Privacy Policy

1. Who this is

blacktop.social is operated by Blacktop Social LLC ("Blacktop Social," "we," "us"). We are responsible for the personal information described here.

Blacktop Social LLC
606 Metropolitan Avenue, 6B, Brooklyn, NY 11211
legal@blacktop.social

2. What we collect

• Bupo beta conversations. When you text Bupo, we store your phone number or messaging handle, incoming messages, Bupo’s replies, timestamps, delivery status, and internal review notes. We may review these conversations to identify problems and improve Bupo’s behavior. Beta conversation records are stored on a private, encrypted server volume we run on Fly.io in the United States. The beta review dashboard has no public address; only the operator can open it. Attachment contents are not stored in that dashboard; text captions and attachment indicators may appear. Bupo also saves short notes from what you tell him, like preferences, people you mention and plans, so he can bring them up later. Notes expire after 30 to 180 days. Text STOP to stop future messages. To request deletion of these notes or of beta conversation records, contact legal@blacktop.social.
• Your email address, if you ask for release updates. The sign-up form in the Site's footer collects an email address. When you submit it we also record the date and time, your IP address, your browser's user agent, and the exact consent wording shown on screen at that moment — that record is how we can show, later, what you agreed to and when.
• Messages you send us. If you email us, we receive your email address, the contents of the message, and any attachments you include.
• Feedback you choose to file. The feedback form records the product, category, note, optional context, and the page that sent you to the form. It also asks for your name and email address so we can reply about that note; adding a phone number is optional. Sending feedback does not add you to our release-update list unless you tick the box that asks; that tick is recorded in the consent ledger like any other opt-in, and you can unsubscribe at any time. A one-way daily code derived from the requesting network address is kept with the note only to limit automated spam; it is not the address itself and is not shown in the feedback ledger.
• Ordinary server logs. Our hosting infrastructure may record an IP address, timestamp, requested page, browser information, and similar request data needed to deliver and secure the Site.
• Your account, if you make one. Your email address is the account. If you choose to tell us a name to greet you by we keep that too, and skipping is a real answer — we do not ask again. We record which of our projects you have put on your blacktop. Drawing on it with chalk is not built yet; when it is, we will store what you draw.
• Sign-in link requests. When somebody asks us to email a sign-in link, we record the address, the IP address it was requested from, and when — that is how the endpoint that sends the link cannot be used to mail strangers.
• Addresses we must stop mailing. When a message bounces or somebody reports it as spam, our mail provider tells us, and we keep that address on a do-not-send list. It is how we avoid mailing someone who told us to stop by the bluntest means available.

Bupo signup asks for your phone number to connect you to its messaging service. The feedback form also accepts a phone number, optionally. The Site does not ask for precise location. Purchases open on Stripe, which collects payment information; and there is no password to forget — signing in is a link we email you. A name is optional and you can skip it outside the feedback form. Public-page analytics records product and page names, campaign labels, referring domains, device/browser information, and actions such as opening a product or starting checkout. We do not send email addresses, form values, authentication tokens, or payment credentials to PostHog.

Simulators and shared play

Your Life in Dots. Your birthday, optional name and answers are used in your browser to make your poster. The current share link encodes your birthday, optional name and selected answers in its URL. Anyone you send that link to can read them, and opening it sends that URL to the hosting service. Saving a poster image shares only what is visible in that image. Avoid sharing a personal link if you do not want its answers disclosed.

Moral Conductor. Your browser saves ride history. A shared verdict link encodes the choices needed to recreate that verdict; a person who opens the link can see it. Queue Theory links carry simulation settings so somebody else can try the same flight, not a record of a real passenger booking.

Playground. A browser session has a generated player name and identifier. When connected to a shared room, movement, appearance and interactions are transmitted to the room service and other players. A note you submit to the shared guestbook is public to other room visitors, together with your generated name, chosen stamp and posting time. Do not put contact details or other private information in the guestbook. When no shared room is connected, the local experience does not send those interactions to a room. The Playground's sticker book is kept only in your own browser: which stickers you have found, which days you played, and how far you got with the day's three challenges. It holds no name, identifier or anything you typed, and clearing this site's storage in your browser deletes it. The rest of the book is not sent to us, but when you are in a shared room the room is told which of the rare visitors you have caught and passes that to the other players there, alongside your generated name. If you choose to share a picture from the book, it shows that day's generated name and the date, and the link that comes with it names only the card, never you.

