Privacy Policy

BlackFlame is operated by Ready Player X India Private Limited, Gurgaon, Haryana, India ("BlackFlame", "we", "us").

This policy explains what we collect when you use blackflame.in, why, and what you can do about it. We have tried to write it so that it matches exactly what the product does today. If something here is wrong, email support@blackflame.in and we will fix the product or the policy.

What we collect

When you sign in with Google / YouTube. We ask Google for your public profile and read-only access to your YouTube channel (no other YouTube permission, and no offline access). From that we keep:

• your Google account ID (a number, not your email)
• your channel's handle, title and profile picture link
• your Google name and picture, used only if your channel has none
• your subscriber count (recorded as 0 if you hide it; also written to the audit log with your account ID)
• the date you verified

We do not store your email address, your Google password, or any Google access token. We read your public profile only. We never post on your behalf.

When Instagram sign-in is available. We would keep your Instagram account ID, username and follower count. No token is stored.

Your BlackFlame account. Your handle (created from your social account's username), your role, and the date your account was created.

Your creator coin. Your coin's handle, display name and picture link, taken from your social profile.

Your activity. Every buy and sell (amounts, fees, price, time), your balance, your holdings, your Daily Vault amounts and claims, and single-use invite codes you redeem.

Your sessions. When you sign in we record the IP address and browser information of the device, the time, and the last time the session was used. Sessions last 30 days.

Audit records. We keep a permanent, tamper-evident log of account and money events (for example: account created, session created, coin bought, claim made). Session-creation entries include your IP address and browser information. Database rules reject any edit or deletion of its rows.

What we do not collect

• No email address, phone number, government ID or payment details.
• No analytics, tracking pixels, advertising identifiers or error-tracking services. The site runs no third-party scripts.
• No identity verification during the beta.

Cookies

One cookie, bf_session, keeps you signed in. It is set for .blackflame.in, lasts 30 days, and is not readable by scripts. There are no advertising or analytics cookies. The trade screen uses your browser’s local storage to protect an in-progress trade against a page reload; it holds your account ID and the coin being traded, and it never leaves your device.

Why we use your data

• to sign you in and keep your session
• to create and display your coin and your handle
• to price and settle trades (QRP, BlackFlame’s pricing engine) and to run the Daily Vault
• to detect abuse (rate limits use your IP address in memory only; it is not written to logs)
• to keep an accurate, auditable record of every money movement

We do not sell your data, use it for advertising, or share it with anyone except the service providers below.

Where your data lives

• Website: Vercel.
• API and database: Railway, hosted in Singapore.
• Database backups: a nightly copy is stored as a GitHub Actions artifact and deleted automatically after 14 days.
• Exchange rates shown on the site come from CoinGecko; that request carries no data about you.
• Profile pictures are fetched from Google’s or Instagram’s image servers and served to you through Vercel’s image service.

How we protect your data

• All traffic between your browser, blackflame.in and our API is encrypted in transit (HTTPS).
• Your database records are stored on Railway's managed PostgreSQL. Railway states that stored data is encrypted at rest and publishes SOC 2 Type II certification at trust.railway.com.
• Nightly database backups are stored as artifacts in our private GitHub repository and deleted automatically after 14 days.
• The database is reachable only with credentials we hold: by the API, by the operator, and by our nightly backup job. No one outside the hosting providers named above has access to your data.
• Your session cookie is HttpOnly and Secure; scripts on the page cannot read it.
• Account and money events go into an append-only audit log; database rules reject any edit or deletion of its rows.
• Access tokens from Google or Instagram are used once, in memory, to read your profile during sign-in. They are never written to the database, backups or logs; our logs redact token fields automatically.

Google user data

What we access: your Google account ID, name and picture (OpenID profile), and your YouTube channel's handle, title, picture link and subscriber count (read-only scope). We request no other YouTube permission and no offline access.

How we use it: to create your account and handle, to create and display your creator coin, and to set your creator tier from your subscriber count at sign-up. Your subscriber count is re-read each time you sign in and updated if it has changed by more than 1.0%.

How we store it: in our database for as long as your account exists. Your Google account ID and subscriber count at sign-up are also written to the permanent audit log.

How we share it: we don't. Google data is never sold, shared with advertisers or data brokers, or used to train AI or machine-learning models. It is processed only on the hosting providers named above.

Deletion: on request to support@blackflame.in we remove your channel title, picture link and subscriber count from your profile and social link. Your Google account ID, handle, coin, trade records and audit-log entries are kept, for the reasons given under "Closing your account".

BlackFlame's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Read the Google API Services User Data Policy.

How long we keep it

• Session records: for the life of the session (30 days). Expired session records are not yet purged automatically; they stay in the database until we clean them up.
• Google profile and channel fields (account ID, handle, title, picture link, subscriber count): for as long as your account exists.
• Trade and balance records: for as long as your account exists, and after that as described under "Closing your account".
• Audit log: permanently.
• Backups: 14 days.
• Sign-in state (used only during the Google hand-off): up to one hour.

Closing your account

Email support@blackflame.in from a message that lets us confirm you control the social account you signed in with. We will close your account by hand and remove your channel title, picture link and subscriber count. Trade and audit records are kept, because other users' holdings and the integrity of the ledger depend on them. There is no self-service deletion or data-export button yet. Your Google account ID and the subscriber count recorded at sign-up remain in the audit log.

Age

You must be 18 or over. We do not knowingly collect data from anyone under 18; if you believe we have, email support@blackflame.in and we will remove it.

Changes

We will update this page when the product changes and put the new date at the top. Material changes will be noted on the site.

Contact

support@blackflame.in