the Gmail insert. Copies to that address then keep arriving as ordinary Blasts e-mail, which uses Blasts Credits, until you remove that destination or turn FIND ME off. When the amount due is more than your balance, you get no copy. To cancel the grant at Google, remove Blasts in your Google account permissions.
A spam filter (gmail.settings.basic): This is a different setting. It creates one "never send to Spam" filter through the Whitelist Emails wizard linked from a sender's email. It does not copy a Blast into Gmail.

These two Gmail permissions never read your existing email and never send email.

5. Data Storage

Account credentials — By default stored only in chrome.storage.local on your device (encrypted at rest; not synced to any cloud). Optional cloud sync (off by default): if you turn on "Sync sending accounts to secure cloud for mobile portal access" in the extension, the sending credentials for your bulk Email and Text Blasts — OAuth refresh tokens, provider/CPaaS API keys, and any bring-your-own OAuth client ID/secret — are transmitted over TLS and re-encrypted at rest on our servers using AES-256-GCM envelope encryption. They are decrypted only in memory during an active campaign send, are never exposed through any read interface, and are used solely to send your own campaigns from the online portal. You can erase the cloud copy at any time by turning the toggle off.
Preferences — UI/notification settings in chrome.storage.sync. Display preferences only — no sensitive data.
Cached Blasts — Recently received alerts cached locally for offline viewing; pruned over time.
Keys you provide — Optional AI and CRM keys you paste for those features stay on this computer. They are not sent to us.
FIND ME carrier keys — Optional. If this computer is registered to a Blasts account and you press Save carrier keys, the extension sends the keys you typed to the Blasts server: an AWS SES access key id and secret, a Twilio Account SID and auth token, and a Telnyx API key, plus the from-address or from-number you typed. The server keeps them on your account so it can ring your phone or inbox through your own carrier. The program does not encrypt those keys before it saves them. The secret text is not shown in the extension again after it is saved. The keys stay until you delete the Blasts account. Turning FIND ME off stops new copies and leaves the keys in place. Clearing the boxes and saving again does not remove a key that was already saved. If this computer is not registered to a Blasts account, or you never press Save carrier keys, those keys are not sent. If you connect Gmail or Outlook under FIND ME, that connection adds the address as a FIND ME e-mail destination, and the Blasts server keeps the sign-in token Google or Microsoft gives us so it can place a copy, or for an encrypted or voice Blast a notice that one arrived, in your own inbox. The program does not encrypt that token before it saves it. Disconnect removes our copy of the token and stops the Gmail insert. Copies to that address then keep arriving as ordinary Blasts e-mail, which uses Blasts Credits, until you remove that destination or turn FIND ME off. When the amount due is more than your balance, you get no copy. Deleting your Blasts account removes the token too. To cancel the grant at Google, remove Blasts in your Google account permissions.
Hard-bounce suppression list — When Email Blasts detects a hard bounce (a permanent delivery failure, such as an address that no longer exists), the bounced email address and the bounce reason are automatically reported to our servers to maintain a shared suppression list, so undeliverable addresses are removed from future campaigns and data downloads. No message content, no recipient identity beyond the dead address itself, and no information identifying you as the sender are transmitted.
Voice messages we hold. A voice message you send to a person is stored on our servers as an encrypted file in the receiver's inbox. It stops showing in the inbox no later than 30 days after it is sent. We do not yet delete the stored copy automatically at 30 days. The receiver can delete it at any time with Dismiss. Deleting an account deletes everything in that account's inbox, voice messages included. A voice message you sent stays in the receiver's inbox until they dismiss it or delete their own account.
Saved voice clips. Optional. If you press Save to mailbox on a clip in the browser extension, the playable clip is kept in this browser on this computer, up to 40 clips, until you delete it. It is not sent to us.

6. What This Extension Does NOT Do

Does NOT scrape websites or collect browsing data for lead generation
Does NOT inject scripts into LinkedIn, Gmail, or arbitrary sites for data harvesting
Does NOT perform B2B lead generation or prospecting
Does NOT enrich, harvest, or buy contact data via Apollo, Hunter, ZoomInfo, or similar prospecting APIs
Does NOT read your email, messages, or form inputs, with one opt-in exception: if you turn on bounce scanning for a sending mailbox you connected, the extension reads that mailbox for delivery-failure notices so it can stop mailing bad addresses.
Does NOT sell your data to anyone

7. Third-Party Services

The extension contacts the Blasts service for its core function. The following are optional and are only contacted when you enable a feature or connect an account with your own credentials:

