Privacy at BlackSiren

Overview

BlackSiren is an Android keyboard with local Full QWERTY typing, user-triggered Dictation, Polish, and Rewrite. This page explains what stays on your device, what leaves it when you choose AI, which provider receives that content, and what BlackSiren retains.

Information We Process

Local QWERTY Typing

• Typed text: QWERTY keypresses are committed directly to the active Android field. They require no BlackSiren account, network connection, microphone permission, or backend request.
• Local preferences: Typing language, double-space period, long-press symbols, keypress sound, and haptic preferences remain in Android app storage on your device.
• Field-aware pages: BlackSiren chooses useful key pages for ordinary text, email, web, number, phone, and date/time fields. It does not send the field type or typed value to the backend.

Voice and Audio

• Voice audio: Captured only after you explicitly tap or hold the microphone control, or after you enable Auto-start hands-free and open the keyboard in a supported non-secure, non-private field. Audio is sent to the transcription provider.
• Transcribed text: Returned by the transcription provider and inserted into the active text field.

Optional Names and Keywords

• Custom vocabulary: Names, brands, acronyms, or jargon you add are stored in Android preferences on your device.
• Session setup: These keywords pass through the BlackSiren backend in request memory and are sent to the transcription provider when dictation begins. The backend does not persist or log them.

Dictation Preferences

• Language hints: Selected BCP-47 language codes are stored on your device and associated with the short-lived backend session and idempotency record used to authorize dictation.
• Retention: Idempotency records carry a 24-hour expiry marker. Expired idempotency and session records are removed under the backend retention procedure and with account deletion.

Text Sent by Polish

• Active selection: If text is selected when you tap Polish, BlackSiren sends only that selected text.
• Full editable field: If no text is selected, BlackSiren sends the full field text that the host app makes accessible. BlackSiren asks for confirmation first unless you turned off that confirmation in settings.
• Replacement: The text provider returns polished text, and BlackSiren replaces the selected text or accessible field text only if the original field and text are still active and unchanged.

Text Sent by Rewrite

• Active selection: If text is selected when you tap Rewrite, BlackSiren sends only that selected text.
• Full editable field: With no selection, BlackSiren can send the full field text that the host app makes accessible. Rewrite has its own confirmation setting.
• Replacement and recovery: Rewrite may make larger wording or structure changes. BlackSiren applies the provider result only if the target is still current and unchanged, then keeps a bounded in-memory snapshot for Revert rewrite. That snapshot is cleared by the next operation, an editor change, or screen-off.

Account Information

• Sign-in: Microsoft Entra External ID hosts sign-in. Depending on the options offered on that page, you may sign in with an email one-time passcode, an email address and password, or a Google or Microsoft account. Microsoft collects and verifies your credentials; BlackSiren never receives, stores, or validates your password. BlackSiren uses the resulting immutable account identifier and authorization claims to verify access.
• Authentication emails: Microsoft may email you a code to verify your address at sign-up, to sign you in with a one-time passcode, to reset your password, or as a second verification step. In those cases, Entra provides the destination address and code to the BlackSiren backend so Azure Communication Services can send the branded message. The address and code remain in request memory and are not persisted or logged. Signing in with a password alone, or with a Google or Microsoft account alone, sends no code and involves the BlackSiren backend in no part of that exchange.
• Separate accounts: Microsoft ties each account to the sign-in method used to create it. If you later sign in with a different method, Microsoft may create a separate account. BlackSiren does not merge accounts or link them by email address, so a separate account has its own access records. Accounts resolving to the same verified email share one pseudonymous private-beta allowance.
• Access records: After sign-in, the backend returns the private-beta defaults without storing new account rows. It stores the immutable account identifier with active or suspended state, provider entitlement, and a quota-identity HMAC only after the first successful app-integrity verification. Allowance counters are stored under that HMAC, not the raw email address. BlackSiren does not receive or store your password.
• Authentication tokens: The app uses tokens to authenticate requests. The backend does not persist or log them.
• Account deletion: When you confirm deletion in the app, the backend uses the immutable identifier in your validated token to block and delete that External ID account. This removes the local or federated sign-in identity attached to that account; email is never used to choose another account for deletion. Separate accounts must each be deleted while signed in to them. Their shared quota HMAC and closed allowance usage remain so deletion cannot reset quota. The app stores a local pending marker containing only a SHA-256 fingerprint of the exact MSAL account before sending the request, clears local custom vocabulary, and uses that marker to resume after a lost response or restart. It contains no raw account identifier or email and cannot authorize deletion of another signed-in account. Before acceptance, the approved app also submits a one-time Play Integrity proof bound to the deletion request; a bearer token alone cannot delete the account.

App and Device Integrity

• App integrity: Before creating a Dictation, Polish, or Rewrite session, the approved installed release requests an integrity token bound to a one-time BlackSiren request hash.
• Signals checked: The integrity service evaluates the app package, signing certificate, app version, install license, app recognition, and device integrity. The BlackSiren backend sends the opaque token to that service for decoding and allows the session only when its fixed policy passes.
• No content in the check: The request hash contains no audio, dictated or selected text, surrounding editor text, email, access token, or raw account identifier.

