Private by design.

Who is responsible

The controller for Blackmail Me is Eldhorn GmbH, c/o ExpertFid & Audit SA, Blegistrasse 11B, 6340 Baar, Switzerland. Contact kontakt@eldhorn.com about your data.

Commercial register: CH-170.4.025.019-2. UID: CHE-412.206.208.

Your information

Photos, audio and videos are encrypted on the sender’s iPhone before upload. The service stores ciphertext, encrypted key envelopes, account and billing identifiers, recipient email addresses, pact schedules and generic completion receipts. It does not receive decryption keys or raw location, HealthKit or Screen Time measurements.

Recipients need the original private link and email verification. The browser decrypts locally. That relies on trustworthy app and browser code; a compromised device or modified viewer can expose content.

Retention and deletion

Verified App Store billing events awaiting reconciliation are retained for up to 30 days. They contain only transaction, account and product identifiers, purchase type and quantity, verification and event times, and any expiry or revocation dates—not raw signed receipts, email addresses, storefronts or prices. Applied events are removed with the billing update. Expired unresolved events leave only one-way transaction and account hashes for the service’s lifetime to prevent replay. Account deletion removes the event details and retains only those replay-prevention hashes.

Closing a pact removes service access. Copies already saved by a recipient cannot be recalled. Unactivated drafts expire after seven days; released material expires after 48 hours. Unresolved pacts, including cancellation holds, are deleted seven days after the original pact end.

Account deletion removes account details, pact records and stored material. For the service's lifetime, we retain one-way account and purchase-transaction hashes with deletion dates to block old sessions and duplicate purchase claims. These records contain no email, media or pact details. If account-index cleanup is interrupted, temporary opaque identifiers remain until automatic cleanup finishes; they contain no email or credentials. Apple subscription cancellation is separate.

Services we use

• Cloudflare hosts the service, stores encrypted material and service records, and delivers sign-in codes and recipient notices by email.
• Apple provides Sign in with Apple, App Store billing and Apple Maps place searches.
• Google handles authentication if you choose Google sign-in when it is available.

You can request account deletion in the iPhone app or contact us with a privacy request.