Blasts delivery network — Sending and receiving Screen Blasts (operated by Tips Marketing Services, Corp).
Savings Sites servers — Loading local deals and coupons; recording deal claims, Free $5 credits, and referral rewards when you are signed in; and (only if you turn SNAP on) storing your SNAP alert preferences so businesses can reach you. Sign-in uses a token kept on your device.
Your own email provider — Google Workspace / Gmail and Microsoft 365, via OAuth, so you can send Blasts from your mailbox and, if you connect Gmail under FIND ME, the Blasts server can place a copy, or for an encrypted or voice Blast a notice that one arrived, into your own inbox.
Your own CRM — Salesforce, HubSpot, Pipedrive, and others — to log Blast engagement when you connect one, using credentials you provide.
OpenAI (optional) — Help composing a Blast, and turning a voice message you send to a person into text when you press Transcribe, only if you add your own API key. That clip is sent from your computer to OpenAI. Our servers are not part of that step. This does not cover the Phone voicemail drop.
Your own AI key (optional) — If you press Summarize on newsletters, the text of the notes you selected is sent from your device to the AI company you chose: Google, OpenAI, or Anthropic. Our servers are not part of that step.
Phone writing help and voice-to-text (optional) — Writing help sends the words you typed from your phone to the AI company you chose: OpenAI, Google (Gemini), or Anthropic (Claude). Voice-to-text sends that recording from your phone to OpenAI or Gemini. You use your own key. Savings Sites never receives that text or that recording.
Typing indicators (optional, off unless you turn them on). If you and the other person both turn on typing indicators, your phone tells our server only whether you are typing in that one chat. The server keeps that on/off signal for a few seconds. It never receives what you type. You can turn this off in Settings at any time.
Link previews (optional, off unless you turn them on). If you turn on link previews and send a message with a link you typed, your phone sends that web address to our server. The server reads the page's title and short description and adds them to your message. That web address is not end-to-end encrypted on its way to our server. The server keeps the title and description for up to 6 hours so it does not fetch the same page twice, and it does not keep the page itself. The people you message do not load anything from that site.
DeepL (optional) — Translating a Blast, only if you add your own API key.
DNS-over-HTTPS (Google / Cloudflare) — Verifying a recipient's email domain is a genuine Google/Microsoft workspace during pairing.
Internet Archive (optional) — Saving a public snapshot of a Blast you sent, for your records.
Twilio or Telnyx (optional) — If you save your own Twilio Account SID and auth token, or a Telnyx API key, under FIND ME, texts and calls go through that account and that company bills you. If you do not, FIND ME uses Blasts Credits.
Phone voicemail drop (optional, beta) — If you send a clip to a phone number through your own Twilio account, the clip is converted to ordinary audio and stored on our servers so Twilio can play it. This feature is not end-to-end encrypted. The play link lasts 25 minutes. We do not yet delete the stored audio file on a schedule.
Stripe — Payment processing for licensing and credits.

None of these are advertising or analytics networks. We use no third-party trackers.

8. Permissions Explained

sidePanel — Display the Blasts inbox, composer, and Deals browser in the browser side panel.
storage, unlimitedStorage — Save your preferences, approved-sender list, cached Blasts, and any keys you provide (encrypted); unlimited supports long Blast history offline.
alarms — Periodic inbox polling and scheduled delivery.
notifications — Desktop alerts when Blasts arrive (if enabled).
activeTab — Used only when you take an action on the current tab (e.g., capture a selection to send as a Blast).
tabs — Open/focus the secure pairing ("connect") page and the side panel.
scripting — Render the on-screen Blast alert surface and the optional CRM "log this Blast" helper.
identity — Google/Microsoft sign-in (OAuth) so you can send from your own mailbox. Gmail features may request gmail.insert (a copy, or for an encrypted or voice Blast a notice, that the Blasts server places in your Gmail) and gmail.settings.basic (a never-send-to-Spam filter); see Section 9.
contextMenus — Right-click "Send as Blast".
nativeMessaging — Optional license check (reads a stable machine ID) only if you install our desktop helper. The extension works without it.
http://localhost/* (optional) — Requested only at the moment you click Connect to M365 Cockpit, so the extension can talk to the Cockpit add-in running on your own PC. Never requested at install; the extension works without it.
offscreen — Runs a local analytics database of your own send history, entirely on your device.
Microphone — Asked for by the browser only when you press Record in the browser extension. Not requested at install. The phone app asks for the microphone when you record a voice message or use voice-to-text. It does not ask at install.

