Legal

Privacy Policy

Effective Date: May 12, 2026

This Privacy Policy describes how Crank Technologies, Inc. (“Crank Technologies,” “we,” “us,” or “our”) handles personal information collected through the Blackcard service.

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, phone number, and date of birth (for age verification). You may optionally provide a profile photo.

Membership Information

We collect information about your memberships, including the issuing venue, membership tier, associated perks, and redemption history.

Device & Technical Information

We automatically collect device identifiers, iOS version, IP address, app crash logs, and general usage analytics to improve the Service.

Location Data

We collect location data only when you use scan verification features at a venue, and only with your explicit opt-in consent. Location data is not collected in the background.

2. How We Use Information

  • Provide and operate the Service, including membership management and verification
  • Verify your membership status at participating venues
  • Communicate updates, perk changes, and service notifications
  • Detect and prevent fraud, including QR code sharing, duplicate scans, and unauthorized access
  • Analyze usage patterns to improve the platform and user experience
  • Comply with legal obligations

3. How We Share Information

With Issuing Venues

We share your membership information with the venue that issued your Blackcard. This is necessary for the venue to manage your membership and fulfill associated perks.

With Service Providers

We share information with trusted service providers who assist in operating the Service, including Stripe (payment processing), Apple (app distribution), analytics vendors, and crash reporting services. These providers are contractually obligated to protect your information.

For Legal Compliance

We may disclose information in response to valid legal process, including subpoenas, court orders, or government requests.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction.

We never sell your personal information to advertisers or data brokers.

4. Data Retention

We retain your personal information for as long as your account is active, plus 24 months for transaction and audit purposes. Certain financial records may be retained for up to 7 years to comply with tax and regulatory requirements. You may request deletion of your account at any time (see Your Rights below).

5. Your Rights

Depending on your jurisdiction, you may have the following rights:

  • Access: Request a copy of the personal information we hold about you
  • Correction: Request correction of inaccurate information
  • Deletion: Request deletion of your personal information
  • Portability: Request an export of your account data in a standard format
  • Opt-out of marketing: Unsubscribe from promotional communications at any time
  • Do Not Sell: We do not sell personal information, but we offer this right regardless under CCPA

To exercise any of these rights, contact us at support@crank.social.

6. Children's Privacy

The Service is not intended for users under 18 years of age (or 21 for alcohol-venue features). We do not knowingly collect personal information from minors. If we discover that we have collected information from a minor, we will promptly delete it. If you believe a minor has provided us with personal information, please contact us at support@crank.social.

7. Security

  • All data is encrypted in transit using TLS 1.3
  • Data at rest is encrypted using AES-256
  • QR codes are signed tokens that rotate regularly; screenshot-sharing is detectable and results in automatic invalidation
  • We are committed to achieving SOC 2 Type II compliance as the platform scales

No system is 100% secure. While we implement commercially reasonable security measures, we cannot guarantee absolute security.

8. International Users

If you access the Service from outside the United States, your data will be transferred to and processed in the United States. By using the Service, you explicitly consent to this transfer and processing. We will take reasonable steps to ensure your data is treated in accordance with this Privacy Policy.

9. Cookies & Tracking

On our marketing website, we use:

  • Essential cookies: Required for basic site functionality
  • Analytics cookies: Help us understand how visitors use the site

We do not use advertising tracking cookies by default. See our Cookie Policy for more details.

10. Third-Party Links

The Service may contain links to third-party websites, including venue websites, the Apple App Store, and Stripe. These sites have their own privacy policies, and we are not responsible for their content or practices. We encourage you to review the privacy policies of any third-party sites you visit.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice via email and/or in-app notification. The “Effective Date” at the top of this page indicates when the policy was last updated.

12. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at:

support@crank.social

Postal address: [To be provided]