Privacy notice
Version 1 · 25 September 2026
This notice explains what personal data blackbrake.dev collects, why, and what you can do about it. It is written to meet the EU General Data Protection Regulation (GDPR) and the Spanish data protection law (LOPDGDD).
Who is responsible for your data
The controller is the natural person who runs the blackbrake project, an individual resident in Spain acting without any company or legal entity.
- Contact for anything related to your data: hello@blackbrake.dev
- Security reports: security@blackbrake.dev
The full identity of the controller is disclosed on request to any data subject exercising their rights and to the Spanish Data Protection Agency (AEPD).
What we collect, and what we don't
If you join the list (the "Notify me" form):
| Data | Why |
|---|---|
| Your email address | To write to you when blackbrake is ready |
| The language of the page you used | To write to you in that language |
| Date and time of your consent, and the version of the consent text | To be able to prove your consent, as the law requires |
| Whether you have confirmed your address | To know who confirmed and delete who did not |
We do not store your IP address with your email, we do not build profiles and we do not use analytics. The public site sets no cookies; only the preview area sets one strictly necessary login cookie (see below).
Your address stays unconfirmed until you confirm it. The first email we send will ask you to confirm that you want to stay on the list. If someone entered your address without your permission, ignore that email: unconfirmed addresses are deleted within 30 days. You can also ask us to delete it straight away.
Bot protection. The form uses Cloudflare Turnstile to check that a person, not a script, is signing up. To do that, Cloudflare processes technical signals from your browser (such as your IP address, user agent and TLS fingerprint). We receive a yes/no answer, nothing else.
Product preview. If you have an invitation and enter the preview, Cloudflare Access sends a
one-time code to your email and sets one strictly necessary login cookie (CF_Authorization) for
that area only. Cloudflare keeps an access log (email and time of access).
Why we are allowed to process it (legal basis)
- The mailing list: your consent (art. 6.1.a GDPR). You can withdraw it at any time; withdrawing does not affect what was done before.
- Bot protection: legitimate interest in keeping the site and the list free of abuse (art. 6.1.f GDPR).
- The preview login: your request to enter the preview (art. 6.1.b GDPR); its access log: legitimate interest in keeping the preview secure (art. 6.1.f GDPR).
How long we keep it
- Until you unsubscribe or withdraw your consent.
- Addresses that are not confirmed after the first email are deleted within 30 days.
- If the project is abandoned, the list is deleted within 90 days.
Who else processes it
- Cloudflare, Inc. hosts the site, the database, the bot check and the preview login as our processor, under its data processing agreement.
- For one purpose Cloudflare acts on its own account: it also uses the Turnstile signals to improve its bot detection, as an independent controller under its Turnstile privacy addendum.
- Cloudflare may process data outside the European Economic Area; those transfers are covered by the EU–US Data Privacy Framework, to which Cloudflare is certified, and by the European Commission's standard contractual clauses.
We do not sell, rent or share your data with anyone else. Nobody else receives the list.
Your rights
You can ask to access, correct or delete your data, to restrict or object to its processing, to receive it in a portable format, and to withdraw your consent at any time. Write to hello@blackbrake.dev from the address you signed up with; we answer within one month. To unsubscribe, write to that address; once we start sending email, every message will also carry a one-click unsubscribe link.
If you think your data has been mishandled, you can complain to the Agencia Española de Protección de Datos (aepd.es).
Security
The site is served only over HTTPS with a strict security policy, loads no third-party code except the bot check on the sign-up form, and keeps the database in the controller's Cloudflare account. Access to the list is limited to the controller.
Children
blackbrake.dev is not directed to children. Do not sign up if you are under 14.
Changes
If this notice changes, the new version will be published here with a new date. If a change affects how your data is used, we will ask for your consent again.