Network/API access is limited to the specific services listed in Section 7. The optional "all sites" permission is not requested at install — it is requested only at the moment you add a custom delivery webhook, on a per-site basis.

9. Google API Services — Restricted Scope Disclosure & Limited Use

When you connect a Google account, and only for the optional features you explicitly enable, the Blasts server starts the Google consent for these Gmail scopes. The extension only opens the server's link:

https://www.googleapis.com/auth/gmail.insert — used solely so the Blasts server can place a copy, or for an encrypted or voice Blast a notice that one arrived, into your own Gmail inbox after you connect Gmail under FIND ME. The default is every sender who can message you, until you choose Selected senders only. It is never used to read, modify, send, or delete any of your other email.
https://www.googleapis.com/auth/gmail.settings.basic — used solely to create, at your explicit request, a single Gmail filter that keeps a chosen sender's mail out of Spam (a "never send to Spam" / safe-list filter). It is not used to change any other Gmail setting.

If you connect Gmail or Outlook under FIND ME, that connection adds the address as a FIND ME e-mail destination, and the Blasts server keeps the sign-in token Google or Microsoft gives us so it can place a copy, or for an encrypted or voice Blast a notice that one arrived, in your own inbox. The program does not encrypt that token before it saves it. Disconnect removes our copy of the token and stops the Gmail insert. Copies to that address then keep arriving as ordinary Blasts e-mail, which uses Blasts Credits, until you remove that destination or turn FIND ME off. When the amount due is more than your balance, you get no copy. Deleting your Blasts account removes the token too. To cancel the grant at Google, remove Blasts in your Google account permissions.

Blasts & Deals' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is used only to provide or improve these user-facing features.
We do not sell Google user data, and do not use or transfer it for advertising, profiling, or creditworthiness.
We do not transfer Google user data to third parties except as needed to provide the feature you enabled, to comply with law, or as part of a merger/acquisition with notice.
We do not allow humans to read your Google user data, except: with your explicit consent (e.g., support you request), where required for security or to comply with applicable law, or where the data has been aggregated and anonymized.

This extension's use of information received from Chrome APIs also adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.

10. No Tracking

This extension contains no analytics, no telemetry, and no tracking pixels. We do not collect usage data. There are no calls to Google Analytics, Mixpanel, Segment, or any other analytics service from extension code. It does not include an advertising SDK. A paid summary of an organization note can include one partner offer under the summary. The offer is chosen from the account type and the ZIP code on the profile. Device location is not used to choose it.

10a. Blasts Deals Mobile App (Android & iOS)

The Blasts Deals mobile app is the phone companion to this product. Everything above applies equally to the app; the following covers what is specific to mobile:

Account email — Collected to create and operate your Blasts inbox (the Screen Blasts inbox described above). Required for the app to function.
Messages (Screen Blasts) — Message text between people is end-to-end encrypted on your device before upload, except a web address you choose to preview (see Link previews). For that text we store ciphertext. Polls are not private from the Blasts service. The sender of a named poll sees the email address and the answer. A photo attached to a Screen Blast is also readable by our servers. A local, readable copy of blasts you send stays on your own phone (your Sent box). Messages from an organization you follow are delivered by our servers and are not end-to-end encrypted. See Newsletters & Organizations.
Location (optional, two ways) — The app uses device location to show you what is nearby, and that device location goes only to our own servers. Deals: if you grant the location permission, your device position — rounded to roughly a one-kilometer area before it leaves your phone — is used to sort nearby deals by distance. Fun (local events): you type a ZIP code, and that ZIP is sent to our servers to look up events in that area; it is a ZIP you chose to enter, not a reading from your device. In both cases location is used at the moment you browse; it is not tracked in the background, not stored as a location history, never used for advertising, and device location is never sold or shared with third parties. The ZIP code you give an organization when you tap Add is a separate choice, described in Newsletters & Organizations. Deny the permission and the app still works — Deals simply won't sort by distance.
Sign-in approvals (LoginBlasts) — The Approvals tab lets connected companies ask you to approve a sign-in on your phone. When a request arrives and when you approve or decline it, we record the decision with the request's network address and device details so you can see who is really using your seats. Approving shares only a pseudonymous, per-company identifier with that company — never your email address.
Push notifications (optional) — If you allow notifications, the app registers a push token (Google Firebase Cloud Messaging on Android; Apple Push Notification service on iOS) with our servers so we can notify you when a new Blast arrives. For a message between people, the notification contains only the sender's email address — never message content. A message from an organization you follow does not ring the phone. Deleting your account or declining the permission removes or avoids the token.
On-device security — Your session, encryption keys, invite codes, and saved contacts are stored in hardware-backed secure storage (Android Keystore / iOS Keychain) on your phone.
Contacts — When you invite a friend, the app opens your phone's own contact picker. It does not ask to read your whole address book, and it does not upload your address book. The email address you pick is sent to our server once to create that person's personal Invite Code. The name stays on your phone. The invitation letter itself goes out through your own email app.
Photos — If you add a photo to a Blast or to your profile, the app removes the camera's location data before the photo is uploaded. Your message text stays end-to-end encrypted, except a web address you choose to preview (see Link previews). Photos are stored on our servers as private links and are not end-to-end encrypted. A profile photo is shown to a person connected with you in either direction, and it stays until you remove it or delete your account. A profile photo can be reported. A photo attached to a Screen Blast lasts 90 days. It is deleted when someone requests that link after it has expired. Deleting the account does not remove that Blast photo. A Fun event photo can be hidden on this phone. A photo inside a Blast does not have a report button.
Account deletion — Available in-app (Settings tab → "Delete my account permanently") or on the web at blasts.app/delete-account.html. Deletion permanently erases your account, inbox, organization memberships, invite codes, connect ID, and push tokens from our servers.
No analytics SDKs — The mobile app contains no advertising or analytics frameworks. A paid summary of an organization note can show one partner offer, chosen from the account type and the ZIP code on the profile. Device location is not used to choose that offer.

10b. Newsletters & Organizations

You can follow organizations in Blasts, in the phone app and in the browser extension: a local newsletter, a church, a club, a chamber, a city office, or a business. Following is your choice. Nothing about you goes to an organization until you tap Add. Organizations are added over time. Until one is added, you will not see the row.

What the organization sees. When you tap Add, the organization can see your name, the ZIP code shown on the card, and the date you joined. It does not see your email address, phone number, or street address. Your name is the name on your Blasts profile. If that name cannot be used, the organization sees "No name on file." You can change the ZIP code on the card before you tap Add. We do not check that the ZIP code is where you live. If you have already changed that ZIP code several times in one day, a later change may leave the earlier ZIP code in place. Looking through the list does not give an organization your name. A ZIP code you type so the list can show organizations near you is used for that list and is not saved as a membership until you tap Add.

What we keep. We keep that membership on our servers so the organization can message you and see its list. We do not charge you for following. If the organization has saved a welcome message, that message can arrive in your inbox after you tap Add. You do not tap a separate button for the welcome message.

Messages. Their messages arrive in your Screen Blasts inbox with the organization's name and logo. We store the text on our servers so we can deliver it. These messages are not end-to-end encrypted. Dismissing a message deletes that copy. Deleting your account deletes the inbox, including these messages. We do not delete them on a fixed schedule. These messages do not ring your phone. In the browser extension these messages add to your unread count. They do not pop up as notifications. They do not include a sponsor message in the note. A paid summary of that note can show one partner offer under the summary, chosen from the account type and the ZIP code on the profile.

Leave, Hide, and Report. Leave takes you off that organization's list when the request succeeds, and it can no longer message you. Leave does not take back the name and ZIP code the organization already saw. Messages from an organization stop showing in your inbox 30 days after they are sent. We do not yet delete the stored copy automatically at 30 days. Dismissing a message that still shows deletes it. Deleting your account deletes all of them. An organization can remove you and block you from joining again. It does not have to tell you. That block lasts until you delete your account. Hide removes that organization's circle on this device. Messages from that organization still arrive until you leave. The organization is not told. Report lets you send us a note about an organization. The note does not include your email address. We do not tell the organization who sent the report. A report we have closed is kept for 365 days. An open report is not deleted on a schedule.

Pictures. An organization gives us its logo, and we approve the name, category, area, and logo before readers see the organization. The logo is shown from our server.

What joining shows. Joining an organization in Faith & Spirituality, News & Politics, Health & Wellness, or Nonprofit & Advocacy tells that organization your name and ZIP code, and that you chose that kind of group. We do not collect a separate beliefs or health field. The terms say you must be 18. We do not check your age when you tap Add.

Organizations are independent. They are not our employees. Approving a name and a logo is not a review or an endorsement of what they send. We may remove an organization at any time.

11. Contact

For privacy questions, contact support@blasts.app

Website: blasts.app

Publisher: Tips Marketing Services, Corp

Last updated: November 4, 2026 · Phone microphone, writing help, voice-to-text, typing indicators, and link previews