PRIVACY_POLICY

Account information

When you sign up, we (via our authentication provider, Clerk) collect your email address, and if you sign in with Apple or Google, the name and email those providers share with us. If you sign up with a password, Clerk stores it in hashed form — we never see or store your raw password.

Profile & learning data

Your username, chosen experience level and interests, XP, streaks, hearts, quiz and lesson history, mastery/spaced-repetition progress, badges, and placement assessment results, and the avatar you picked. All of this is stored by Convex, our database provider, and linked to your account.

Friends & social features

If you add friends in-app, we store the connection (who requested, who accepted) and enough of each friend's profile (username, XP, streak, recent activity) to display it to their friends.

Purchases & subscriptions

If you subscribe to Blackbat Pro or buy a certification pack, our payment processor (RevenueCat, on top of the App Store) shares your subscription status, product IDs, and transaction IDs with us so we can unlock premium features. We do not receive or store your card number — that's handled entirely by Apple.

Notifications

If you enable reminders, we store a push notification token and your reminder preferences (which reminders, what time) so we can send them.

We do not access your camera or photo library, location, contacts, or microphone, and we don't use any third-party analytics or crash-reporting SDK that profiles you across other apps. Profile pictures in Blackbat are chosen from a set of built-in avatar presets, not uploaded from your device.

To run the app you're using: authenticate you, save your progress, calculate streaks/XP/leaderboards, unlock premium content you've paid for, show your friends what you're up to, and send reminders you've opted into. We do not sell your personal data, and we do not use it to build advertising profiles of you.

Who we share data with, and why

• Clerk — authentication (email, name, login method)
• Convex — our database and file storage (everything listed above)
• RevenueCat & Apple's App Store — subscription and purchase processing
• Google AdMob — serves ads to free-tier users (see below)

Each of these processes data only to provide their specific service to us — none of them are permitted to use your Blackbat data for their own purposes.

Free accounts see two kinds of ads, both served by Google AdMob: a banner below some practice questions, and optional rewarded ads you can watch to skip a short cooldown. We request non-personalized ads only — we don't ask for App Tracking Transparency permission, and we don't share your Apple advertising identifier (IDFA) or any cross-app tracking data with Google or anyone else. Blackbat Pro removes ads entirely.

Non-personalized ads still involve storing and reading an identifier on your device. If you're in the EEA, the UK, or a US state with a comparable privacy law, we show you Google's consent form (via the Google User Messaging Platform) before any ad is requested, and we don't request ads unless that form has been completed. You can reopen it and change your answer at any time from Settings > Ad privacy choices.

You can permanently delete your account at any time from Profile > Delete Account — no email required. This immediately and permanently removes your profile, progress, streaks, avatar, and friend connections. We retain purchase and transaction records after deletion, as required for financial recordkeeping and fraud prevention, but these are no longer linked to an active, usable account.

While your account is open we keep your profile and learning data so the app can work — there's no fixed expiry, because streaks and mastery history are the product. Purchase and transaction records are kept for 7 years to meet tax and financial recordkeeping obligations. Push notification tokens are discarded once they stop being valid or you turn reminders off. Backups containing deleted data roll off within 30 days.

Why we're allowed to process it (GDPR Art. 6)

• Contract — your account, progress, purchases, friends and leaderboard entries: we can't provide the app you asked for without them.
• Consent — push notifications, appearing on public leaderboards, and ads consent where required. You can withdraw any of these in-app at any time, without losing access to the rest of Blackbat.
• Legitimate interests — keeping the service secure, preventing abuse and fraud, and keeping the financial records above.

International transfers

Blackbat is operated from Australia, and our providers (Clerk, Convex, RevenueCat, Google) process data on servers in the United States and other countries. Where data leaves the EEA or UK, those transfers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), which each of these providers has in place with us.

Depending on where you live, you have rights to access a copy of your data, correct it, export it in a portable form, delete it, restrict or object to certain uses of it, and withdraw any consent you've given. You can exercise most of these yourself in-app (edit your profile, change notification and leaderboard settings, delete your account); for anything else, email blackbat.terminal@gmail.com and we'll respond within 30 days.

We do not sell personal data and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of under the CCPA/CPRA on either front. We won't discriminate against you for exercising any of these rights. If you're in the EEA or UK and you think we've got something wrong, you also have the right to complain to your local data protection authority.

Blackbat is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has created an account, contact us and we'll delete it.

Data is encrypted in transit (HTTPS/TLS) between the app and our backend. Access to production data is limited to what's needed to operate the app. No system is perfectly secure, but we don't store payment card data, and we minimize what we collect in the first place.

If this policy changes materially, we'll update the effective date above. Continued use of Blackbat after a change means you accept the updated policy.