Terms & Conditions

BLACK BOX

Terms & Conditions of Use

Legal position, disclosure, and terms — full version, provided for transparency.

Effective: [DATE]  ·  Last updated: [DATE]  ·  Version 2.0 (DRAFT)

DRAFT — PENDING LEGAL REVIEW — NOT LEGAL ADVICE

1. Agreement to These Terms

These Terms & Conditions ("Terms") govern your use of the BLACK BOX application and the website at blackboxsentinel.com (together, the "Service"), operated by BLACK BOX ("we," "us," "our"). By using the Service you agree to these Terms. If you do not agree, do not use the Service.

BLACK BOX complements and does not replace emergency services. It is not a monitored alarm service and does not guarantee dispatch or response. In an emergency, contact local emergency services directly (911 in the U.S.; 110/119 in Japan).

2. What the Service Is

BLACK BOX lets you discreetly document a situation affecting your safety and notify contacts you designate. On activation it records audio, location, and — where a camera is present — video, notifies your contacts by text or messaging channel, and, where applicable, surfaces a live response view to an authorized responder or organization coordinator. Contacts and responders receive a secure link and do not need to install any application.

3. How Activation Works — Reasonable Expectations

This section states plainly what you should and should not expect from the Service, so your use of it is based on how it actually behaves rather than an assumption about how it behaves.

●       Activation is instant and unconditional. Once triggered, recording begins immediately. The Service does not pause to assess your location, the severity of the situation, or the recording-consent law that applies where you are. There are no exceptions to this behavior and no way to configure it differently.

●       This is deliberate. A safety tool that hesitates to evaluate jurisdiction before protecting the person who triggered it has failed at its purpose. Because the Service does not adapt at the moment of use, the legal groundwork for that behavior is established here, in advance, rather than decided in the moment (Section 4).

●       Video only records where compatible camera hardware is present and enabled. Absent such hardware or permission, no video is captured, regardless of what audio and location capture is doing.

●       The Service is best-effort, not guaranteed. Delivery of alerts and Capture depends on your device's battery, connectivity, operating-system permissions, and third-party channels (carriers, messaging providers, cloud infrastructure), any of which may fail or delay. We do not guarantee that any contact, coordinator, or Authority will see, act on, or respond to an alert.

●       The Service does not verify what is happening. It records and transmits what your device captures; it does not evaluate, confirm, or dispute the truth of any situation.

4. Recording, Consent & Your Legal Position

Laws governing the recording of audio and video vary by jurisdiction, including "all-party consent" requirements in some U.S. states and requirements under the laws of Japan, India, and other countries. Because activation does not adapt to your location (Section 3), you should understand the following before you use the Service:

●       Some jurisdictions require the consent of everyone present before a conversation may be lawfully recorded. BLACK BOX does not obtain that consent on your behalf and does not check whether it applies to you before recording.

●       Consent law creates two separate risks: whether a recording can later be used as evidence in a proceeding, and whether making the recording at all could itself expose you to liability, independent of any court case. Both can matter, and they are not the same question.

●       Many jurisdictions recognize some form of exception allowing a person to record without others' consent where they reasonably believe it is necessary to document a threat to their own safety. BLACK BOX is built around that premise. We do not represent that this exception applies in every jurisdiction, and its scope varies by location. [COUNSEL — see companion Legal Position document for the jurisdiction-by-jurisdiction analysis.]

●       You are responsible for your own use of the Service consistent with the laws that apply to you. The Service is provided as a tool for documenting a threat to your own safety — not for surveilling, harassing, or recording others outside that purpose.

By using the Service, you acknowledge the above and accept that BLACK BOX's recording behavior is uniform and does not vary by jurisdiction, situation, or severity.

5. Eligibility & Account

●       You must be legally able to enter these Terms, or use the Service under the supervision of a responsible adult who accepts them on your behalf.

●       Sign-in is passwordless, using a device passkey and an optional recovery code. You are responsible for maintaining access to your account and for the accuracy of your contacts.

6. SMS / Text Messaging Program

REQUIRED CARRIER DISCLOSURES  By adding a mobile number as a contact channel and using the Service, you represent that you are authorized to provide that number and that the recipient consents to receive BLACK BOX safety and service messages at that number.  • Program: BLACK BOX sends safety alerts, check-in messages, and related service messages by SMS. • Message frequency varies based on use; there is no fixed schedule. • Message and data rates may apply, per your mobile carrier plan. • Opt out: reply STOP to any message to stop safety messages to that number; reply HELP for help. • Carriers are not liable for delayed or undelivered messages. • Mobile numbers are handled as described in our Privacy Policy and are not shared or sold to third parties for marketing.