3. Release updates, and how to stop them

Submitting the sign-up form is marketing consent: it adds your address to our release-update list, and we send occasional email about new and existing projects. The first of those is a welcome message sent automatically when you sign up.

Every one of those emails carries an unsubscribe link, and most mail apps also show their own Unsubscribe button beside the sender. Either one removes you immediately and permanently. We keep a record that you unsubscribed, and when, because being able to prove we honoured it is the point of keeping records at all — but we stop sending.

Two processors handle the list itself. Resend delivers the mail and holds your address as a contact for that purpose. Neon, through Vercel, hosts the database where the consent record lives. Both act on our instructions and neither is permitted to use your address for their own purposes.

4. Why we use it

• To send the release updates you asked for, and to keep the record of that request.
• To read and respond to messages you choose to send.
• To triage feedback, reproduce bugs, plan improvements, and reply by email about the note you sent.
• To deliver, secure, debug, and prevent abuse of the Site — including limiting how many sign-ups one network can trigger in an hour, so the form cannot be used to send mail to people who did not ask for it.
• To understand which products and acquisition sources attract interest, identify failed steps, and reconcile completed purchases.
• To comply with law or protect rights and safety where necessary.

We do not use simulator answers or Playground guestbook notes to build advertising profiles. Advertising is not enabled by this policy update. If we enable personalized advertising later, we will first provide the required notice, choices and opt-outs described below. We do not make automated decisions with legal or similarly significant effects.

If you are in a place with a lawful-basis regime such as the UK or EU: we rely on your consent for release updates, which you can withdraw at any time using the unsubscribe link; and on our legitimate interests in answering our mail, keeping the Site up, and defending against abuse. Where we keep a consent record after you unsubscribe, we rely on our legal obligation to be able to show that consent existed.

5. Cookies and tracking

Our essential sign-in cookie is set after you sign in. It holds a random value identifying your session and nothing else — no name, no address, no history. It is marked HttpOnly, so scripts cannot read it, and SameSite=Lax, so another site cannot make your browser use it to act as you. Signing out deletes it, and it expires on its own after 90 days.

PostHog runs in cookieless mode on the public studio, BusyWork, and 404 B.C. web pages. It derives a daily identifier on its server using a rotating salt, the request IP address, user agent, and hostname. It uses no analytics cookies or browser storage for a lasting identity. This is still processing of request information; "cookieless" does not mean no data is processed. We do not use it to identify people across days or unrelated domains.

To tell a first visit from a return, each product keeps three things in your browser's local storage: the date of your first visit, the date of your last, and how many days you've visited. No ID. Our anonymous usage events carry only what those imply: which visit this is, how many days since the first, and the week of the first. The record starts over after 13 months, and clearing site data removes it.

We disable session recording and automatic capture of page contents. Our event code removes URL query strings and fragments and sends selected campaign labels separately. Account, sign-in, feedback, and legal pages do not load this public-page analytics script. Other features may store local preferences such as the site's chosen day/night appearance.

Stripe handles checkout. We receive purchase information needed for delivery and support. A random checkout reference connects a checkout action to a verified payment event without sending the customer's email or card data to PostHog. A purchase or account does not enroll you in marketing emails; those require the separate release-update opt-in.

Emails we send do not contain tracking pixels. We can see what our mail provider reports about delivery — whether a message was accepted, bounced, or reported as spam — because that is how email works at all, but we do not track opens or which links you click.

Advertising and your choices

We are preparing Google advertising on selected game, simulator and Playground pages. It will not be enabled until advertising privacy controls are in place. When enabled, Google and the advertising partners listed in the consent message may process IP addresses, browser/device information, page context, cookies and identifiers to deliver and measure ads, limit repeated ads and detect fraud. Where permitted and with consent where required, advertising cookies can support ads based on prior visits to this or other websites. Non-personalized ads can also use cookies or process device data; they do not mean that no information is processed.

