Privacy Policy – How Black Box Protects Your Data

Effective Date: September 10, 2025

Product Name: Black Box

Company: Click4Kart Tech Private Limited

Support Contact: support@click4kart.com

1. Introduction

Black Box is a mobile application developed by Click4Kart Tech Private Limited. This Privacy Policy outlines how we collect, use, protect, and manage your data. By using Black Box, you agree to this policy.

2. Information We Collect

• Personal Info: Name and Mobile Number (used only for OTP verification)
• Device Data: With your consent, we access Contacts, Images, Documents, and Notes for backup purposes.

2.1 Google Play Data Safety

We have completed the Google Play Data Safety form and ensure that the disclosures shown on our Play Store listing accurately reflect the data collection, usage, and sharing practices described in this Privacy Policy. Any data collected by third-party SDKs used inside our app is also declared in the Play Console.

3. Purpose of Data Collection

• To verify user identity via mobile number and OTP
• To enable encrypted data backup services
• To allow data restoration on any device after login

4. Data Encryption and Security.

Black Box uses industry-standard security practices to protect your information.

• Encryption in Transit: All data transferred between your device and our servers is encrypted using HTTPS/TLS 1.2+, preventing interception during transmission.
• Encryption at Rest: All backups stored on our servers are encrypted using AES-256, one of the strongest encryption standards in the industry.
• Key Management: The encryption keys are securely managed within our infrastructure and are never accessible to unauthorized parties, including our internal team. This ensures that while we store your backups for restoration purposes, we cannot read or misuse your actual data in a human-readable form.

⚠️ Important Note on End-to-End Encryption (E2EE):

In strict technical terms, true end-to-end encryption means that only the user controls the encryption keys and the service provider cannot decrypt data at all. Currently, Black Box provides encryption in transit and at rest that meets Google Play’s data security requirements, but the encryption keys are managed by our secure servers.

If in the future we implement user-controlled keys to enable strict end-to-end encryption, this Privacy Policy will be updated accordingly.

5. Auto Backup Functionality

Black Box provides an Auto Backup feature that uses our own secure backup system (we do not use Android's Auto Backup to Google Drive). Backups are encrypted in transit and at rest, and include only the data types you select (Contacts, Photos, Documents, Notes). You can disable Auto Backup anytime from app settings.

6. Data Recovery

If a user's device is lost, broken, or reset, they can reinstall the app on another device and restore data using their mobile number and OTP. No password or email is required.

7. Data Retention & Deletion Policy

7.1 Uninstalling the App

Uninstalling the Black Box app does not delete your backed-up data. The data remains securely encrypted on our servers and can be restored when you reinstall and log in again.

7.2 Account Deletion Request

If a user requests account deletion through the app or by contacting our support:

• The account is marked for deletion.
• The user’s data is retained for a 30-day grace period.
• During this period, data can be recovered by logging in again.
• After 30 days, the data is permanently deleted and cannot be recovered.

7.3 Device Loss or Change

If your phone is lost or damaged, your data remains secure. You can recover your backups anytime by installing Black Box on a new device and logging in with your registered mobile number.

8. User Rights

• Access your stored data
• Delete specific items or the full backup
• Disable auto-backup at any time
• Request full account and data deletion

9. Permissions Required

We ask for access only when needed, and solely for backup services:

• Contacts
• Photos & Media
• Documents
• Phone State (for basic app functionality)

Runtime permissions are requested just-in-time (only when you activate a feature). We will never request or access sensitive data before showing this disclosure and obtaining your explicit consent.

10. Data Sharing Policy

We never sell or rent your data. We only disclose your information when required by law or in response to lawful requests by public authorities (e.g., a court or a government agency).

10.1 Google Play Data Safety

We have completed the Google Play Data Safety form and ensure that the disclosures shown on our Play Store listing accurately reflect the data collection, usage, and sharing practices described in this Privacy Policy. Any data collected by third-party SDKs used inside our app is also declared in the Play Console.

11. Children's Privacy

Our Service is not directed to children under the age of 13 (or under 16 in certain jurisdictions). We do not knowingly collect data from children. If we become aware that a child has provided us personal data, we immediately delete such information in compliance with Google Play Families Policy..

12. Changes to This Policy

We may update this policy occasionally. We encourage users to check this page regularly. Continued use of the app after changes implies your agreement to the updated policy.

13. Legal Compliance

We comply with all applicable data protection laws, including the Information Technology Act (India) and global privacy standards where applicable.

14. Third-Party Infrastructure

We use trusted third-party cloud services to host your data. All such providers are bound by strict data security and confidentiality agreements. They cannot access or misuse your content.

