Privacy policy

Who is responsible

BX2 Invest AS is the controller of personal data in Black Book. Northflow Technologies AS develops and operates the service on behalf of BX2 Invest AS, and is the processor.

Questions about privacy can be sent to hjelp@blackbook.no.

Your conversations

Messages and photos are encrypted on your phone before they are sent, with keys that only exist on your phone and the recipient's. We cannot read them.

An encrypted message stays on the server only until the recipient picks it up, for at most 14 days, and is then deleted. Encrypted photos are deleted after at most 14 days. The server sees which ID a message is for, but not who sent it.

Your account

So that you can sign in and be reached by others, we store:

• Your ID and the alias you chose
• Public keys others need to send you encrypted messages
• A verification value derived from your password. The password itself never leaves your phone
• When the account was last active, if you have turned on automatic deletion, and whether the account is paused

We do not ask for your name, phone number, email address or contacts.

Nearby

If you use the public space, we also store:

• Your profile: alias, photo and the text you write about yourself
• Your location, roughly rounded. It is never shared, others only see rough distance
• Posts, stories, comments, likes, hearts and who you have blocked
• Reports you send or that concern you, and what moderators did about them

Posts and stories disappear when the time you chose is up. Photos are cleaned of location and other metadata on the phone and again on the server.

The waiting list

If you join the waiting list, we store your email address, the language you chose and when you signed up. We only use it to tell you when Black Book is out, and delete the list once that is done. You can ask to be removed at any time.

Why we are allowed to

• Our agreement with you: to deliver messages, keep your account and show your content in Nearby (GDPR Article 6(1)(b))
• Legitimate interest: to stop abuse, handle reports and keep the service secure (Article 6(1)(f))
• Consent: for the waiting list (Article 6(1)(a))

Who helps us

We never sell data and do not share it with advertisers. These parties process data on our behalf:

• Northflow Technologies AS, which develops and operates the service
• Cloudflare, which runs the servers and storage. Cloudflare processes IP addresses to deliver traffic and stop attacks
• Apple and Google, which distribute the app and handle in-app purchases under their own terms

Cloudflare may process data outside the EEA. Transfers rely on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

We only disclose data to authorities when the law requires it. We cannot disclose the content of conversations, because we do not have it.

How long we keep data

• Your account: until you delete it, or until it is deleted automatically after the period you chose
• Messages and photos in transit: until picked up, at most 14 days
• Posts and stories: until the time you chose is up, or until you delete them
• Reports and moderation: as long as needed to handle the case and prevent further abuse
• The waiting list: until the launch notice has been sent

Your rights

You have the right to access, correct and delete data about you, and to object to processing. Most of this you can do yourself in the app: Kill Switch deletes your account and everything that belongs to it immediately.

Write to hjelp@blackbook.no for anything else. If you are unhappy with how we handle your data, you can complain to the Norwegian Data Protection Authority (Datatilsynet).

The website

The website uses no cookies, no analytics and no third party scripts. Fonts are served from our own server.

Changes

If we change this policy, we update the date at the top. For significant changes, we let you know in the app.