Blakcat is a VPN service: our apps create an encrypted connection between your device and our servers, and your internet traffic leaves from there. This policy explains what information we handle when you use the Blakcat apps, our website and our support channels, why, for how long, and the choices you have. It applies on every platform where Blakcat is offered.
In short
We do not monitor, record or store your online activity. Our servers keep no record of:
Because we do not keep this information, we cannot produce, sell or disclose it. To route your connection, a server must of course handle your traffic and know your device's address while you are connected; that happens in memory and is not written down.
This commitment covers the servers we operate. If you choose a Residential location, your connections also pass through a third-party network; see Residential locations.
Our servers block connections to known advertising, tracking and malicious domains. Each time they do, we add one to a counter for your account for the current month, by category (advertising and tracking, or malicious and phishing sites) and, for advertising and tracking, by the company that runs the blocked service (for example "Google" or "Meta"). We do not record the blocked address, the website or app that made the connection, when it happened, or your IP address. The counters are used only for your monthly protection report in the app, and are deleted as soon as that report is sent.
If you have a Premium Dedicated Server or Dedicated Residential IP, we record the country you requested, which server or residential exit and which exit IP address are assigned to you, and when it was set up, paused and released. Because that exit address is used by you alone, a complaint from a network operator naming it (for example a copyright notice) can be matched to your account. We still keep no record of what you do through it, and act on such a notice only as our Terms describe.
Payments are handled by payment providers; we never receive or store your full card number or your payment account credentials. For each order we keep the plan, amount, currency, payment method, status and dates, and the provider's confirmation of the payment (its transaction reference). When you pay with USDT, the transfer is recorded on a public blockchain, as all such transfers are, and we keep its transaction hash. When you pay through a payment channel that serves mainland China, your IP address is passed to that provider when the order is created, as its checkout requires; we use it at that moment to decide which payment methods to offer and do not store it. The iOS version of Blakcat does not offer in-app purchases or third-party payment.
If you invite others, we record who signed up with your code, the commissions earned, and the payouts made. To pay you, we keep the payout details you give us: a USDT (TRC20) wallet address, or a bank account number (IBAN) and the account holder's name. These are used only to pay you.
If you write to us through the in-app support chat, we store your messages and our replies so the conversation is available on all your devices. Each message you send carries your app version, platform, selected server, connection status and the last connection error shown in the app, so we can help without a round of questions. This is sent only with a message you write. If you email us, we keep the correspondence for as long as we need it to handle your request.
blakcat.app uses no cookies for tracking and no analytics or advertising scripts. It stores your language and currency choice in your browser, and, if you answer the "which platform do you need" poll on the download page, a random identifier so the poll remembers your answer. If you sign in on the website, it keeps your session in your browser the same way the app does.
| Purpose | Information | Legal basis |
|---|---|---|
| Providing your account, connections and plan | Account, devices, sessions, connection credentials, Dedicated assignment | Performing our contract with you |
| Taking payment and paying referral commissions | Orders, payment references, payout details | Contract; keeping accounting records required by law |
| Fixing connection problems and keeping servers reliable | Failure reports and technical logs (3 days) | Our legitimate interest in a service that works |
| Diagnostic logs | The log your app uploads (48 hours) | Your consent, given in a support conversation |
| Counting active users | Device activity (40 days) | Our legitimate interest in planning capacity |
| Monthly protection report | Protection statistics | Contract (it is part of the service) |
| Answering you | Support conversations | Contract; our legitimate interest in helping you |
| Preventing abuse and fraud | Rate limits on sign-in, sign-up and other requests, kept in memory only | Our legitimate interest in a secure service |
We do not sell your personal information or share it for advertising. We use the following providers to run the service. Each receives only what its task needs.
| Provider | What for | What they receive |
|---|---|---|
| Amazon Web Services, Hetzner, Vultr | Hosting our servers | They run the machines our servers and account system live on, and carry our servers' network traffic |
| Cloudflare | DNS for our domains and for our servers' lookups; storage of encrypted backups | Domain-name lookups made by our servers (nothing that identifies you); backups they cannot read |
| Residential network providers | Residential locations (Premium) | Connections from our servers to websites; see Residential locations |
| Stripe | Card payments | The payment details you enter on its page; the order amount |
| Payment channels for Alipay and WeChat Pay | Payments from mainland China | The order amount and reference, and your IP address at checkout |
| Resend | Sending and receiving email | Your email address and the emails we send you or you send us |
| Telegram | The messaging tool our support staff use to answer the in-app chat | Your support messages with your account email, plan and the app details listed above |
You do not need a Telegram account to use the support chat. Copies of support messages delivered to our staff through Telegram may remain there after you delete them in the app; you can ask us to delete them.
Premium's Residential locations, including a Dedicated Residential IP, reach websites through a home-broadband IP address that a third-party residential network provider supplies, instead of directly from our servers. We send that provider nothing that identifies you — not your IP address, account, email or device: the connections reach it from our servers, and connections to encrypted (HTTPS) sites stay encrypted end to end. Like any network that carries traffic, it can see which sites those connections go to, when, and how much data they carry. A shared Residential location carries many people's connections together; a Dedicated Residential IP carries only yours, so the provider could tell that its connections come from one customer, though not who. The provider's own record-keeping is outside our control. Our other locations connect directly from our own servers.
We disclose information only when a request is legally binding on us, and only what we hold. Because we keep no activity logs, we cannot say which websites someone visited, or link an IP address seen on the internet to an account — except for a Dedicated Server or Dedicated Residential IP, whose exit address is assigned to one account, as described above.
| Information | Kept |
|---|---|
| Account, devices, plan, orders, referral records, support conversations | While your account exists |
| Technical logs and connection failure reports | 3 days |
| Diagnostic logs (only with your consent) | 48 hours |
| Device activity | 40 days |
| Protection statistics | Until the monthly report is sent |
| Server error logs (which can include the address involved in an error) | 7 days |
| Encrypted backups of our database | Daily backups 30 days; monthly backups 3 months |
You can delete your account in the app. Your account data, including your support conversations, is permanently removed 30 days after you ask, and is gone from our backups within 3 months after that. Where the law requires us to keep accounting records of payments, we keep those records only for as long as it requires.
You can ask us to give you a copy of your information, to correct it, to delete it, or to stop or restrict a use of it, and you can withdraw a consent you gave. Many of these you can do yourself in the app: change your email or password, remove devices, or delete your account. For anything else, write to support@blakcat.app from the email address on your account; we answer within 30 days and do not charge for it. If you are in the European Economic Area or the United Kingdom, you can also complain to your data protection authority.
Our servers are in many countries, so that you can choose where your connection leaves from. Our account system runs in Japan, and our providers may process information in other countries, including the United States. Where the law requires it, we rely on appropriate safeguards for such transfers.
Traffic between your device and our servers is encrypted. Passwords are stored as one-way hashes, credentials on your device are held in the platform's secure storage, access to our systems is limited to the staff who run them, and our backups are encrypted with a key our servers do not hold.
Blakcat is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.
We may update this policy. The date at the top shows the latest version. We will tell you about material changes in the app or by email before they take effect.
Questions or privacy requests: support@blakcat.app