Privacy Policy

Last updated 4 September 2026

BlackRep is an adult site for people aged 18 and over. To run a dating service we have to collect things that are genuinely private — your ethnicity, your gender, details about your sex life, sometimes your location and your ID. This page says exactly what we hold, who can see it, and how to get rid of it.

Short version: we do not sell your data, we do not run advertising trackers, and nothing you enter is shared with anyone outside the three suppliers named in section 6.

1. Who is responsible for your data

The controller of your personal data is blackrep.app.

For anything in this policy — questions, requests, complaints — write to privacy@blackrep.app.

2. You must be 18

This site is not for under-18s. We ask for your date of birth at registration and refuse accounts below 18. If we find out an account belongs to a minor we delete it and everything on it immediately. If you believe a minor has registered, tell us at the address above.

3. What we collect

Things you type in

Account — email address, password (stored only as a bcrypt hash, never in readable form), display name, date of birth.
Your name — first and last name if you register for dating. Your last name is never shown to another member; it exists so an administrator can compare it against an ID document if you choose to upload one.
Profile — gender, ethnicity, city, height, body type, bio, photos.
Intimate details — the optional stats on your profile. Depending on your role these are body count, ovulation date, date of last sex, penis size, date of last ejaculation, and circumcision status. These are optional. Leave them blank and nothing breaks.
Who you want to see — your preference switches for t-girls, black women and Asian women, and your partner link if you set one.
Anything you write — messages, comments, bug reports, reports about other members.

Things you upload

Photos — profile and gallery pictures. When you upload one we record a fingerprint of it (a checksum and a perceptual hash), its dimensions, and any camera or software details embedded in the file. This is used to spot the same photo being used on two accounts, which is how we catch people using someone else's pictures.
Videos — the file, your title, description, tags, and the four legal confirmations you tick, recorded with the time and the IP address you ticked them from.
ID documents — entirely optional. Nothing on the site is locked behind it; it exists only so members who want to prove who they are can. ID files are stored outside the public web root, are never shown to other members, and are replaced or removed rather than accumulated.

Things we record automatically

Your IP address at sign-up, each time you log in, and when you confirm a video upload.
An approximate country and city derived from that IP, so we can flag accounts whose stated location does not match where they connected from, and notice when an account suddenly logs in from a different country. This is an anti-fraud measure against fake, bot and taken-over accounts. Login records are kept for 90 days.
Precise location (latitude and longitude) — only if you turn on the map feature. You can leave it off.
Use of the site — logins, login streak, failed login attempts, likes, passes, matches, watch history, and which days you were active.
Administrator actions affecting your account, in an audit log.

4. Sensitive data, and why we are allowed to hold it

Your ethnicity, your gender identity, your sexual preferences and the intimate details above are special category data under Article 9 of the UK/EU General Data Protection Regulation. So is an ID document, and so is precise location when it reveals those things.

We rely on your explicit consent (Article 9(2)(a)) to process it. You give that consent when you fill these fields in, and this is the point of the service — a dating site organised around ethnicity cannot work without knowing it. You can withdraw consent at any time by clearing the fields, or by deleting your account (section 9). Withdrawing does not undo processing that already happened, but it stops it going forward.

5. Why we process it

Purpose	Legal basis
Creating and running your account	Performance of a contract
Showing you to other members, and them to you	Performance of a contract, plus explicit consent for the sensitive parts
Sending you the account confirmation email and service notices	Performance of a contract
Blocking bots, duplicate accounts and stolen photos	Legitimate interests — keeping the site usable and its members safe
Comparing your stated city against your IP country	Legitimate interests — fraud prevention
Reviewing uploaded videos before publication	Legal obligation, and legitimate interests
Keeping records of consent given at video upload	Legal obligation
Handling reports and moderating behaviour	Legitimate interests — member safety

6. Who else sees your data

We do not sell personal data. We do not share it with advertisers, data brokers or analytics companies, and the site carries no third-party tracking scripts.

Three suppliers process data on our behalf:

Hostinger — hosting and email delivery. Everything above is stored on their servers, in the EU.
Bunny.net (Bunny Stream) — video hosting and delivery. Uploaded videos are stored with them, and your IP address reaches them when you watch one, as it does with any video host.
ip-api.com — turns an IP address into an approximate country and city for the fraud check in section 3. Your IP address is sent to them for this. The result is cached for 30 days so the same address is not looked up repeatedly.

We will also disclose data where we are legally required to — a valid court order, or a law-enforcement request we are obliged to answer.

7. What other members can see

This is worth being precise about, because it is the part people get wrong.

