Privacy Policy
This policy explains what snapblocks.sitecollects, why, who handles it for us, and what you can ask us to do with it. We collect the minimum needed to run accounts, deliver what you buy, keep the service safe and understand how the site is used. We don't sell personal data, run ads or use advertising pixels.
What we collect
- Your email address — to create your account, send receipts and password resets, and contact you about your account.
- Your password — stored only as a salted, one-way scrypt hash; we can never see it. Password-reset links are signed, expire after 45 minutes and stop working once used.
- How you found us — when you create an account we record where your first visit came from (for example a search engine, a social site or a campaign tag) and the address of the page that referred you, plus your country as reported by our host from your connection.
- Security records — when you sign up, sign in, reset your password or take a component, we record the IP address and browser it came from. We use these only to rate-limit abuse, spot shared or compromised accounts, and answer payment disputes, and we never sell or share them.
- Purchases — from Dodo Payments, our merchant of record, we receive the plan, the amount, the currency, payment and subscription references, and your email. We never see or store card or bank details.
- What you open— when you copy a prompt or code, or download a project, we record the component, the format and the time. This delivers the 3-month plan’s weekly allowance, shows us which components are used, and lets us resolve payment disputes.
- Email preferences— if you join the newsletter, your email, where you signed up and when you confirmed (we send a confirmation link first). If you tick “email me” when creating an account, that choice. A record of each marketing or follow-up email we send you, and of any unsubscribe.
- Messages — anything you send us by email.
- Usage analytics — with Google Analytics we measure which pages and items are viewed, searches and filters, playground use, copies, downloads and checkout steps, along with general device, browser and approximate location data. We never send Google your email or account details. In the EEA, UK and Switzerland analytics cookies are only set if you allow them.
Cookies and storage
We set one essential cookie, sb_session, which keeps you signed in for up to 30 days. Google Analytics sets its own cookies (_ga, _ga_*) to tell visits apart — in the EEA, UK and Switzerland only after you allow them. We also keep small notes in your browser's local storage: how you first arrived (sent with your sign-up) and your cookie choice. There are no advertising or cross-site tracking cookies. Details are on the cookie page.
Why we use it
- To provide the service you asked for: your account, your plan and your downloads (performance of a contract).
- To keep the service secure, enforce fair use and prevent fraud (legitimate interests).
- To understand which channels and items work, in aggregate (legitimate interests; in the EEA, UK and Switzerland, consent for analytics cookies).
- To keep tax and accounting records (legal obligation — largely held by Dodo Payments).
- To send the newsletter and product news, only if you opted in (consent — unsubscribe any time).
- To send a few follow-up emails after you create an account (getting started, what the plans include) and one reminder if a checkout you started didn't finish (legitimate interests). Every one has a one-click unsubscribe, and after you unsubscribe we never send them again.
Who processes it for us
- Vercel — hosts the site and serves pages (United States and edge locations).
- Neon — hosts our database (United States, AWS us-east-2).
- Cloudflare — stores the public preview videos (R2). Component code is never stored there.
- Resend — sends receipts, welcome emails and password resets.
- Dodo Payments — processes payments, tax and invoices as merchant of record, under its own privacy policy.
- Google — Google Analytics 4 measures site usage. IP addresses are not stored by GA4.
Each processes data only to provide its service to us. Some are in the United States; where data leaves your country, it is protected by the provider's contractual safeguards, such as standard contractual clauses.
How long we keep it
Account data is kept while your account exists. If you ask us to delete your account we remove your email and how-you-found-us data and sign-in records. Payment records are kept, without your email, because tax and accounting law requires it. Where a payment dispute is open we keep what we need to resolve it until it is closed.
Your rights
You can ask us to access, correct, export or delete your personal data, to restrict or object to how we use it, or to withdraw consent to the newsletter. Email support@snapblocks.site from the address on your account and we will respond within 30 days. You can also complain to your local data-protection authority.
Children
Snapblocks is not directed at children under 16, and we don't knowingly collect their data.
Changes
If we change this policy the date above changes, and for anything significant we will email account holders first.