Privacy Policy

Who We Are

BlackKarat is operated by Hillstone Ventures LLC ("BlackKarat," "we," "us," or "our"). This Privacy Policy explains what information we collect when you use the BlackKarat mobile app (the "App") or our website at blackkaratapp.com (the "Site") — together, the "Services" — how we use it, and the choices you have.

Information We Collect

Account information: when you create an account in the App, we collect your first and last name, email address, password, and an assigned account ID. Our authentication provider stores password credentials in hashed form; we do not retain plaintext passwords. We also store account preferences, including notification and promotional-email settings. The Site does not have accounts.

Location and search requests: with your permission, the App accesses foreground device location to show nearby businesses, calculate distances, and display maps. Coordinates and search inputs, such as a business name, category, or selected location, are sent to our backend to fulfill searches; map providers also process information needed to deliver their maps. We do not request background location. You can deny or revoke location permission and browse using the default location or search for another location. The Site does not request device location.

App activity and approximate-location analytics: when Home loads or the App returns to the foreground after Home has loaded, the App attempts to record at most one activity record per installation per local calendar day. This record contains a random installation ID, the day, and, when signed in, your account ID. If a real location fix is available, coordinates are rounded on your device to two decimal places (approximately one kilometre) before being stored in this activity record. Otherwise, the record contains no coordinates. We use these records to count active installations and understand aggregate activity by metro, including whether a market has sufficient activity to support future sponsored placements. The installation ID persists until local app data is removed or the app is reinstalled; it is not a hardware or advertising ID. These records are pseudonymous, not necessarily anonymous, because they can be linked to an account while you are signed in. Denying location does not disable the activity record; it prevents storing device coordinates in that record.

Saved businesses: when you save a favorite, we store the business reference with your account so you can access your saved businesses later.

Content you submit in the App: if you submit a business listing, claim a business, upload photos, report an issue with a listing, or send us feedback, we collect what you provide — for example a business's contact and proof-of-ownership details, photos, or your feedback message — along with your account ID and the time of submission.

Information you send through the Site: a listing request collects the business name and location, your name, email, relationship to the business, requested action, and description of the issue. We record listing requests in our internal review queue and send a receipt; support email is a fallback if forwarding to the queue fails. An account deletion request collects your email address and optional reason. A support message collects your name, email, subject, and message. Support and deletion requests are delivered to our support mailbox. Do not include passwords, payment-card numbers, government ID documents, or other sensitive information in forms or free-text submissions.

Push notification token: if you enable notifications while signed in, we store an Expo push token and device platform tied to your account and provide the token to notification-delivery services so we can deliver messages such as submission status updates. You can disable push notifications in Profile or your device settings.

Payment information, if paid placements become available: payment is handled by Stripe on its secure checkout page. We do not receive or store your full card number. We receive identifiers and purchase, subscription, and payment-status information needed to administer the selected business placement. Paid placement sales are currently disabled.

Crash and diagnostic information: when production crash reporting is enabled, Sentry receives error reports that may include stack traces, app version, operating system and device information, a diagnostic identifier, and technical context about the error. Map and other SDK providers may also process usage, performance, location, and technical information under their provider settings and policies. Network providers receive IP addresses and request metadata needed to operate their services. We use diagnostics to investigate failures and improve reliability.

Technical data and website analytics: our hosting provider records standard server request logs, including IP address, browser user agent, and the pages requested, to deliver the Site and protect it from abuse. We also use Cloudflare Web Analytics to measure website visits, page views, referring sites, browser and device categories, and page performance. Its browser beacon does not use cookies, local storage, or browser fingerprinting to identify visitors. These aggregate website metrics are separate from the App's installation-based activity records. Network requests still expose IP addresses and request metadata to Cloudflare. The Site also loads its fonts from Google's font service, which means your browser's IP address is visible to Google when a page loads.

We do not use third-party advertising trackers or use the activity records described above for behavioral ad targeting. We do use first-party app activity analytics and technical crash diagnostics as described in this policy.

How We Use Your Information

We use your information to operate and authenticate your account; show nearby businesses and saved favorites; process submissions, claims, and reports; respond to support and listing requests; measure website traffic and performance, active installations, and aggregate metro activity; diagnose errors, maintain security, and prevent abuse; and administer purchases if paid placements become available.

