Black UI ("Black UI", "we", "us") is operated by Thoiba Trader, Lanka, Hojai, Assam, India. This Privacy Policy explains what information we collect when you use the Black UI website (blackui.thoibatrader.com) and the Black UI app (web and Android), how we use it, who we share it with, and the choices you have. By signing in to or using Black UI you agree to this policy.

1. Information we collect

Google account information (when you sign in)

Black UI uses Sign in with Google so we can identify you and keep your account separate from everyone else's. When you sign in, Google shares with us only your:

• name,
• email address, and
• profile picture.

We request only the basic sign-in scopes (openid, email, profile). We do not ask for, and cannot access, your Gmail, Google Drive, contacts, calendar or any other Google data, and we never see your Google password.

Your Black UI account record

After you sign in we create a unique Black UI user ID for you (a random-looking code such as u_…) and keep a small account record on our servers containing: your user ID, email address, name, the time of your first and most recent sign-in, how many times you have signed in, and your plan, coin balance, ticket balance and usage-limit information. We also keep a history of changes to your coin and ticket balances (for example sign-up grants, purchases, usage and bonuses, including which AI model was used and how much), and your payment order records (the pack, amount, status and payment reference). We do not store your raw Google account identifier — the user ID is derived from it with a secret key.

Billing details and GST invoices

Black UI is run by a GST-registered business, and Indian GST law requires us to issue a tax invoice for what you buy. For services delivered online to a person who is not GST-registered, the invoice must show the customer's state, and that state also decides whether CGST + SGST or IGST applies (the “place of supply”). That is why, before your payment, we ask you to choose your billing state, and we do not start a payment without it.

• Personal purchases (B2C). We store only your state. We do not ask for or store your name, address, phone number or PAN for the invoice.
• Business purchases (B2B) — optional. Only if you tick the business-invoice option, we also ask for and store your business name, GSTIN and business address so they can appear on your invoice. We check that the GSTIN is correctly formed and that its first two digits match the state you chose. If you are a sole proprietor, this information may identify you personally, so add it only if you need a GST invoice (for example, to claim input tax credit).
• Your saved details. Your billing state (and business details, if you added them) are saved against your account so you are not asked again. You can view and change them in the Shop in the app at any time (you can also remove your business details there), and you can ask us to delete them as described in Section 7. Changes apply to future purchases only.
• The invoices themselves. For every successful purchase we keep an invoice record: invoice number and date, what you bought, the amount and tax split, the place of supply (your state), the payment and order reference and, for a business invoice, the business name, GSTIN and address as they were at the time of purchase. An invoice is an accounting record, so changing your billing details later does not alter an invoice that was already issued. You can view and download your invoices from the Shop in the app; the PDF is created on your own device.

We do not send your billing state or business details to Razorpay or to any AI provider. We use them only for invoicing, GST compliance, support and preventing abuse.

Who at Black UI can see your account record

The account record described above can be viewed by the operator of Black UI (Thoiba Trader) through a private administration dashboard that is separate from this website and protected by a password and a one-time code. We use it to run the service, give you support, check balances and payments, prevent abuse, and, at our discretion, add bonus coins or tickets to an account and send you an email about it (see Section 9 of the Terms of Service). We keep a log of bonus credits added and emails sent through it. The operator can also look up your billing state, any business details you saved and your invoice records in our database when needed for support, accounting and GST filing. This access covers only your account, billing and payment records; it does not include your chats, files, API keys, tokens, keystore password or Google password, which stay on your device or with Google as described in this policy.

Your messages and files — stored on your device, not ours

Your conversation history, app settings, and your login session live only in your own browser or app storage (IndexedDB and localStorage) on your own device, kept separately for each signed-in account. When you send a message, it passes through our backend (hosted on Cloudflare) to the AI provider that produces the reply; our backend relays the content and returns the response, but does not save the content of your messages or files on our servers, and we do not use your content to train our own models.

Screenshots and store images

If you ask Black UI to capture screenshots of your app, the capture runs inside your own GitHub repository and GitHub Actions, using your own GitHub token; the screenshots stay in your GitHub account and are shown to you in the chat. To start a capture, the dashboard obtains a short-lived permit from us tied to your account and stores it as a secret in your own repository; it is used only to confirm that the capture is allowed.

If you attach your own screenshots and ask for store-ready images, the images you attach are processed by the AI provider like any other attachment (see Section 4). The designed images themselves are drawn on your device in your browser and are not uploaded to our servers.

API keys, tokens and the APK signing password

Any API key or token you choose to add — for example your own Claude API key or GitHub token — is stored only on your device and sent directly from your device to the provider it belongs to (Anthropic or GitHub); it does not pass through our servers.

The keystore password you set when building an Android app is encrypted on your device before it ever leaves your browser. It is never transmitted to or stored on our servers, and it is never visible to any AI model (Gemini, Claude, or Groq) used by Black UI. It is used only inside your own GitHub Actions run to sign your app in your own repository. We cannot see it, and we cannot recover it for you if you lose it — see the Guide for details.

Technical information

To deliver the service and protect it from abuse, our infrastructure processes technical request data such as your IP address, browser type and request timing. We use this transiently (for example, for rate limiting) and we do not write IP addresses to our database or application logs. Cloudflare, our hosting provider, may keep its own standard operational and security logs under its own privacy policy.

APK/AAB builder

When you start an Android build we issue a short-lived, signed build permit tied to your user ID so the build can be authorised. The build itself runs in your own GitHub repository and GitHub Actions, not on our infrastructure, and is subject to GitHub's own rate limits and policies, which are outside our control — see the Guide.

2. How we use your information

• to sign you in, recognise you, and keep your data separate from other users;
• to provide the chat, coding-help and builder features you use;
• to apply fair-use and rate limits per user, and to detect, prevent and investigate abuse (including blocking accounts that misuse the service);
• to process payments for coins, tickets and plan upgrades through Razorpay;
• to ask for your billing state (and, if you choose, your business details), issue GST invoices, keep our accounts and file our GST returns;
• to keep the service secure and working, and to fix bugs;
• to reply to your support, payment and privacy requests;
• to review account, balance and payment records for support and abuse prevention, and to add bonus coins or tickets to an account where we decide to;
• to email you at your sign-in address about your account, for example support replies, payment or balance notices, and notices that bonus credits have been added;
• to comply with the law.

We do not sell your personal information, we do not show advertising, and we do not use your information for advertising or marketing profiles.

3. Google user data — Limited Use

Black UI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use your Google name, email address and profile picture only to sign you in, identify your account and show it back to you inside the app. We do not sell this data, do not use it for advertising, do not transfer it to others except as described in this policy, and do not allow humans to read it except with your consent, for security or abuse investigations, to comply with the law, or for internal operations of the service.

4. How your messages are processed — free vs. paid plans

Every message you send is processed by a third-party AI provider (Google Gemini, and Anthropic Claude if you've added your own key). Which Gemini access tier handles your message depends on your Black UI plan, and this materially changes how Google treats that content:

Free plan — Google's free (unpaid) Gemini API quota

Free-plan messages are served using our shared, unpaid Gemini API quota. Under Google's own terms for this unpaid tier, Google may use the content you submit and the responses generated to provide, improve and develop Google's products and machine-learning technologies, and human reviewers may read and annotate a sample of that input/output for quality purposes (Google disconnects it from your account and API key first). Do not send sensitive, confidential or personal information (passwords, financial details, medical information, government ID numbers, etc.) in a free-plan chat. See Google's Gemini API Additional Terms of Service for the exact current wording.

Paid plans — Google's paid Gemini API

Messages from paid-plan accounts are served using a paid Gemini API key. Under Google's terms, content sent through paid usage is not used by Google to improve its products, and is handled under Google's Data Processing Addendum for services where Google acts as a data processor.

Groq

Black UI also sends a small share of requests — quick background classification/routing decisions, and voice-to-text transcription — to Groq. Groq does not offer a "zero data retention" setting that we can switch on, so we make no such claim here; Groq processes this data under its own privacy policy. Avoid including sensitive personal information in voice input or messages that may be routed to Groq.

Anthropic Claude

Claude is used only if you add your own Claude API key in Settings. In that case your device talks to Anthropic directly for those requests, under Anthropic's privacy policy — that traffic does not pass through our servers.