7. Your Responsibilities

●       Provide accurate information and maintain at least one reachable contact channel.

●       Use the Service for personal-safety documentation, not to unlawfully surveil, harass, or record others outside that purpose.

●       Comply with the recording and privacy laws applicable to you, understanding that the Service itself will not adjust its behavior to help you do so (Section 4).

8. No Warranty; Best-Effort Service; Limitation of Liability

The Service depends on your device, connectivity, permissions, and third-party channels, any of which may fail or delay. Alert delivery and Capture are best-effort and not guaranteed. The Service is provided "as is" and "as available," without warranties of any kind to the maximum extent permitted by law. We do not guarantee that any contact, coordinator, or Authority will see, act on, or respond to any alert. To the maximum extent permitted by law, BLACK BOX is not liable for indirect, incidental, or consequential damages arising from use of or inability to use the Service.

[COUNSEL] Enforceable warranty disclaimer and limitation of liability appropriate to a safety tool to be finalized. Nothing in these Terms limits liability that cannot lawfully be limited.

9. Data & Privacy

Your use of the Service is subject to our Privacy Policy, which describes what we collect, who owns it, who can access it, and your choices. The Privacy Policy is incorporated into these Terms by reference. In summary: you own your Capture; an enrolled organization can operate on an active event but cannot independently distribute your data; the Operator's access is minimized by design and does not include standing content access; Authorities receive your data only at your direction or under valid legal process.

10. Fees & Licensing

The Service is provided to individual users at no charge, and the Survivor is never billed. Organizations may license the Service under separate written terms; need-based organizations may be licensed at no cost.

[Licensing and any organization fee terms to be confirmed.]

11. Acceptable Use

You may not use the Service to violate law, infringe others' rights, or attempt to compromise the security or integrity of the Service. We may suspend or terminate access for violation of these Terms or as required by law.

12. Open-Source Components

BLACK BOX software is made available under open-source terms (AGPL). Use of the source code is governed by its license; these Terms govern your use of the hosted Service.

[Confirm license terms and any dual-license position.]

13. Changes & Termination

We may modify the Service or these Terms; material changes will be posted with an updated effective date. You may stop using the Service at any time.

14. Governing Law & Disputes

These Terms are governed by the laws of [JURISDICTION], without regard to conflict-of-laws rules.

[Governing law, venue, and dispute-resolution terms to be set by counsel.]

15. Contact

Questions: [CONTACT@blackboxsentinel.com]

DRAFT FOR LEGAL REVIEW. This document is provided for transparency and is not legal advice. Bracketed items marked for counsel are pending review. Where this document and any plain-language summary differ, this document is the more complete statement.

BLACK BOX

Legal Position, Disclosure & Chain of Custody

Legal position, disclosure, and terms — full version, provided for transparency.

Effective: [DATE]  ·  Last updated: [DATE]  ·  Version 2.0 (DRAFT)

DRAFT — PENDING LEGAL REVIEW — NOT LEGAL ADVICE

1. Purpose of This Document

This is an engineering-accurate description of how BLACK BOX captures, categorizes, secures, transfers, and releases data, written in review-ready language so that qualified counsel can adapt it into binding instruments (Terms of Service, Privacy Notice, Recording/Consent Notice, Data Processing Agreements, and institutional licensing terms). It states no legal conclusions on its own. Items in [BRACKETS] require a decision by the Operator or by counsel. Sections marked [COUNSEL] identify determinations that must be made by a licensed attorney in each applicable jurisdiction before reliance.

Applicable jurisdictions in scope: United States (federal and relevant states), Japan, India, and any additional institutional-deployment jurisdiction. [COUNSEL to confirm the full list.]

2. Definitions

●       Survivor / User — the individual who installs and activates BLACK BOX to document a situation affecting their own safety. The Survivor is the person the system is designed to protect and the owner of their Capture.

●       Organization — an institution (e.g., a domestic-violence shelter, coalition, or agency) that deploys BLACK BOX to a defined population of Survivors under a license.

●       Coordinator (Seat) — an authorized individual within an Organization who operates the live response dashboard during an active Event.

●       Operator — [OPERATOR LEGAL ENTITY], the party that develops and hosts the BLACK BOX infrastructure.

●       Designated Contacts — the personal contacts a Survivor configures to receive alerts.

●       Capture — audio, and, only where camera hardware is present, video, and location data recorded during an Event.

