Privacy Policy

1. What kind of information do we collect and why?

To successfully provide our services, we must collect and process your information. Depending on how you use our Services, we collect various types of information.

1.1 When you use or navigate our Services

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information). However, it may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical details. This information is primarily needed to maintain the security and operation of our Services and for our internal analytics and reporting purposes.

1.2 Information we collect when you subscribe to our newsletter

We collect your email address, consent, and IP address when you subscribe to our newsletter through the form on our website. This information is needed to send you an email notification with the latest updates about our Services and to send marketing and promotional communications. You can opt out of the newsletter through the unsubscribe link in the newsletter email.

1.3 When you create a user account

WWe collect and process your email address and email verification data, hash of your password, the dates and times your account record was created and last updated, the time and IP address of your last successful login. We use these data to create and administer your account, authenticate you, provide access to account features, communicate with you about your account, and protect our Services.

2. Data security and our third-party data processors

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

We use several third parties to process personal data on our behalf. This makes our services more secure and reliable. We have carefully chosen these third parties, and they maintain a very high level of data security. Here is the list of external providers that we use:

2.1 Hetzner Online

Hetzner Online is a professional web hosting provider and experienced data center operator. We use their servers to host our servers, databases, and all other information mentioned in section 1 of this policy. You can read their data privacy policy here: Hetzner Online Data Policy.

2.2 Amazon Web Services

Amazon Web Services (AWS) offers reliable, scalable cloud computing services. We use AWS to increase our availability and performance. We use AWS to store encrypted backups of databases with information mentioned in section 1 of this policy. AWS is also our email delivery provider and processes recipient addresses and email content to deliver messages such as account verification emails. Delivery services may also process technical delivery or error information. You can read their privacy policy here – AWS Privacy.

2.3 Cloudflare

We use Cloudflare to enhance the security and performance of our website. Cloudflare is a content delivery network (CDN) and web application firewall. When you access our website, your data, such as your IP address and other technical information, may be processed by Cloudflare to protect against malicious attacks, improve website load times, and provide reliable access. Cloudflare adheres to strict security and privacy standards and processes data in compliance with applicable laws. For more information, refer to Cloudflare's privacy policy: Cloudflare privacy policy.

3. Account security and password checks

This section explains how we protect your account, handle passwords and maintain your signed-in session. It also describes the cookies and other mechanisms used for account access and form security.

3.1 Password storage and strength feedback

Our server processes your submitted password to validate it and create or check a password hash. The account database stores the hash rather than the original password. The password-strength feedback displayed while you type is calculated locally in your browser.

3.2 Checks against known compromised passwords

To help protect user accounts, we use the Pwned Passwords service provided by Have I Been Pwned, operated by Superlative Enterprises Pty Ltd in Australia, during account registration.

Our server calculates a cryptographic hash of the submitted password and sends only the first five hexadecimal characters of that hash over an encrypted HTTPS connection. We do not send your password, its complete hash, your email address, or account identifier. Our server performs the final comparison. Your browser does not connect directly to Have I Been Pwned for this check. For more information, please see the Have I Been Pwned Privacy Policy.

3.3 Sessions and form protection

We use sessions and an associated cookie to maintain your authenticated state as you move between pages. We also use mechanisms to protect forms against unauthorized submissions, including cross-site request forgery (CSRF) protection.

The lifetime of a browser cookie and the period for which session information remains on the server are separate. Blocking necessary session mechanisms may prevent account features from working.

4. Data breaches

We will report any unlawful data breach of this website's database or the database(s) of any of our third-party data processors to any relevant persons and authorities within 72 hours of the breach if it is apparent that personal data stored in an identifiable manner has been stolen.

5. Sharing data

We will not share, sell, convey, or otherwise disclose personal data other than as stated in this Privacy Policy unless we are required to do so by law or you have given your explicit consent. We might disclose information to the police or other public authorities subject to a court or administrative order if there is suspicion of illegal activities in connection with the use of our services.

Our servers and data centers are in Germany. If you access our Services from outside of Germany, please be aware that your information may be transferred to, stored by, and processed by us in our facilities and in the facilities of third parties with whom we may share your personal information in Germany and other countries.

6. Data retention and account deletion

We store the data until it is no longer necessary to provide our services or until you or we delete your account or data.

6.1 Deleting newsletter subscription

You can unsubscribe from the newsletter through the unsubscribe link in one of the emails you receive from us. We will delete all the data collected through the newsletter subscription form.

6.2 Additional methods

You can also request to delete your data by contacting us via contactus@blacksail.email.academy.

6.3 Data that we must keep

When you request to delete your data, we will promptly remove it from our active systems. However, we retain logs and backups for 30 days for security, auditing, and continuity purposes. We store these logs and backups securely and delete them automatically after the retention period. During this time, your data will not be accessible or used for any other purpose.

7. Data controller

The data controller responsible for your information is Black Sail Division, a company registered in Poland with NIP number 5482617350. Black Sail Division operates the Black Sail Academy website.

You can contact us by email at contactus@blacksail.email.academy or by mail at:

8. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. An updated "Revised" date at the bottom of this Privacy Policy will indicate the updated version. If we make material changes to this Privacy Policy, we may notify you either by prominently posting a notice or by directly sending you a notification. We encourage you to review this Privacy Policy frequently to learn how we protect your information.

Last revision

Date of Last Revision: October 31, 2026