BLINDBANDIT MOBILE / PRIVACY

Blindbandit Mobile Privacy Policy

Store-grade privacy terms for profiles, posts, messaging, LiveKit calls, Web Push, FCM/APNs, verification, and monetization on Blindbandit Mobile.

Effective September 18, 2026 · Blindbandit Records · Operator contact: business@mrblindbandit.net · Privacy: privacy@mrblindbandit.net · Safety: safety@mrblindbandit.net

Who we are and what this covers

Blindbandit Mobile is the social, messaging, calling, notifications, monetization, and verification product operated by Kaeleb Savon Heck, professionally known as Mr. Blindbandit, in connection with Blindbandit Records (the “Operator”). The public product lives at https://mrblindbandit.net/mobile and related API routes under https://mrblindbandit.net/api/v1 and https://api.mrblindbandit.net.

This Mobile Privacy Policy supplements the website Privacy Policy at /privacy/. Where this document is more specific to Blindbandit Mobile features (profiles, posts, follows, direct messages, LiveKit calls, device push tokens, Web Push, verification, monetization, and ads marketplace), this document controls for those features. The invitation-only label portal remains under separate notices.

By creating a Clerk account, creating a profile, posting, messaging, enabling notifications, or otherwise using Blindbandit Mobile, you acknowledge this Policy. If you do not agree, do not create a Mobile profile or use messaging/calling features.

Controller, officers, and contact

Controller/operator: Kaeleb Savon Heck / Blindbandit Records. Postal: Purok 6-A, Mabuhay, Barangay Capungagan, Davao del Norte 8113, Philippines. PH +63 962 695 4905 · US +1 540 926 9791.

Privacy Officer / DPO contact: privacy@mrblindbandit.net. Legal: legal@mrblindbandit.net. Security: security@mrblindbandit.net. Trust & Safety: safety@mrblindbandit.net. Business: business@mrblindbandit.net.

Accounts and authentication

Blindbandit Mobile uses Clerk for sign-up and sign-in. Google and email/password (or email magic links, if enabled in Clerk) are supported. Apple Sign In is intentionally disabled for this product configuration unless later announced.

Clerk processes identifiers, email addresses, authentication events, device/browser signals, and fraud-prevention data under Clerk’s role as authentication provider. Anyone with a verified email through Clerk may create a Blindbandit Mobile profile and publish posts — label portal membership is not required.

The official verified artist profile for Mr. Blindbandit is linked to the Operator’s Clerk identity associated with kheckfinancial@gmail.com for ownership and verification integrity.

Profile, posts, follows, and public visibility

Profiles may include handle, display name, bio, avatar, cover image, location, website, verification status, and monetization status. Posts, display names, handles, avatars, and verification badges are public by default when visibility is set to public.

Public content can be indexed, screenshotted, or copied by others. Do not post passwords, financial credentials, government IDs, home addresses of private individuals, intimate imagery, or another person’s personal data without authorization.

Follow relationships are used to build feeds, send notifications, and show social graph counts. Unfollow and account deletion/requests are available subject to legal retention duties.

Messaging and calling

Direct messages are private between participants but are accessible to the Operator for abuse investigation, legal process, security, and integrity. Message content, timestamps, and participant identifiers are stored in the product database.

Voice and video calls use LiveKit. The Worker mints short-lived room tokens using LIVEKIT_API_KEY and LIVEKIT_API_SECRET held only as server secrets. The browser/app receives a token and room name — never the API secret. LiveKit and network providers may process IP addresses, connection metadata, and media transport information necessary to operate the call.

Call signaling events may trigger push notifications to the callee’s registered devices.

Push notifications: Web Push, FCM, and APNs

Blindbandit Mobile supports (1) browser Web Push via the Push API and VAPID keys, (2) Apple Push Notification service (APNs) device tokens for iOS apps, and (3) Firebase Cloud Messaging (FCM) registration tokens for Android apps.

When you enable notifications, we store encrypted or hashed device tokens / Web Push subscription endpoints, platform, app version, language, installation id, topic subscriptions, and delivery receipts needed to send and debug notifications. You can unregister devices and Web Push subscriptions from Settings or via API.

Notification categories include system/security, messages, calls, social activity, and optional marketing topics. Marketing topics require affirmative subscription where consent is required. You can manage topic subscriptions through /api/v1/push/topics endpoints.

