Privacy Policy

Last updated: April 16, 2026

blackbear is built by xavi group llc ("we", "us", "our"). We believe your data is yours — not ours, not anyone else's. This policy explains what data we collect, what we don't, and why.

The Short Version

We don't read your data. We can't. blackbear stores everything on your device. If you opt into cloud sync, your data is end-to-end encrypted before it leaves your device — we store only encrypted blobs that are meaningless without your key. We collect the minimum data necessary to provide the service. We don't sell your information to anyone.

What We Collect

When you visit blackbear.app

Our website does not use cookies, analytics, or tracking scripts. We don't use Google Analytics, Facebook Pixel, or any third-party tracking. Server logs may record your IP address and browser type for security purposes; these logs are rotated and deleted within 30 days.

When you create an account

You can use blackbear without creating an account. If you choose to create a free account (via email sign-in or Google Sign-In), we collect:

We use your email to send sign-in links, account notifications, and to respond to support requests. We will never send marketing emails unless you explicitly opt in.

If you sign in with Google, we receive your email address and name from Google. We do not receive or store your Google password. You can revoke blackbear's access from your Google Account permissions at any time.

When you subscribe to cloud sync

Payment is processed by Stripe. We receive your email address and payment confirmation. We do not receive or store your credit card number, CVV, or full billing details.

Cloud sync is available in two tiers: Cloud ($2/month or $19/year) and Cloud Pro ($5/month or $48/year). Both include end-to-end encrypted sync across your devices.

When you use blackbear

The app itself collects no data. No analytics, no telemetry, no crash reports, no usage tracking. Your notes, journal entries, tasks, calendar events, routines, drawings, spreadsheets, voice memos, imported documents, tags, templates, and settings all live on your device. We never see them.

If you use cloud sync

When you subscribe to cloud sync, all your data is end-to-end encrypted before it leaves your device using XChaCha20-Poly1305 encryption. Your encryption key is derived from your passphrase via Argon2id and never sent to our servers. We cannot read, access, or analyze your synced content — even if compelled to. Our servers store only encrypted blobs that are meaningless without your key.

This applies to all synced data including:

You can cancel sync and request deletion of all synced data at any time. We will delete your data from our servers within 30 days of your request. Your local copy remains untouched.

If you use messaging

blackbear includes end-to-end encrypted messaging. Messages are encrypted on your device before being sent to the recipient via our servers. We cannot read the content of your messages. Message metadata (sender, recipient, timestamp) is used only for delivery and is not analyzed or sold.

Contacts are added by scanning a QR code or sharing a connect link — no phone number or email is shared between users unless you choose to share it. Voice and video calls use end-to-end encryption via WebRTC/SRTP; our servers facilitate the connection but cannot access call content.

If you connect third-party integrations

blackbear can optionally connect to third-party services like Google Calendar to display your external data alongside your local content. These integrations are entirely opt-in — blackbear never contacts third-party services unless you explicitly connect an account.

What we access: When you connect an integration, blackbear requests the minimum permissions needed. For example, Google Calendar integration uses read-only access to view your calendar list and events. We do not request permission to modify, create, or delete your data on these services.

Where your data goes: Data fetched from third-party services (such as calendar events) is stored locally on your device only. It is not uploaded to our servers. If you use cloud sync, integration credentials (OAuth tokens) are end-to-end encrypted along with all your other data — we cannot read them.

Token security: Authentication tokens from third-party services are stored in your device's local database and, if you use cloud sync, encrypted before leaving your device. We never have access to your third-party credentials in any readable form. If you believe a device has been compromised, you can revoke blackbear's access from the third-party service directly (e.g., your Google Account permissions) and disconnect the integration within blackbear.

Disconnecting: You can disconnect any integration at any time from Settings. When you disconnect, all data fetched from that service is immediately deleted from your device. We do not retain any third-party data after disconnection.

blackbear's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Health and wellness data

blackbear includes optional routine tracking features for sleep, hydration, medication, and other personal wellness data. This data is stored exclusively on your device. If you use cloud sync, it is end-to-end encrypted like all other data. We never have access to your health or wellness information in any readable form.

What We Don't Collect

Third Parties

We use the following third-party services:

We may add additional optional integrations over time. Each will follow the same principles: opt-in only, minimum permissions, data stays on your device, credentials end-to-end encrypted. We will update this policy when new integrations are added.

No analytics providers, no ad networks, no data brokers.

Data Retention

We retain your email address and account information for the lifetime of your account to provide the service. If you cancel a cloud sync subscription, your encrypted data is retained for 30 days in case you resubscribe, then permanently deleted. You can request immediate deletion at any time by emailing us. We will delete your information within 30 days.

Children's Privacy

blackbear is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us.

Changes to This Policy

We may update this policy from time to time. We'll post changes here and update the "last updated" date. For material changes, we'll notify users via email.

Contact

Questions or concerns? Email us at [email protected].