Privacy Policy

Account information. When you create an account we collect your email address, display name, and (optionally) a profile picture. If you sign in with Google, we receive your Google profile name and email.

Usage data. We log which features you use, pages you visit, and actions you take inside Black Hole (e.g. prompts submitted, projects created). This data is used exclusively to improve the product.

Payment information. Billing is handled by Stripe. We never store your full card number — Stripe stores a tokenised reference only.

Project content. The prompts you submit and the websites Black Hole generates on your behalf are stored in our database so you can access them later. You own this content.

• To provide, operate, and improve the Black Hole service.
• To authenticate your identity and maintain session security.
• To process payments and manage your subscription.
• To send transactional emails (account confirmation, password reset, billing receipts). We do not send marketing emails unless you opt in explicitly.
• To detect and prevent fraud, abuse, and security incidents.
• To comply with legal obligations.

We do not sell your personal data. We share limited data only with the following sub-processors:

We use the following cookie categories:

• Essential cookies — session tokens, CSRF protection, and authentication state. These are required for the service to work and cannot be disabled.
• Analytics cookies — PostHog collects anonymised behavioural data to help us improve Black Hole. Only activated with your consent.
• Advertising cookies — Google AdSense serves personalised ads to help fund free access to Black Hole. Only activated with your consent. Google's use of advertising cookies is governed by the Google Privacy Policy.

You can change your cookie preferences at any time by clicking "Cookie settings" in the site footer.

We retain your account data for as long as your account is active. You can request deletion at any time (see Section 7). Project content is retained for 90 days after account deletion, then permanently erased.

Our servers are located in the United States (Vercel/Supabase US region). If you access Black Hole from the EU/EEA, your data is transferred under Standard Contractual Clauses (SCCs).

We implement industry-standard safeguards including TLS encryption in transit, AES-256 encryption at rest (Supabase), hashed password storage, and row-level security policies so users can only access their own data. We conduct periodic security reviews.

No method of transmission over the Internet is 100% secure. If you discover a security vulnerability please report it to security@blackwhole.online.

Depending on your jurisdiction you may have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — request deletion of your account and associated data.
• Portability — receive your data in a machine-readable format.
• Opt-out of advertising — withdraw ad consent via the cookie banner at any time.

To exercise any of these rights, email privacy@blackwhole.online. We will respond within 30 days.

If you have questions about this policy, please contact us: