Privacy Policy

BlackLeaf (blackleaf.app) is a data-journalism publication operated by The Fantoccini Company LLC, a New York limited liability company ("we", "us"). We are the data controller for the personal information described here. We collect as little as the site needs to work, and this page lists all of it — what we collect, why, how long we keep it, and the choices you have. Questions or requests: editor@blackleaf.app.

What we collect, and why

Reading.You can read everything without an account. We count article views in aggregate — a number per article, not a profile per reader. We use your IP address transiently to rate-limit abusive traffic and keep the site up; we don't log it for tracking. There are no ads and no third-party analytics or tracking scripts on the site.

Accounts. If you register, we store your name, email address, and a hashed password (we never store the password itself), used to operate your account and let you comment, post, and flag articles. Logging in sets a single session cookie (bl_session) that keeps you signed in — it's the only cookie we set, and it isn't used for tracking or advertising.

What you post. Comments, annotations, forum posts, and article flags are stored with your account and shown publicly where you posted them.

Membership.Payments are processed by Stripe. We never see or store your card number; we keep only what Stripe reports back — that your account's membership is active. Stripe's handling of your payment data is covered by Stripe's own privacy policy.

Newsletter. If you subscribe, we store your email address and send the newsletter through SendLayer, our email delivery provider. Every issue includes an unsubscribe link, which removes you immediately.

Social platforms and platform APIs

We publish our own videos to our own brand accounts on social platforms (TikTok, YouTube, X, and Meta platforms) through those platforms' APIs. When a platform account is connected to do this, we receive and store, server-side: the OAuth tokens the platform issues, and the connected account's basic profile information (such as display name, avatar, and account ID — e.g. via TikTok Login Kit's user.info.basicscope). We use this data solely to authenticate, publish, and manage our own posts on the connected account. We do not collect or process any other user's platform data, we do not use platform data for advertising or profiling, and we never sell or share it.

Tokens are kept only while the connection is active and are deleted when it is revoked. You can revoke a connection at any time from the platform itself — on TikTok under Settings → Security → Manage app permissions, or for Google via Google security settings. BlackLeaf uses YouTube API Services; by using features that rely on them you are also agreeing to the Google Privacy Policy.

Where it lives, and security

Data is stored with Google Cloud (Firestore) and the site is hosted on Vercel; our servers are located in the United States, and if you use the site from elsewhere your data is processed there. All traffic is encrypted in transit (HTTPS), passwords are stored only as hashes, and API credentials are held server-side, never in the browser. We share personal information only with the service providers named in this policy (Stripe, SendLayer, Google Cloud, Vercel), each acting on our instructions to run the site. We don't sell, rent, or share your personal information for advertising — with anyone — and we disclose it only if the law compels us to.

How long we keep it

Account data is kept until you delete your account. Public posts are kept until you or we remove them. Newsletter addresses are kept until you unsubscribe. Platform tokens are kept until the connection is revoked. Aggregate view counts contain no personal information and are kept indefinitely. Transient rate-limiting data (IP addresses) is discarded automatically.

Your rights and choices

You can ask us to access, correct, export, or delete the personal information we hold about you, or object to our processing of it — email editor@blackleaf.app and we'll handle it promptly, and you may also lodge a complaint with your local data-protection authority. You can unsubscribe from the newsletter at any time via the link in any issue. We do not sell personal information as defined by the California Consumer Privacy Act, and we honor deletion and access requests from all readers regardless of where they live.

Children

BlackLeaf is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, email us and we will delete it.

Changes

If this policy changes, the new version is posted here with a new effective date; material changes will be noted on the site.

Contact

The Fantoccini Company LLC, New York, NY — editor@blackleaf.app.