Visible to members who can see your profile: display name, first name, age, gender, ethnicity, city, height, body type, bio, your photos, and any intimate stats you filled in.
Never visible to another member, ever: your last name, your email address, your password, your IP address or the country we derived from it, your ID document, your exact coordinates, and your notes on other people.
Who your profile is shown to depends on your role and on other members' preference switches. It is not public — you must be logged in with a confirmed account to see anyone.
Body-count history. Every change you make to your body count is kept with its date and any note you wrote, and is shown to the same people who can see the number itself.
Messages from white men. Off unless you switch it on in Settings. When on, a white man who follows you can write to you (text only, five messages a day until you reply); switching it off closes those chats on his side. He is never told anything about you that your profile does not already show.
Your creator page on the video site shows the same dating profile stats to any logged-in member, and links to your dating card.
Gallery videos you upload in the dating app are also submitted to the video site's review queue unless you untick that option; nothing is published without an admin's approval.
Following. A browse-only account (a white man) can follow your profile. A follower is told when you match, when your body count changes, when you add a photo, and when a video of yours is approved — never who you matched with, and never anything on the "never visible" list above. You are not shown who follows you; blocking a member ends their follow.
Blocking removes you from that person's view and them from yours, in both directions.

Search engines are asked not to index the member areas. Anything you write in a message or a comment is readable by the person or people it is addressed to, and by administrators handling a report.

8. How long we keep it

Your account data — for as long as the account exists.
After you delete your account — see section 9.
Video upload consent records (who confirmed what, when, from which IP) — kept for as long as the video is published and for 7 years afterwards, because we are required to be able to evidence them.
Moderation and audit records — up to 2 years, so a pattern of behaviour can still be seen after the fact.
IP-to-location lookups — 30 days.
Login records (time, IP, derived city and country, browser) — 90 days.
Watch history on the video site (which videos, how far you got) — for as long as the account exists; it is erased with the account.
Unconfirmed sign-ups — if you register and never confirm your e-mail address, the sign-up and everything entered with it is deleted after 7 days.
Login sessions — a session token lasts 15 minutes and a sign-in lasts until you log out or it expires.

9. Deleting your account

You can delete your account yourself, from your profile settings. When you do:

Your profile disappears from the site immediately and you are signed out everywhere.
Your email address, name, date of birth, ethnicity, gender, city, coordinates, bio, intimate stats and preference settings are erased.
Your photos and any ID document are deleted from our servers and from the delivery network.
Messages you sent to other people remain in their conversation, shown as from a deleted account — we cannot edit someone else's copy of a conversation they took part in.
Records we are legally required to keep — chiefly the consent confirmations attached to any video you published — are retained for the periods in section 8 and nothing else.

If you would rather we did it for you, or you cannot get into your account, email privacy@blackrep.app and we will do it within 30 days.

10. Your rights

Under the GDPR you have the right to:

See what we hold about you, and get a copy of it.
Correct anything wrong — most of it you can edit yourself in your profile.
Have it erased — section 9.
Restrict or object to how we use it, including anything we do on the basis of legitimate interests.
Take it with you in a portable, machine-readable form.
Withdraw consent for the sensitive data in section 4, at any time.

Email privacy@blackrep.app to exercise any of these. We will reply within one month. There is no charge.

We do not make any automated decision that produces a legal or similarly significant effect on you. The fraud checks described above flag accounts for a human to look at; they do not act on their own.

If you think we have handled your data badly you can complain to your national data protection authority. In the Czech Republic that is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).

11. Security

The whole site is served over HTTPS. Passwords are stored as bcrypt hashes and cannot be read back, by us or by anyone who obtained the database. ID documents are kept outside the public web area. Sign-in tokens are short-lived and are revoked when you log out, delete your account, or an administrator suspends it. Repeated failed logins lock an account temporarily.

No system is perfectly secure. If we ever suffer a breach that puts you at risk, we will tell you and the supervisory authority, as the law requires.

12. Cookies and browser storage

We set no advertising or analytics cookies, and there are no third-party trackers on the site.

We store three things in your browser's local storage, all of them strictly necessary to keep you signed in: your access token, your refresh token, and a cached copy of your own profile. Clearing your browser data signs you out. That is the whole of it.

13. Where your data is

Data is stored on servers in the European Union. Bunny.net operates a global delivery network, so a video you upload may be cached on servers outside the EU in order to play quickly for someone watching from there; Bunny.net's transfers are covered by Standard Contractual Clauses. ip-api.com receives IP addresses only.

14. Changes to this policy

If we change anything that matters, we will change the date at the top and tell members through a notice on the site. Continuing to use BlackRep after that means you accept the updated policy.

15. Contact

privacy@blackrep.app — for privacy questions, access requests, deletion requests and complaints.