Privacy Policy

Last updated: 14 May 2026

This Privacy Policy explains how BlackBox ("we", "us", "our") collects, uses, and protects information when you use the BlackBox mobile applications and website (the "Service"). By using the Service you agree to the practices described here.

1. Who we are

BlackBox is operated by George Barbour, a sole trader based in Scotland, United Kingdom, trading as "BlackBox". You can contact us at blackboxsupport@ghillie.xyz. We act as the data controller for personal data processed through the Service.

2. What we collect

Account information

When you sign in with Google, we receive your email address, display name, and Google account identifier. We do not store your Google password.

Vehicle and trip data

Information you enter (vehicles, fuel logs, costs, modifications, trip GPS samples, and uploaded images) is stored in your account so you can sync it across devices. Trip GPS data is only recorded when you actively start a trip in the app.

Payment information

Subscription payments are processed by Stripe. We receive billing status (active, trialing, cancelled, period end) and a Stripe customer identifier; we do not see or store your card number, CVV, or full billing address. Stripe's own privacy policy applies to data they hold: stripe.com/privacy.

Device and usage data

To keep the Service working, we log technical information such as your device identifier, app version, IP address (transiently, for rate limiting), and error reports. We do not use third-party advertising or behavioural tracking.

3. How we use your data

To operate the Service: store and sync your vehicles, costs, and trips across your devices.
To provide support and respond to your messages.
To manage subscriptions and process payments through Stripe.
To detect and prevent abuse (rate limiting, device-bound auth).
To comply with legal obligations.

4. Legal bases (UK / EU GDPR)

We process your data on the following legal bases: (a) performance of a contract for the core Service and subscription billing; (b) legitimate interests for security, abuse prevention, and product improvement; (c) consent where required (e.g. precise location for trip tracking, which you opt into per-trip); (d) legal obligations for tax and compliance records.

5. Sharing and processors

We do not sell your data. We share it only with service providers acting on our instructions:

Cloudflare: hosting, database (D1), storage (R2), key-value (KV). EU/global data centres.
Google: sign-in authentication.
Stripe: subscription billing.
DVLA & MOT API (UK): when you look up a vehicle by registration plate. We forward the plate to the official UK government API and do not store the request beyond the response shown in the app.

6. Retention

We retain your account and content for as long as your account exists. If you delete your account, content is deleted within 30 days of the deletion request, except where retention is required by law (e.g. UK tax records for subscription payments, which we keep for 6 years in line with HMRC requirements).

7. Your rights

If you are in the UK or EEA, you have the right to access, correct, delete, export, restrict or object to processing of your personal data, and to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority. Email blackboxsupport@ghillie.xyz to exercise any of these rights.

8. Security

Data is transmitted over HTTPS. Session cookies are HttpOnly, Secure, and signed. Backend secrets are held in Cloudflare's secret store. No system is perfectly secure; if you believe an incident has affected your account, please contact us.

9. International transfers

Cloudflare, Google, and Stripe operate globally and may process your data outside the UK/EEA. They rely on Standard Contractual Clauses and equivalent safeguards.

10. Children

The Service is not directed to children under 13 (or under 16 in the EEA where required). We do not knowingly collect data from children.

11. Changes

We may update this policy from time to time. Material changes will be highlighted in the app or via email before they take effect.

12. Contact

Questions? Email blackboxsupport@ghillie.xyz.