Privacy Policy

Last updated: October 22, 2026 · DRAFT — pending legal review

1. Who We Are

The Black Exchange is operated by The Black Exchange LLC (“we,” “us”), a Missouri limited liability company. This policy explains what we collect through our website (theblkexchange.com) and The Black Exchange app for iPhone, and why. We do not sell your personal information, and we do not track you across other companies’ apps or websites.

2. Information We Collect

Information you give us

• Account — your name or display name, email address and password (stored only in hashed form by our sign-in provider), and, if you add them, a handle, profile photo and home corridor.
• Registration details — on our website, your home ZIP code, mobile number, and whether and when you agreed to receive text messages.
• Mobile number verification — in the app, your mobile number and the fact that you confirmed it with a code we texted you. We use it to keep to one account per person and to protect perks from misuse.
• Membership — your plan, status, billing dates and Founding number. Card details are collected and stored by our payment processor, Stripe; we never see or store your full card number.
• Invitations — your personal referral code, who invited you (if anyone), and how many people joined through your link.
• Business recommendations and requests — details you submit about businesses you’d like to see in the network, and requests you send through Ask the Exchange.
• Activity in the app — perks you claim, Passport stamps, status and Season points, Exchange Academy progress and quiz answers, Build mission submissions, and event RSVPs.
• Photos you choose — a profile photo or Build mission evidence, and, for businesses, photos for listings and posts. The app only accesses photos you pick.
• Businesses — business name, category, address, hours, owner and staff names and contact details, ownership information, perks and posts.
• Support — messages you send us.

Information collected when you use the service

• Visit verifications — when you tap a counter stand: the stand and business, the time, the perk applied, a one-time proof code, the app version, and a scrambled (hashed) identifier for your device. We use these to verify visits and prevent fraud.
• Location — only with your permission:
  • Counter scans. When you scan a business’s counter stand, the app sends your location once with that scan so we can confirm you’re at the business. We don’t store your location. We keep only whether the scan was at the business and a distance rounded to 25 meters. The business sees totals only, never who scanned or where you were.
  • Directory “near me.” Your current location is sent with that one search to find nearby businesses. We don’t store it.
  • Perk reminders. If you allow location “Always,” your phone watches for when you are inside a participating business where you hold a perk. This is worked out on your phone. We never receive or store your location; we only learn whether a reminder was shown, opened or skipped, and for which business.
• Business links — when anyone opens a business’s Exchange link (for example from a social post or a receipt), we record the approximate area our hosting provider derives from the internet connection: city, state and the first 3 digits of the ZIP code. We don’t link it to an account or a person. The business sees totals by area, and areas with fewer than 5 opens are grouped together.
• Notifications — your device’s notification token, the permission choices you make, and which notifications were delivered and opened.
• Usage — pages and screens viewed, buttons tapped, Directory searches, a random app ID and session ID, app version, and the campaign link that brought you to us. We don’t use third-party advertising or analytics tools.
• Crash reports — when the app hits an error: what went wrong, which screen it happened on, the app version, your iPhone model and iOS version, and the random app ID. Crash reports aren’t attached to your account and never include your email, phone number or location.
• Camera — used only to scan a stand’s QR code. Camera images are not stored or sent to us.

Information from businesses that connect Square

• Card payments at those businesses — the time, amount and location of each card payment, the card brand, the last four digits, and Square’s card fingerprint (a code that recognizes the same card; not the card number). We scramble (hash) the fingerprint with a secret key before storing it, and we never receive full card numbers, names or receipts.
• Matching (only if you turn it on) — purchase matching is off until you say yes when the app asks. With it on, we compare the time of a payment with your taps at the same business. If the same card appears next to your taps on two different days, the app asks whether it is your card. It is linked to your account only if you say yes. Once linked, payments with that card at connected businesses confirm your visits. We record each answer you give, and when.
• Payments not linked to anyone — their card details (fingerprint, brand and last four) are erased within 30 days. Totals without card details may be kept for the business’s own reports.
• Not for marketing — card payments are never used to choose who receives a business’s offers or messages, and businesses see totals only, never which payments were yours.

3. How We Use It

To provide membership and perks, verify visits and prevent fraud, process payments, verify businesses, send the notifications, reminders, emails and texts you’ve agreed to, give businesses their results, run the Founding Registry and Seasons, apply the 30-Day Money-Back Guarantee (we check whether you redeemed any perks in that period and, if not, refund your first charge through Stripe), support you, and comply with law. Payment amounts are used only in totals; we never use how much you spend to rank you or set your status. We use your ZIP code to understand where members live, so we can bring businesses to the neighborhoods with the most members. We use your mobile number for texts only if you opted in; reply STOP at any time to opt out. To learn whether features help, we sometimes leave a small, random group of members without a feature (such as perk reminders) and compare.

4. What Others Can See

• At the counter, the cashier sees what is on your Proof Screen: your display name, Founding number, status tier, the perk and the proof code.
• Businesses see totals for their own business, such as verified visits, unique and new members, repeat visits and perks redeemed. We do not share your email address, mobile number or home address with businesses. A request you send through Ask the Exchange is shared only with the businesses we match it to, without your contact details.
• The public can see your Founding number and chosen name on the Founding Registry only if you opt in, and your display name and points on Season leaderboards.
• Your invite link shows your first name to people who open it — never your last name, email, phone number or ZIP code.
• Aggregated area counts. We may share aggregated, non-identifying counts with businesses and the public — for example, the number of members in a ZIP code. These counts never include names, email addresses, phone numbers, or other contact details.

5. Service Providers

We share information only with service providers that process it on our behalf, and where required by law:

• Supabase — database, sign-in and file storage
• Stripe — payments and refunds
• Square — card payment details from businesses that choose to connect Square (read-only)
• Twilio — sends the code that verifies your mobile number
• Vercel — website hosting
• Resend — email delivery
• Expo and Apple Push Notification service — app notifications
• Apple Maps — maps and directions in the app, under Apple’s own privacy policy
• Our text-message provider — only if you opted in to texts

6. Retention

We keep your information while your account is open. Card details from payments that are never linked to a member are erased within 30 days. When you delete your account, we delete or de-identify your personal information within 30 days, except records we must keep by law (such as billing and tax records) or to prevent fraud and resolve disputes. We may keep de-identified totals that can’t be linked to you.

7. Your Choices and Rights

• See and correct your account details in the app or on the website.
• Delete your account in the app (Settings → Delete account) or by emailing us.
• Turn off notifications, location and camera access at any time in your iPhone’s Settings.
• Remove your name from the Founding Registry in the app’s Settings.
• Unlink a card, say no to a card prompt, or turn purchase matching off completely in the app (Settings → Purchase matching).
• Unsubscribe from marketing email using the link in any email, and reply STOP to stop texts.
• Depending on where you live, you may have additional rights; contact us to exercise them.

8. Security

We protect information with administrative and technical safeguards, including encryption in transit and database row-level security that limits each account to its own data. No system is perfectly secure.

9. Children

Accounts are for people 18 and older. The service is not directed to children, and we do not knowingly collect information from anyone under 13. If you believe a child has given us information, contact us and we will delete it.

10. Changes and Contact

We may update this policy; material changes will be posted here with a new date. Questions or requests: support@theblkexchange.com, or see our Support page. By mail: The Black Exchange LLC, 1503 Main Street, Suite 262, Grandview, MO 64030. By phone: (913) 735-7232.