Before activation, ad-supported pages will offer a Privacy & cookie settings control to review or withdraw applicable choices. Declining optional advertising consent will not prevent you from using the experience. Applicable US-state choices, including Do Not Sell or Share My Personal Information and recognized opt-out preference signals, must also be in place before advertising starts. Consent to advertising is separate from consent to Blacktop marketing emails.

Ads are planned at these places: below the plane once you finish a Queue Theory flight, and between later flights; under the page and, on wide screens, beside the board after a finished run of 404 B.C., and between games; at a pause in Touch Grass; in a thin strip across the top of the Playground's entrance on larger screens, and when you leave the Playground after a while; at the end of your own Your Life in Dots poster once you have saved or shared it; at the end of your own Moral Conductor verdict; on a separate page you can choose to open after Moral Conductor or Your Life in Dots; and once on our games and simulators lists. Apart from the strip at the Playground's entrance, ads will not appear before your first play, and none sits within 150 pixels of a game while you play it. They will never appear inside a result, or on a page whose address carries answers, such as a Moral Conductor verdict link or a Your Life in Dots poster link someone sent you; those pages never load advertising code. Before your own poster or verdict shows an ad, the page removes your birthday, name and answers from its address; what is already on your screen stays there.

Our games and simulators share one web address, so they also share your browser's storage for this site. A script running on any of our pages, including an advertising script on an ad-supported page, could technically read what our other pages keep there: Moral Conductor's list of your recent rides and the choices in them, game scores and settings, the Playground's random player identifier for the current tab, and the Playground's sticker book. That storage does not contain your name, email address or birthday, and we do not pass any of it to advertising providers.

Learn how Google uses information from sites that use its services and manage Google's personalized advertising through Google Ads Settings. Those settings do not replace the choices provided on this Site. Advertising providers describe their own retention and data handling in their policies.

6. Who we share it with

We disclose information to the providers below to operate the Site, when required by valid legal process, to protect rights or safety, or as part of a merger, acquisition, or transfer of the business. Providers' roles depend on the service; some, including payment and advertising providers, also process information under their own policies. Future advertising disclosures can be considered a sale or sharing under some privacy laws even without a cash payment for personal information. The advertising controls described above must be available before that processing begins.

• Photon — connects Bupo to its messaging service and processes your messaging handle and messages to deliver conversations.
• AI model providers — currently xAI for Bupo — process conversation context to generate replies. The operator can also configure Anthropic as the model provider.
• Vercel — hosts and delivers the Site, and creates the ordinary server logs described above.
• Cloudflare — runs the connected Playground room service, including shared player activity and the guestbook.
• Google and selected advertising partners — planned advertising and consent services, subject to the activation conditions and choices described in Section 5.
• Neon — provides the database, reached through Vercel, where the release-update list and the consent record are stored, along with accounts, the sessions that keep you signed in, what you have put on your blacktop, the record of who has asked for a sign-in link, and the do-not-send list.
• Supabase — provides the shared identity and product hub used across Blacktop projects, including the private feedback table. Browser accounts cannot read that table; only our server and the restricted feedback ledger can.
• PostHog — processes the public-page events described above in its US region.
• Stripe — processes payments and receipts. It may collect billing and fraud-prevention information under its own privacy policy.
• Resend — delivers our email and holds your address as a contact for that purpose.
• Fly.io — runs the Bupo messaging service and stores beta conversation records and Bupo’s notes on an encrypted volume in the United States, with daily snapshots.

7. How long we keep it

Bupo beta conversation records and review notes currently have no automatic expiry. They remain in the private beta store on our Fly.io server, and in its daily snapshots and any recovery copy, until we delete them. A deleted record can remain in snapshots for up to 14 days. Texting STOP stops replies; it does not delete past conversations. You can request deletion using the contact address above. Messaging and model providers may retain their own operational records under their respective policies.