●       Event — an activation instance, from trigger through closure.

●       Authority — law enforcement, emergency, or judicial recipients to whom Capture may be released only at the Survivor's direction or under valid legal process.

3. Nature of the Service

BLACK BOX is a personal-safety documentation and notification system. On activation it records Capture, transmits alerts to Designated Contacts, and — where an Organization is involved — surfaces a live Event to a Coordinator dashboard. It complements and does not replace emergency services; it is not connected to any public-safety answering point (911/110) by default and does not guarantee dispatch. Many activations are intended to culminate in a call to emergency services, with a documentation trail and an informed personal network already engaged.

4. Activation Categorization — Reference Taxonomy

BLACK BOX's trigger is intentionally uniform: activation is immediate and unconditional, with no in-product distinction by category, severity, or jurisdiction at the moment of activation (Section 5). The taxonomy below is not a gate on triggering. It is applied after activation, for triage, dispatch summary, and Authority View tagging — it describes what the system observed, it does not decide whether the system records.

4.1 Category 1 — Life-Threatening / Imminent Danger

Reasonable indication of an immediate threat to life or serious bodily harm, present-tense. Includes, but is not limited to: domestic violence, sexual assault, kidnapping or forced confinement, assault carrying risk of death or serious bodily harm, intimidation under threat, coercion under threat, and strangulation (which auto-elevates to High severity given its recognized status as a strong lethality indicator, regardless of other markers present).

Severity

Illustrative indicators (not exhaustive)

Low

Verbal threat without proximity or weapon indicator; escalating argument with a history of violence but no current physical contact

Moderate

Physical altercation without a weapon; blocked exit or restrained movement; assault in progress without a weapon or overpowering force

High

Weapon referenced or present; strangulation/choking referenced; forced confinement or kidnapping; combined compliance, fear, and restraint signals; assault with weapon or overpowering force

4.2 Category 1B — Medical Emergency

Same urgency tier as Category 1, without an interpersonal-threat component. Severity assessed by symptom indicators (cardiac, respiratory, allergic reaction, bleeding, loss of consciousness).

4.3 Category 2 — Non-Life-Threatening / Risk

Severity

Illustrative indicators (not exhaustive)

Low

Harassment, verbal only, no threat of force; non-violent dispute; property damage without personal threat; overdue check-in

Moderate

Elderly person fallen, conscious and alone; stalking indicators (unwanted contact pattern); non-violent organization-safety incident; community hazard

High

Elderly person fallen, unconscious or unresponsive; active stalking with current proximity; evacuation-level organization or community event

Category 2, Low includes harassment without a threat of force. The moment a threat of force is present, the indicator set moves the Event into Category 1 (intimidation/coercion under threat). This is a severity-fusion rule applied by the classifier after the fact, not a precondition for the trigger.

5. The Trigger Is Instant and Unconditional — No Exceptions

This is the central design and legal-positioning decision of the product, and it governs everything else in this document: BLACK BOX does not evaluate category, severity, location, or local consent law before it begins recording. Activation is immediate, silent, and identical in behavior everywhere the app runs.

The rationale is deliberate, not an oversight: a personal-safety tool that pauses to assess jurisdiction before protecting the person who activated it has failed at its one job. All legal positioning therefore has to happen before the moment of use — at onboarding, in the disclosures the Survivor consents to — rather than as runtime logic that adapts behavior to where the Survivor happens to be. See Section 6 and the onboarding disclosure language in Section 6.5.

6. Recording, Consent & Lawful Use — [COUNSEL — PRIMARY RISK AREA]

6.1 Two distinct risks, not one

Consent law creates two separate exposures that must be addressed separately, not treated as a single admissibility question:

●       Admissibility — whether a court will allow a recording into evidence. This is decided by a judge ruling on a motion, not unilaterally by police or opposing counsel. Some jurisdictions also apply a statutory suppression rule (e.g., 18 U.S.C. §2515 under U.S. federal wiretap law) that operates independently of general evidentiary discretion when an interception was unlawful.

●       The recorder's own liability — whether making the recording without the consent a jurisdiction requires is itself a crime or a basis for a civil suit against the Survivor, entirely independent of whether the recording is ever offered in any proceeding. In several U.S. states this exposure is a felony. This is the more urgent risk to design against, because it can materialize even if the Survivor never goes to court.