Delivery providers (Apple, Google/FCM, browser push services) receive the minimum token and payload data needed to deliver the notification.

Verification, monetization, and ads marketplace

Verification applications may include evidence links and statements you submit. Reviews are performed by the Operator. Approved verification sets a public verified badge.

Creator monetization applications may include payout email and program notes. Ads marketplace listings include title, body, destination URL, and budget metadata and remain subject to review before becoming active.

Financial payouts, if enabled later, will use additional providers disclosed at enrollment. Do not send bank passwords or full card numbers through free-text forms.

Advertising on eligible Mobile surfaces

Google AdSense may appear on eligible public Blindbandit Mobile surfaces (for example the main feed, explore, and monetization marketing pages) subject to the site’s Privacy Choices / consent gates and Advertising Disclosure. Ads are not placed on Mobile Privacy, Trust & Safety, About Us, verification application, authentication, messaging, or calls surfaces.

Publisher id used site-wide: ca-pub-7238428274233485. Ad loading follows the existing advertising.js pattern and visitor privacy choices.

Legal bases, retention, security, and rights

Processing relies on contract/requested service, legitimate interests (security, abuse prevention, product integrity), legal obligations, and consent where required (optional marketing, certain cookies/ads).

Retention follows need: active account life, abuse and security windows, legal holds, and accounting duties. Backups may retain deleted data for a limited rolling period.

Security controls include HTTPS, auth checks on social routes, rate limits, audit logs for sensitive actions, encrypted device token storage via the platform vault when PLATFORM_VAULT_KEY is configured, and private vulnerability reporting at security@mrblindbandit.net.

Depending on your jurisdiction you may have access, correction, deletion, portability, restriction, objection, and complaint rights. Email privacy@mrblindbandit.net. Philippine data subjects may contact the National Privacy Commission. EU/UK users may contact a competent supervisory authority where GDPR/UK GDPR applies to the processing.

Children

Blindbandit Mobile is not directed to children under 13. Users under 13 may not create accounts, post, message, call, or enable push notifications. Older minors must comply with parental consent rules in their jurisdiction. See also the Child Safety Policy at /safety/ and Mobile Trust & Safety.

International transfers and changes

Infrastructure may include Cloudflare Workers, D1, R2, Clerk, LiveKit Cloud, Apple, Google, and other subprocessors. Transfers use appropriate contractual and technical safeguards available for the configured vendors.

Material changes will update the effective date. Continued use after notice constitutes acceptance where permitted by law. Prior versions may be requested from privacy@mrblindbandit.net.

Subprocessors (illustrative)

Depending on configuration, Blindbandit Mobile may rely on: Cloudflare (Workers, D1, R2, DNS, CDN), Clerk (authentication), LiveKit Cloud (realtime media), Apple (APNs), Google (FCM / AdSense where enabled), Spotify (embeds), browser push services endpoint operators, and email providers such as Resend for transactional mail. Each receives only data needed for their function.

A current subprocessors list can be requested from privacy@mrblindbandit.net. Material new subprocessors that change risk will be reflected in policy updates.

Data subject request procedure

Email privacy@mrblindbandit.net with “Privacy Request” in the subject. Describe the right you wish to exercise and the email/handle involved. We may need to verify identity (for example via the verified Clerk email on the account). We respond within the period required by applicable law, commonly within 30 days where GDPR-style timelines apply, subject to extensions and exceptions.

We will not delete information we must keep for security, fraud prevention, accounting, legal claims, or law. Where deletion is limited, we will say so.

Do Not Sell / Share and advertising choices

The Operator does not sell personal information for money. Advertising technology on eligible pages may constitute “sharing” or targeted advertising under some US state laws. Use Privacy Choices on the website, browser Global Privacy Control where honored by first-party controls, and Mobile notification topic opt-outs for marketing topics.

API and app developers

Third-party or first-party apps calling /api/v1 must protect tokens, use TLS, avoid logging secrets, and present privacy disclosures to end users covering push tokens, call metadata, and message access. Developer abuse may result in credential revocation.

Expanded official terms (September 18, 2026 — merged with Legal Master Package 2026.09.13)

Blindbandit Mobile is a production social and communications product of Blindbandit Records. This page forms part of the Operator’s binding public documentation together with the website Privacy Policy, Terms, Cookies notice, Community Guidelines, Copyright policy, Advertising Disclosure, Security Reporting policy, Submission Terms, Media Suite Terms, Child Safety Policy, and the Mobile-specific Privacy, Trust & Safety, and About documents.

Authentication is Clerk-only for end-user signup and session. Label portal invitation matching continues to rely on verified Clerk email. Push notification registration covers Web Push (VAPID), APNs, and FCM. Calling uses the Operator’s LiveKit server credentials held only as Worker secrets. Moderators may enforce bans, suspensions, mutes, content removal, verification decisions, token revocation, and call disconnects, with audit logging.

Business contact: business@mrblindbandit.net · Privacy: privacy@mrblindbandit.net · Safety: safety@mrblindbandit.net · Security: security@mrblindbandit.net · Legal: legal@mrblindbandit.net.

Address: Purok 6-A, Mabuhay, Barangay Capungagan, Davao del Norte 8113, Philippines · +63 962 695 4905 · +1 540 926 9791.

Master package privacy crosswalk (September 13, 2026)

Blindbandit Mobile is covered by the website Privacy Policy (Master Package Part IV) in addition to the Mobile-specific terms on this page. The following excerpts summarize how the master package applies to Mobile; the full Privacy Policy controls if there is any conflict on website-wide topics.

Scope

This Privacy Policy explains information practices for the official Mr. Blindbandit website and Blindbandit Records public services. It covers public pages, authentication, community participation, contact and submission forms, newsletters, advertising, browser utilities, and Media Suite features. A separate notice in Part XII applies to the invitation-only label portal.

Controller, operator, and Data Protection Officer

The website is operated by Kaeleb Savon Heck, professionally known as Mr. Blindbandit, in connection with Blindbandit Records. Postal contact: Purok 6-A, Mabuhay, Barangay Capungagan, Davao del Norte 8113, Philippines. Philippine telephone: +63 962 695 4905. United States telephone: +1 540 926 9791.

Kaeleb Savon Heck serves as Data Protection Officer / Privacy Officer for the website. Privacy questions and rights requests should be sent to privacy@mrblindbandit.net. Legal notices may be sent to legal@mrblindbandit.net.

Scope

This Policy covers information processed through mrblindbandit.net public pages and features under the operator’s control. Third-party destinations, streaming platforms, payment services, identity providers, and embedded services have their own privacy practices. The private label portal has a supplemental notice because it handles additional contractual, royalty, messaging, and client records.

Categories of information

Depending on the feature, the service may process names, artist or organization names, email addresses, telephone numbers voluntarily included in a message, account identifiers, display names, profile details, community posts and comments, poll responses, timestamps, music metadata, project descriptions, listening links, uploaded submission files, support messages, consent choices, accessibility and browser preferences, device and browser information, IP addresses, security and authentication events, rate-limit data, referral information, advertising request information, and records needed to document a request or legal obligation.

The service does not intentionally request passwords, complete payment-card numbers, banking credentials, government identity numbers, or highly sensitive personal data in ordinary public forms. Do not place that information in a public post or an unsolicited message.

Sources

Information comes from visitors, account holders, people making submissions or inquiries, authorized label administrators, service providers performing authentication or delivery functions, ordinary browser/network requests, public professional links intentionally submitted for review, and security or moderation events generated by use of the service.

The operator does not ask a user to provide personal data obtained unlawfully or private information about another person without authorization.

Music submissions

Demo and project submissions may include contact details, project metadata, ownership or permission confirmations, listening links, messages, and optional audio. They are used to receive, secure, organize, evaluate, and respond to the submission; prevent fraud or abuse; document permission; and preserve records needed for an active negotiation or dispute. A submission does not enroll the sender in unrelated marketing.

Mobile-specific processing for profiles, posts, follows, Clerk authentication, LiveKit calls, Web Push / APNs / FCM, verification, monetization, and Social Admin review is described in the sections above and remains part of this Mobile Privacy Policy.

Related: Cookies · Advertising · Security reporting · Legal and Trust Center.

Related documents

Mobile Privacy · Trust & Safety · About Us · Website Privacy · Website Terms · Community Guidelines · Child Safety · Accessibility · Moderation Appeals · Legal Hub · Cookies · Copyright · Security Reporting · Advertising Disclosure

These documents explain product practices for Blindbandit Mobile on mrblindbandit.net/mobile. They are not a substitute for legal advice about a particular dispute or jurisdiction.