BLACKSITE
Privacy policy
BLACKSITE is a private GPS tracking service for vehicles and assets, run by Daniel Redetzke (redetzke.aero). It is made up of the BLACKSITE website and the BLACKSITE iOS app. This policy explains what data BLACKSITE stores, why, who it is shared with and what you can ask for. There is no public sign-up: accounts are created by an administrator for the people who use the service.
What we store
- Your account: your username, your role (admin or user), which trackers you may see, your password as a one-way hash (never the password itself), and, if you turn on two-factor sign-in, its secret and hashed recovery codes. The time and IP address of your last completed sign-in are also recorded.
- Sign-in sessions: a hashed session token, so you stay signed in for up to 30 days or until you sign out.
- Notifications on your iPhone: if you allow notifications in the app, the push token Apple gives your phone, tied to your sign-in, so alerts can reach it. It is deleted when you sign out.
- Tracker data: the positions (latitude, longitude, speed, time) and device status (battery, voltage, ignition and similar readings) that each GPS tracker reports. This describes the tracked vehicle or asset, not the phone or computer you use BLACKSITE on.
- Alerts: alerts raised for a tracker, who acknowledged them, and a log of alert emails, text messages and calls sent, including the recipient's address or number.
- Links you share: police view and share links, with who created them, when they expire or were turned off, and how often they were opened.
- Server logs: for security and troubleshooting, the server records each request: when it was made, which page or action, the result, the signed-in username if any, and the IP address it came from. The log is replaced as it grows, so older entries are removed after a while.
- Settings on your device: the website remembers your theme and map style in your browser, and the app remembers your map style on your phone. These never leave your device.
BLACKSITE does not use the location of your phone or computer. It has no advertising, analytics or tracking across apps or websites, and it does not sell or rent data.
Why we use it
Only to run the service: to sign you in and keep your account secure, to show trackers on the map and in their history, to raise and send alerts, and to let you share a tracker's live location when you choose to. The legal basis is the legitimate interest of the tracker owner in locating and protecting their vehicles and assets, and the performance of the service for the people who use it.
Who can see it
- Admins can see all trackers and manage accounts. Users see only the trackers an admin has assigned to them.
- Anyone with a police or share link can see that one tracker's live position, without signing in, until the link expires or is turned off. Links carry no account details.
- Service providers that process data on our behalf:
- SweTrack, the tracker platform that sends positions and statuses to BLACKSITE and stores its own copy;
- Cloudflare, which carries traffic to the website and sees visitors' IP addresses;
- Postmark (email) and Twilio (text messages and calls), when alert notifications are turned on, and Apple Push Notification service for notifications in the app;
- Open-Meteo (weather), which receives a tracker's position rounded to about 1 km when an alert opens, to look up the wind there, with no tracker name or account details;
- on the website, CARTO and Esri (map tiles), Google Fonts (fonts) and unpkg (map software), which receive your IP address when your browser loads them; in the app, maps come from Apple Maps.
How long we keep it
Tracker positions, statuses and alerts are kept until an administrator removes them. BLACKSITE has tools to delete a tracker's data, delete data older than a chosen age, or clear everything. Accounts are kept until an administrator deletes them, which also removes their sessions and any share links they created. Share links stop working when they expire, after at most 3 days.
Security
All traffic uses HTTPS. Passwords and session tokens are stored only as hashes, two-factor sign-in is available, repeated failed sign-ins are rate limited, and everyone sees only the trackers they are allowed to see.
Your rights
You can ask for a copy of the data about you, and ask for it to be corrected or deleted. Ask the administrator who gave you your account, or email [email protected]. If you are in the EU or UK, you may also complain to your data protection authority; in Ireland that is the Data Protection Commission.
Children
BLACKSITE is not meant for children under 16, and we do not knowingly hold accounts for them.
Changes
If this policy changes, the new version is published on this page with a new date.