5. Who processes your information

We share information only with the service providers needed to run Black UI. Each handles data under its own privacy policy:

• Cloudflare — hosting, our backend and account storage (privacy policy).
• Google — Sign in with Google and the Gemini API that answers chat messages (privacy policy).
• Groq — background classification and voice transcription for some requests (privacy policy).
• Anthropic — only if you add your own Claude API key; your device talks to Anthropic directly (privacy policy).
• GitHub — only if you use the APK/AAB builder or the screenshot capture with your own GitHub token; your device talks to GitHub directly, and your build runs on your own GitHub account under GitHub's own limits and policies (privacy policy).
• Razorpay — payment processing for coins, tickets and plan purchases; we do not store your card, UPI or bank details ourselves (privacy policy).
• Resend — delivers the emails we send you (such as support replies and notices about your account or bonus credits); it receives your email address and the content of the email (privacy policy).

Content you send to an AI provider is processed by that provider under its own terms, so please avoid sending information you would not want processed that way. We may also disclose information if required by law or to protect the rights, safety or security of our users or the service, and it may be transferred as part of a business restructuring, in which case this policy will continue to apply to it.

6. Cookies, storage and third-party resources

We do not use advertising or analytics cookies, trackers or session-recording tools. Black UI uses browser storage (see above) to keep you signed in and to save your chats on your device. Our pages and app load some resources from third parties — Google Sign-In, Google Fonts, Font Awesome from cdnjs, Tailwind CSS, Razorpay's checkout script and, only when you download an invoice PDF, the html2canvas and jsPDF libraries (also from cdnjs) — and those providers receive standard connection data such as your IP address and may set their own cookies under their own policies.

7. Retention and deletion

• Account record — kept while your account is active. To delete it, email [email protected] from the address you signed in with, with the subject "Delete my Black UI data". We will delete it within 30 days, except where the law requires us to keep something (for example, payment records for tax purposes). Related records, such as your coin and ticket history and our log of bonus credits and emails sent to you, are handled the same way.
• Invoices and billing records — GST law requires us to keep invoices and the related accounts for a fixed period (currently 72 months, i.e. six years, from the due date of the annual GST return for the year they relate to). For that reason we keep issued invoices, and the billing details printed on them, for that period even if you ask us to delete your account, and delete them once the period is over. During that time we use them only for tax and accounting purposes. Your saved billing profile (state and any business details) is not an invoice, so we delete it when you ask us to delete your data.
• Data on your device — signing out ends your session; clearing your browser or app data removes your chats, settings and any keys you added, permanently and without our ability to restore them.
• Google access — you can review or remove Black UI's access to your Google account at any time at myaccount.google.com/permissions.

8. Security

All traffic between your device and Black UI is encrypted with HTTPS. Login sessions are cryptographically signed and expire, your Google token is verified on our server before an account is created, user IDs do not reveal your Google identity, and sensitive values like your APK keystore password are encrypted on your device before use. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Where we operate

Black UI is currently offered to users in India only, using India-facing Google Gemini free-tier quota and Razorpay for payments in INR. Our infrastructure providers (see Section 5) operate globally, so your information may still be processed in countries other than India as part of delivering the service. By using Black UI you understand your information may be transferred and processed there.

10. Your rights and choices

You may ask us to tell you what personal information we hold about you, correct it, delete it, or withdraw your consent to our processing of it, including the rights available to you under India's Digital Personal Data Protection Act, 2023 and any other law that applies to you. Some information, such as GST invoices and the payment records linked to them, we are legally required to keep for a fixed period, so we cannot delete it on request until that period ends (see Section 7). Email [email protected] and we will respond within a reasonable time, normally within 30 days. If you are not satisfied with our response you may also approach the relevant data-protection authority.

11. Children's privacy

Black UI is not directed at children under 18, and we do not knowingly collect personal information from them. If you believe a child has created an account, contact us and we will delete it.

12. Changes to this policy

We may update this policy as Black UI changes. When we do, we will change the "Last updated" date above and, for material changes, tell you in the app or on this website. Continued use after an update means you accept the revised policy.

13. Contact and grievances

Thoiba Trader, Lanka, Hojai, Assam, India. Questions, requests or complaints about this policy or your data: [email protected] or the Contact page.