Your address on the list stays until you unsubscribe or ask us to delete it.

The consent record — that you signed up, when, and the wording you agreed to, plus the matching record if you later unsubscribed — is kept for no less than four years after your last interaction with the list. That is deliberate: the record is what lets us show an opt-in was genuine and an opt-out was honoured, and it is the one thing that would be useless if it were deleted on request. It is stored so that it cannot be edited after the fact, only added to.

Your account — the name you gave us, what is on your blacktop, and your chalk drawings — stays until you delete it or ask us to. Sessions expire on their own after 90 days, and signing out ends one immediately.

The do-not-send list is kept indefinitely, deliberately. It exists because an address hard-bounced or somebody reported us as spam, and deleting the record would mean starting to mail them again — the exact opposite of what it is for. It holds the address, the reason, whatever our mail provider told us in its own words, and when it happened.

Sign-in link requests are evidence of nothing, so they are not kept — old rows are swept away as new ones come in.

Emails you send us are kept as long as reasonably needed to answer them, keep business records, resolve disputes, or meet legal obligations. Infrastructure logs follow our providers' operational and security retention schedules.

Feedback and the contact details attached to it are kept as long as reasonably needed to understand the request, decide or ship the work, reply, and keep a useful product history. You may ask us to remove your contact details or the note using the address below.

Playground guestbook. The room keeps its latest 12 notes; older notes are replaced as new notes arrive. There is no time-based expiry for those remaining notes. A note includes its generated player name, stamp and posting time. To request removal, contact the address below with enough information to identify the note. Live player and toy state is used to run the room; hosting providers may keep separate operational logs.

8. Security

The Site uses HTTPS, and access to communications and service accounts is limited. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

9. Children

This Site is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has sent us personal information, email legal@blacktop.social.

10. Your choices and rights

The fastest one needs no email at all: the unsubscribe link at the bottom of every message we send removes you from the list immediately, as does the Unsubscribe button most mail apps show beside the sender.

Beyond that, you may ask what personal information we hold about you, ask for a copy of it, ask us to correct it, or ask us to delete it, by emailing legal@blacktop.social. Depending on where you live you may also have the right to object to or restrict a use, to withdraw consent, or to complain to your data protection authority. We will not discriminate against you for exercising a privacy right.

We will ask you to confirm the request came from the address it concerns, which for a list of email addresses is the only verification available to us. One limit is worth stating plainly: if you ask us to delete your information, we will remove you from the list, but we keep the consent record described in Section 7 for its retention period, because a deleted record of consent cannot be used to prove we honoured your choices.

Deleting your account removes the name you gave us, what was on your blacktop, and your chalk drawings. Two things survive it, both described in Section 7: the consent record, and the do-not-send list if your address is on it — deleting that entry would simply mean we resumed mailing you.

Advertising is not enabled by this update. Before enabling it, we will implement applicable advertising opt-outs and handling of recognized preference signals such as Global Privacy Control. Until then, this policy does not claim that a live advertising preference control is available.

11. Where information is handled

We are based in New York, and our providers process information in the United States. If you use the Site or the list from outside the United States, your information is transferred there. Where the law requires a transfer mechanism for that — for example the UK or EU — we rely on our providers' standard contractual clauses.

12. Other sites and future features

Links to other sites are governed by those sites' policies.

This page previously said that if Blacktop Social added an account we would update this policy before that collection began. This is that update. If we later add features that collect information beyond what is described above, we will update this policy and present any required notice or consent before that collection begins.

13. Changes and contact

Playground sticker book disclosure added 5 October 2026, and updated the same day for visitors and shared pictures. Simulator sharing, Playground and planned advertising disclosures updated 4 October 2026. Bupo disclosures were last updated 19 October 2026.

We will update this page and its "last updated" date when our practices change. Questions, requests, or complaints can be sent to:

Blacktop Social LLC
606 Metropolitan Avenue, 6B, Brooklyn, NY 11211
legal@blacktop.social
general mail: hello@blacktop.social

See also our Terms of Service.