Privacy Policy

1. Data controller

Tomas Cikanauskas, sole trader — 31 avenue George V, 06000 Nice, France. SIREN 850 393 976.
Contact for any data-related question: contact@blackboxapp.fr.

2. Data processed

• Account: email address, nickname, technical account identifier.
• Team life: teams joined, role (manager, sheriff, treasurer), penalties received or handed out, payments declared and confirmed, balances, seasons. This data is visible to the other members of your team — that is the whole point of the Service.
• Notifications: technical push notification token (Expo/Apple/Google) and your notification preferences.
• Purchases: if you buy the Season Pass, the transaction identifier passed on by Apple or Google, the product purchased, the amount and currency, the purchase and expiry dates, and the team and season concerned.
• Technical data: connection logs, device model and app version, error and crash reports (via Sentry).
• Feedback: if you use "Report a bug" or "Suggest an improvement", the form is opened on Tally with your technical account identifier, those of your team and season, the app version and your platform, so the problem can be reproduced. Neither your name nor your email is sent automatically; the content of the message is what you write.
• Camera: camera access is used solely to scan invitation QR codes, locally on your device. No image is stored or transmitted.
• Audience measurement: anonymous statistics on the sign-up journey (via PostHog) — steps completed (screen viewed, code verified, team created or joined), with no email, no nickname, no team name and no identifying data. These events cannot identify you and are used solely to improve the sign-up journey.

Blackbox processes no payment card data. Payments between team members happen outside the app. The Season Pass is paid to Apple or Google: they alone see your payment method, and the publisher only receives the purchase confirmation (product, amount, transaction identifier). No data is sold or used for advertising purposes. The app contains no advertising tracker and no third-party cookie, and does not track your activity outside Blackbox.

3. Purposes and legal bases

4. Recipients and processors

Your data is accessible to the members of your team (team life data only) and to the following processors, who act on the publisher's instructions (art. 28 GDPR):

• Supabase — database hosting and authentication. Data stored in Frankfurt, Germany (eu-central-1), in the European Union.
• Expo (EAS) — distribution of app updates and delivery of push notifications.
• Sentry — collection of error and crash reports.
• RevenueCat — in-app purchase management: receives your technical account identifier, those of the team and season concerned, and the transaction information passed on by the store. Receives no payment card data.
• Tally — hosting of the bug report and suggestion form, for the data described in section 2 only.
• PostHog — anonymous audience measurement of the sign-up journey (section 2), on its European infrastructure (PostHog Cloud EU). Receives no identifying data.
• Apple (Apple Distribution International Limited, Ireland, for the European Economic Area) and Google — app distribution, delivery of push notifications to your device and collection of the Season Pass payment. For that payment, Apple and Google act as independent data controllers and not as processors of the publisher: their own privacy policies apply.

No data is passed on to third parties for commercial or advertising purposes.

5. Transfers outside the European Union

Where data is transferred outside the European Union, those transfers are covered by appropriate safeguards: the EU–US adequacy decision (Data Privacy Framework) where the provider is certified under it, or the European Commission's standard contractual clauses (art. 46 GDPR). Provider by provider:

• Supabase — data stored in Frankfurt (Germany), in the European Union. As the company is American, any support access from the United States remains covered by the standard contractual clauses of its data processing agreement.
• Sentry — data hosted in the European Union (Sentry EU region).
• PostHog — data hosted in the European Union (PostHog Cloud EU, Frankfurt, Germany).
• Tally — company established in Belgium: data stays in the European Union, no international transfer takes place.
• Expo (650 Industries, Inc., United States) — self-certified with the Department of Commerce under the EU-U.S. Data Privacy Framework. Standard contractual clauses apply in addition.
• RevenueCat, Inc. (United States) — not certified under the Data Privacy Framework. Transfers are covered by the European Commission's standard contractual clauses, included in its data processing agreement.
• Apple — for people located in the European Economic Area, data is under the responsibility of Apple Distribution International Limited, established in Ireland. Apple's transfers to the United States are covered by the standard contractual clauses.
• Google LLC (United States) — certified under the EU-U.S. Data Privacy Framework, with standard contractual clauses in addition.

Statuses checked on 1 August 2026. As a certification can change, the official list of participating companies is available at dataprivacyframework.gov/list.

6. Retention periods

• Account data: for as long as the account is active, then deleted within 30 days of account deletion.
• Team life data: for the lifetime of the team. When you delete your account, your data is deleted or anonymised; the team's accounting entries (penalties, payments) may be kept in anonymised form to preserve the consistency of balances.
• Notification tokens: revoked as soon as you sign out or turn notifications off.
• Season Pass purchase data: for the validity period of the pass, then kept as accounting evidence for 10 years (art. L.123-22 of the French Commercial Code).
• Technical logs and crash reports: 90 days maximum.
• Anonymous sign-up journey statistics: 25 months maximum.
• Reports and suggestions: kept while the request is being handled, then 12 months maximum.
• Notifications archived in the app: purged automatically after their display period.

7. Security

• Passwordless sign-in with a one-time code sent by email — no password is stored.
• Session stored in the phone's secure enclave (iOS Keychain / Android Keystore), not in clear text.
• Encrypted traffic (HTTPS/TLS) and data partitioned by team at the database level (row-level access rules).
• Access to production data restricted and logged.

In the event of a data breach likely to create a risk to your rights, the CNIL will be notified within 72 hours and you will be informed in accordance with articles 33 and 34 of the GDPR.

8. Your rights

You have the following rights over your data (art. 15 to 22 GDPR):

• Access: obtain a copy of your data.
• Rectification: correct inaccurate data (your nickname can be changed directly in the app).
• Erasure: delete your account and your data, directly in the app or on request to contact@blackboxapp.fr. Purchase data kept under a legal obligation (section 6) cannot be erased before the end of its retention period.
• Portability: receive your data in a structured, machine-readable format.
• Objection and restriction: object to processing based on legitimate interest, or request its restriction.
• Withdrawal of consent: turn push notifications off at any time, with no effect on the rest of the Service.
• Post-mortem directives: set directives on what happens to your data after your death (French Data Protection Act, art. 85).

To exercise these rights: contact@blackboxapp.fr. Answer within one month at most. If you believe your rights are not being respected, you can lodge a complaint with the CNIL: cnil.fr/fr/plaintes.

9. Minors

The Service is open to players from the age of 15, the age of digital consent in France. For members under 15, signing up requires the joint consent of the minor and of a holder of parental authority. A manager who invites minors into their team is responsible for making sure that consent has been given.

10. Changes to this policy

This policy may change along with the Service or with regulations. In the event of a substantial change (new purpose, new recipient), you will be informed in the app or by email before it takes effect. The date of the last update is shown at the top of this page.

11. Language

This English version is provided for convenience. In the event of any discrepancy, the French version of this policy prevails.