Content-Free Operational Data

• Allowance and session records: Provider, operation, reserved and consumed quantity, request/session identifiers, status, and expiry metadata. Allowances are partitioned by a keyed HMAC of the normalized verified email so same-email accounts share usage without storing the email itself. Sessions remain owned by the immutable account identifier.
• Integrity challenge records: A one-time challenge identifier, authenticated owner/tenant, idempotency key, content-free request fingerprint/hash, and two-minute expiry. Consumed rows are deleted atomically.
• AI output reports: If you report an unsafe Polish or Rewrite result, BlackSiren stores your selected category, provider, source operation, whether you transformed a selection or full field, a source session identifier, report timestamps, and the same immutable account identifier used for access records. That association lets us enforce one report per result and delete all reports with your account. The report does not include your text, the AI output, a free-form reason, email address, or token.
• Telemetry: A pseudonymous user identifier, request identifier, provider, operation, timestamps, duration, status, sanitized error code, usage quantity, and estimated cost.
• Excluded from telemetry: Audio, text, prompts, provider responses, access or integrity tokens, decoded integrity verdicts, request hashes, certificate digests, raw account identifiers, raw provider errors, and exception messages.

What BlackSiren Does Not Retain

How We Use Your Information

1. Local typing: Commit QWERTY keypresses directly to the active Android field without a BlackSiren backend request.
2. Dictation: Send audio and optional custom vocabulary to the transcription provider and return its transcription.
3. Polish: Send the text you explicitly choose to Polish to the text provider, return the polished result, and replace the original target.
4. Rewrite: Send the text you explicitly choose to Rewrite to the text provider, return a broader revision, and replace the original target while keeping short-lived Revert rewrite recovery.
5. Authentication and authorization: Send a requested sign-in code, authenticate the account, and apply backend access policy.
6. Fraud prevention and security: Verify that the session request comes from an approved installed app version on a device meeting the integrity policy.
7. Allowance enforcement: Reserve and count dictation seconds, Polish input characters, or Rewrite input characters.
8. Reliability and cost control: Use content-free telemetry to diagnose sanitized failures and monitor service usage.
9. AI safety: Review content-free report trends by provider, scope, and closed unsafe-content category to improve moderation and filtering.

Private-Beta Allowances

Private-beta allowances start at 25,200 Dictation seconds and 1,000,000 Polish input characters for each normalized verified email and provider, plus 250,000 Rewrite input characters. OTP/password, Google, and Microsoft accounts that resolve to the same email share these counters. These are service-control limits, not monthly or commercial plan promises. The backend shows the defaults after sign-in and stores them only after the first successful app-integrity verification. Operators may suspend access or adjust a limit, and allowances do not reset monthly or on any automatic calendar schedule. Usage counters remain in operational storage so the backend can enforce the limits.

Data Retention

• Audio and editor text: Not persisted by the BlackSiren backend.
• Custom vocabulary: Persisted only in Android preferences on your device; handled by the backend only in request memory.
• Account and access records: Retained while needed to operate and control private-beta access, then deleted with the account.
• Allowance records: A keyed HMAC of the normalized verified email and closed provider/operation limits and usage remain for the lifetime of the quota program. This prevents deleting or multiplying accounts from resetting allowance. The raw email, sign-in method, account identifier, text, and audio are not stored in this ledger.
• Deletion records: While deletion is processing, BlackSiren temporarily stores the immutable account identifier with a closed processing state, timestamps, retry schedule, and worker lease. This record contains no email address or sign-in-provider value and is removed when deletion completes. BlackSiren then retains a one-way digest derived from the former immutable account identifier so a request using an old token cannot recreate the deleted account. The retained digest contains no email address, raw account identifier, entitlement, allowance, or usage record. Content-free account-administration audits may cover user state, provider entitlement, suspension, and the deletion fence. They contain only a target type, pseudonymous target and operator, previous and new closed states, closed action and reason codes, and timestamps.
• Integrity data: Raw tokens and decoded verdicts are request-memory only. Consumed challenge rows are deleted; dormant expired rows are removed under the backend retention procedure.
• Content-free backend logs: Retained for 30 days for diagnostics.
• AI output reports: Retained for up to 90 days for safety review, then removed under the backend retention procedure. One report is accepted per completed Polish or Rewrite session.
• Authentication email: The destination address and one-time code are processed only long enough to queue and deliver the requested message through Azure Communication Services.
• Provider processing: Data sent to an external service provider is processed under that provider's own privacy practices.

Providers and Data Routes

Local QWERTY typing uses no external processor and sends no typed text to BlackSiren. Dictation, Polish, and Rewrite use the routes below only when you start those actions.

BlackSiren uses external service providers for Dictation, Polish, Rewrite, authentication, email delivery, and app integrity:

• App integrity: Before a Dictation, Polish, or Rewrite session is authorized, the app and backend perform an integrity check for security and fraud prevention. This separate check receives no Dictation, Polish, or Rewrite content.
• Authentication and email: External identity and email services host sign-in and deliver requested BlackSiren email codes.
• Speech and text processing: Dictation audio and optional custom vocabulary go to the transcription provider using a constrained, short-lived token issued by the BlackSiren backend. User-triggered Polish and Rewrite text go through the BlackSiren backend to the text provider.
• Older approved builds: An older approved release may use a different provider route until BlackSiren raises its minimum supported version.

Security

• All BlackSiren app, backend, and provider traffic uses TLS/HTTPS or secure WebSockets.
• Authentication uses OAuth with Microsoft Entra External ID.
• Every provider session requires a fresh, one-time, backend-decoded app integrity verdict. Sideloaded, unlicensed, outdated, wrong-certificate, replayed, or non-integrity devices receive no session or provider token.
• Provider credentials stay on trusted services and are not included in the Android app.
• Provider failures shown to users and recorded in telemetry use closed, sanitized error codes.

Contact Us

For privacy questions or requests:

• Email: support@blacksiren.app
• Website: https://blacksiren.app