We send transactional messages such as email confirmations, password resets, receipts, and moderation outcomes. We may also send promotional offers and market-availability updates when enabled. You can turn off promotional email using Profile → Offers & Updates or the unsubscribe link in those emails. Turning off promotional messages does not stop essential account or transaction messages.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

When Information Is Disclosed

We disclose information to providers that help operate the Services, including hosting, authentication, storage, email, maps, crash reporting, and notification delivery, for the purposes described here. Authorized moderators access submissions and requests for review. We may disclose information when reasonably necessary to comply with law or legal process, protect rights or safety, investigate fraud or abuse, or support a merger, acquisition, or transfer of the Services, subject to applicable law.

Approved business listing information, including business contact details, descriptions, ownership-basis sources, and photos, is public. Claim-verification details, private feedback, and support messages are not intended for public display. Business contact details may also identify an individual, including a sole proprietor; submit only information appropriate for public business use. External websites and apps you choose to open, such as a business website or directions app, handle information under their own policies.

AI-Generated Content

Some business descriptions displayed in the App are generated by an AI language model (Anthropic's Claude), based on information from the business's own public website. AI-generated descriptions are labeled internally as such, but we do not independently verify every detail of AI-generated text for accuracy. If you are a business owner and believe your listing's description is inaccurate, you can claim your business to correct it, or contact us.

How Business Listing Data Is Sourced

Business listings are compiled from publicly available sources, including Google's Places API and other publicly available business data, supplemented by user submissions and owner claims. This data may include business names, addresses, hours, ratings, photos, and reviews as made publicly available by those sources. Businesses named on the Site are drawn from that same directory.

Third-Party Services

We rely on the following third-party services to operate the Services. Each is bound by its own privacy policy, which we encourage you to review:

• Supabase — authentication, database, photo storage, and backend hosting.
• Cloudflare — hosts the Site and processes its request logs.
• Apple Maps, Mapbox, and Google Maps Platform / Places API — platform-dependent maps, business location data, and place details.
• Sentry — production crash and error diagnostics.
• Google Fonts — serves the typefaces used on the Site.
• Anthropic (Claude) — generates certain business descriptions from public website content.
• Resend — delivers our transactional and support email.
• Stripe — processes payments for promotional placement.
• Expo, Apple, and Google — registration and delivery of push notifications.

Data Retention

We retain account information while your account is active, and submissions, claims, reports, and feedback while needed to administer the directory and moderation process. Public business listings may remain after account deletion. Support messages, website requests, email-delivery records, diagnostics, backups, and any payment or legal-compliance records are retained according to their operational purpose, provider retention settings, and applicable legal requirements.

Daily installation/activity records, including rounded coordinates when available, currently have no fixed automatic expiry. Account deletion removes their account association but does not erase their installation ID, day, or rounded coordinates. We do not describe those remaining records as fully anonymous. We retain them to measure aggregate market activity. We do not promise that deleting an account immediately removes every copy from provider logs, backups, support correspondence, or published business content.

Account Deletion

You may delete your account from Profile → Delete Account, by emailing support@blackkaratapp.com, or via our account deletion form. Deleting an account removes its authentication record, profile, favorites, push tokens, and account-linked feedback and moderation submissions. It is permanent. Published business listings and photos can remain; deleting an account does not itself remove a public listing or business contact details. Use our listing request form for corrections or removal.

Activity records lose their account ID but retain the information explained under Data Retention. Support and website-request records and legally required records may also remain. We may verify a requester's identity or authority before acting on an email or web request. Contact us about any additional personal-data deletion request; any rights available under applicable law remain in effect.

Your Privacy Rights

Depending on your residence and whether a particular law applies to us, you may have rights to access, correct, delete, or obtain a portable copy of your personal information, and to appeal a decision on a request. We do not sell personal information or share it for cross-context behavioral advertising. To exercise applicable rights, contact support@blackkaratapp.com. We may need to verify your identity or an authorized agent's authority. We aim to respond within 30 days and will comply with applicable deadlines and any permitted extensions. We will not discriminate against you for exercising legally protected rights.

The Services are intended for a United States launch. Our providers may process information in the United States or other countries where they operate, which may have different data-protection laws. This policy does not waive any mandatory rights or authorize collection or use that requires additional consent under applicable law.

Data Security

We use industry-standard safeguards, including encryption in transit and access controls on our backend, to protect your information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Children's Privacy

BlackKarat is not directed at, and may not be used by, children under the age of 13. An app-store content rating does not change this minimum age in our Terms. We do not knowingly collect personal information from children under 13. If we learn that we have done so, we will take steps to delete it. If you believe a child under 13 has provided us with personal information, please contact us.

Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. We will update the date above and provide notice of material changes through the Services or by email. Where applicable law requires consent for a new use of information, we will obtain it; continued use alone does not replace required consent.

Contact Us

Questions about this Privacy Policy or your data? Contact us at: support@blackkaratapp.com