6.2 Working consent posture

BLACK BOX does not rely on jurisdiction-by-jurisdiction consent analysis to decide whether a given recording is lawful, because the trigger performs no such analysis (Section 5). It defaults to the most protective assumption available: every activation is treated, in its disclosures, as if the applicable law required all-party consent, regardless of the Survivor's actual location. The product does not assert that such consent exists. Its stated basis for recording is the exception, recognized in some form in a number of consent regimes, permitting a person to record without others' consent where they hold a reasonable, good-faith belief the recording is necessary to document a threat to their own safety.

[COUNSEL] Confirm this exception exists, in what form, and in every jurisdiction in scope. It is not uniformly settled — see Section 6.3.

6.3 United States — state consent requirements

Thirty-nine states plus the District of Columbia are one-party consent jurisdictions: Alabama, Alaska, Arizona, Arkansas, Colorado, DC, Georgia, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Michigan, Minnesota, Mississippi, Missouri, Nebraska, Nevada, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, Utah, Vermont, Virginia, West Virginia, Wisconsin, Wyoming. (Hawaii, Michigan, and Nevada have statutory or case-law nuance and should be independently confirmed.) No dual-consent restriction applies in these states.

All-party consent state

Confirmed danger/victim exception in statute or case law

California

Yes — Penal Code §633.5 (named exception for DV, violent felonies, extortion, kidnapping, bribery)

Washington

Yes — statute names an emergency / threat-of-bodily-harm exception

Pennsylvania

Yes — recognized victim-of-crime-of-violence exception

Connecticut

Not confirmed — verify with counsel

Florida

Not confirmed — verify with counsel

Illinois

Not confirmed — verify with counsel

Maryland

Not confirmed — verify with counsel

Massachusetts

Not confirmed — treats all illegal recording as a felony with no misdemeanor tier; treat as highest-risk state pending confirmation

Montana

Not confirmed — verify with counsel

New Hampshire

Not confirmed — verify with counsel

Delaware / Oregon

Inclusion in the all-party group is itself disputed across sources — verify

6.4 By country

Jurisdiction

All-party consent required?

Notes

United States

Varies by state (Section 6.3)

No federal all-party requirement; states may impose one

Japan

No

No private-party wiretap statute; participant recording is lawful. APPI governs subsequent use of the data, not the act of recording.

India

No

Participant recording is lawful under IT Act / DPDP framework. DPDP treats voice and precise location as sensitive personal data once collected — this drives the location-generalization default in Section 6.6, not a recording-consent restriction.

6.5 Onboarding disclosure language

"Activation is immediate and unconditional. BLACK BOX does not evaluate your location, the nature of the situation, or local consent law before recording. This is a deliberate design choice — a personal-safety tool that pauses to check jurisdiction before protecting you has failed at its one job. By using the Service, you acknowledge that laws governing recording without all parties' consent vary by location, that some jurisdictions may treat non-consensual recording as a criminal offense, and that BLACK BOX's built-in behavior does not adapt to those laws. The system is designed for use in situations involving a reasonable belief of danger to yourself; use outside that purpose is at your own risk under the laws that apply to you."

6.6 India — location generalization

For India deployments, BLACK BOX defaults to region- or city-level location granularity rather than exact coordinates, reflecting DPDP's heightened treatment of precise location as sensitive personal data. The Survivor may opt into precise location for an active Event. This is a data-handling design choice, not a response to any recording-consent requirement — India, like Japan and the one-party U.S. states, does not require the consent of other parties for a participant to record their own conversation.

6.7 Evidentiary vs. surveillance purpose

The system exists to let a person document a threat to their own safety, not to surveil third parties for other ends. Acceptable-use terms in the Terms & Conditions should reflect and enforce this limitation.

7. How Data Is Secured

●       In transit — all transmission between device, Operator infrastructure, and authorized dashboards occurs over encrypted transport (TLS).

●       At rest, current — sensitive local values are encrypted on-device (AES-GCM via Web Crypto, PBKDF2-derived key); Capture is stored server-side in object storage with relational metadata in an edge database, access token-scoped and audited.

●       At rest, planned — envelope encryption of Capture: each Capture encrypted on-device with a per-Capture key, wrapped to the Survivor's key and the Organization's key; Operator infrastructure stores ciphertext and an integrity hash only. Do not represent this as active until deployed and independently reviewed. [COUNSEL / CRYPTO REVIEW]

●       Integrity — Capture and Event records are hashed (SHA-256) and chained so any alteration is detectable; exports carry a signed manifest and a standalone verification routine.