15. Limitation of Liability

Click4Kart Tech Private Limited shall not be liable for:

• User-side errors, such as device misuse or data deletion
• Unauthorized access due to compromised credentials
• Losses due to force majeure (natural disasters, technical failure)

By using our app, you acknowledge that you do so at your own risk, and accept these limitations.

16. Android Auto Backup

Black Box generally supports Android’s Auto Backup feature, available on Android 6.0+ (API 23+).

• This feature securely and automatically backs up your app data to Google Drive (up to 25 MB per app).
• On devices running Android 9 and above, the backup is end-to-end encrypted, with the screen lock PIN/pattern/password protecting the encryption key.
• We have set android:allowBackup="true" in the manifest, and configured res/xml/backup_rules.xml to ensure only selected data (Contacts, Photos, Documents, Notes) are included.
• If users prefer not to back up via Google, they can disable backup from the app settings or Android system settings.

17. In-App Disclosure & Consent

Our app only accesses and backs up data (Contacts, Media, Documents, etc.) when the user explicitly enables the corresponding feature.

• We request runtime permissions only at the time of feature use.
• Before any backup starts, users see a prominent in-app notification/explanation describing data usage and permissions. This complies with Google Play’s “prominent disclosure” requirement.

18. Permissions / Consent

• We request device permissions only at runtime and only when necessary to enable a specific feature (e.g., backing up contacts or documents). Before requesting access, the app displays a clear and prominent in-app disclosure explaining why the permission is needed, in line with Google Play’s disclosure requirements.

19. Data Safety Form

In compliance with Google Play’s Data Safety requirements, we disclose what data we collect, how it is used, and whether it is shared with third parties. This information is available both in this Privacy Policy and in our Google Play Data Safety form.

20. Third-Party SDKs / Services Disclosure

• Our app does not share personal or sensitive user data with third-party SDKs or external partners for advertising or analytics purposes. If we ever integrate any third-party services (e.g., crash reporting, analytics, or cloud storage), we will clearly disclose their names, purpose, and data usage in this Privacy Policy.
• Our app may integrate third-party SDKs or libraries (e.g., analytics, crash reporting, or cloud services). These services may collect limited information as required for their functionality. We ensure that such providers comply with industry-standard security and privacy practices.

21. Data Storage & Location Transparency

All user data is stored securely on [local device storage / our secure servers]. We do not transfer or store personal data outside the user’s device unless explicitly mentioned (e.g., when the user chooses to back up data). We do not use Google Drive or other cloud storage unless clearly disclosed.

22. Data Safety Form

In compliance with Google Play’s Data Safety requirements, we disclose what data we collect, how it is used, and whether it is shared with third parties. This information is available both in this Privacy Policy and in our Google Play Data Safety form..

23. Google Play Data Safety Declaration

While filling out the “Data Safety Form” in Google Play Console, we have truthfully and accurately declared the following:

• Collected Data Types: Mobile number (OTP), Contacts, Photos, Documents, Notes, etc.
• Purpose: User authentication, encrypted backup, device-to-device data restoration.
• Encryption: Data encryption in transit and at rest.
• User Rights: Data access, selective deletion, auto-backup toggle, full account & data deletion (30-day grace policy).
• No third-party sharing: Data is not shared with advertisers or unrelated third parties.

24. Data Residency

All backup data is stored on servers hosted in India and managed in accordance with local data protection standards and contractual safeguards.

25. Policy Updates & Versioning

This Policy is versioned and timestamped. Material changes will be reflected on this page with an updated “Last Updated” date and, where appropriate, in-app notification.

26. Security & Breach Notification

We follow industry-standard security practices (encryption in transit and at rest, access controls). In the unlikely event of a confirmed data breach that affects user data confidentiality, we will:

• Notify affected users promptly via in-app message and/or email.
• Notify regulators/authorities as required by applicable law.
• Provide guidance on steps users should take and technical remediation where appropriate.

27. Grievance Officer (India)

In accordance with applicable Indian laws, you may contact our Grievance Officer for questions or grievances related to this Policy or your data:

28. Jurisdiction

This policy and any dispute arising from it shall be governed by the laws of India. Any legal proceedings shall be under the jurisdiction of courts located in your operating city Delhi.

29. Future Developer Verification

We are committed to complying with all current and future Google Play developer verification requirements to ensure transparency and user safety.

30. Policy Versioning

This Privacy Policy was last updated on September 10, 2025. We’ll notify users via in-app message or website alert for any material changes.

31. Grievance Officer / Contact

For any questions, concerns, or complaints regarding your data, please contact our Grievance Officer at:

Email: support@click4kart.com

Company: Click4Kart Tech Private Limited

WhatsApp Only: 8447222999