8. Roles & Legal Responsibilities — [COUNSEL]

The provisional model: the Organization acts as controller for the Survivors it enrolls; the Operator acts as processor/sub-processor storing (in end-to-end-encrypted deployments) ciphertext it cannot read; individual Survivors control their own Capture. In non-Organization (individual) deployments, the role allocation differs and must be specified separately. Data Processing Agreements must be executed between the Operator and each Organization, and between the Operator and each sub-processor.

9. Chain of Custody & Evidentiary Integrity

●       Identity on access — evidence cannot be opened or exported anonymously; the first claim of a dispatch or export link requires registration (name, agency/organization, role, verified contact), binding the recipient to an immutable identifier.

●       Tamper-evidence — every Capture object and Event record is hashed and chained; a standalone verification routine lets a recipient or court independently confirm a package is unaltered.

●       Export as custody transfer — export assembles the package with a signed manifest, records a custody-transfer entry, and seals the canonical original into a write-once archive (Section 10).

●       Access logging and watermarking — every access is logged and available to the Survivor; Capture is watermarked with the account/Organization/Seat identifier so a downstream leak traces to a specific seat.

[COUNSEL] The system is designed to make integrity and custody provable; it cannot guarantee admissibility in any given proceeding, which is a determination for the relevant court.

10. Retention

No single retention period satisfies grant-compliance rules, evidentiary needs, and minimization duties simultaneously — they pull in different directions. The working structure is layered rather than uniform:

Data

Default retention

Rationale

Capture content

Deletable by Survivor after event closure

Minimization; Survivor controls own risk

Sealed original / evidence vault

36 months, write-once

Clears the federal grant-records floor (3 years, 2 CFR §200.334) with margin

Audit metadata only

7 years

Covers most applicable statute-of-limitations windows without holding content

[COUNSEL] Confirm 36 months is sufficient given statute-of-limitations variance across deployment states for the offenses in scope (particularly sexual assault and other violent felonies, several of which carry long or no limitations period), and confirm no state's DV-confidentiality statute caps retention shorter than this schedule.

11. Release to Authorities / Third Parties

●       Survivor-directed release — release to an Authority is initiated or authorized by the Survivor. In the planned encryption model, release is effected by re-encrypting the specific evidence to the Authority's key — a logged, controlled, audited disclosure, not an unrestricted download-and-forward.

●       Legal process — where the Operator or an Organization receives valid legal process, it will respond as required by law and, where lawful and feasible, notify the affected Survivor. [COUNSEL to draft the legal-process response and notice policy.]

●       No bulk export without authorization — export requires Survivor authorization or a court order by default.

●       Scoped, expiring access — Authority/dashboard access is scoped to the active Event and expires by default following resolution, extendable by the Survivor/authorized party for an active investigation. [Confirm default windows.]

12. Limitations & No Warranty

Alert delivery and Capture are best-effort and not guaranteed; the Service depends on device, connectivity, permissions, and third-party channels, any of which may fail or delay. The Operator does not continuously monitor Events and does not guarantee that any Designated Contact, Coordinator, or Authority will see, act on, or respond to an alert. [COUNSEL to draft the enforceable warranty disclaimer and limitation of liability appropriate to a life-safety product.]

13. Governing Law & Regulatory Touchpoints

●       U.S. federal wiretap/ECPA and state consent laws (Section 6.3)

●       Japanese APPI and communications/privacy law

●       India's IT Act, DPDP Act, and applicable case law

●       Applicable U.S. state privacy statutes; cross-border transfer law

●       Grant-program data conditions (VAWA/VOCA/OVW/HUD) where institutional funding is involved

[TO BE SET BY COUNSEL: governing law, venue, dispute resolution.]

Appendix A — Counsel Review Checklist

●       Confirm the recording/consent posture and required in-product notices per jurisdiction (Section 6); confirm the danger/victim exception exists, and in what form, in the states listed as "not confirmed" in Section 6.3.

●       Determine controller/processor roles for both Organization and individual deployments; draft DPAs.

●       Specify lawful cross-border transfer mechanisms and disclosures for each corridor, including India.

●       Confirm the 36-month / 7-year retention schedule against grant conditions, statute-of-limitations variance, and any state DV-confidentiality caps.

●       Draft the legal-process response and Survivor-notice policy.

●       Draft enforceable warranty disclaimer and limitation of liability appropriate to a life-safety tool.

●       Validate chain-of-custody design against admissibility standards in target forums.

●       Gate any representation of zero-knowledge encryption as active on independent cryptographic review.

DRAFT FOR LEGAL REVIEW. This document is provided for transparency and is not legal advice.