Privacy Policy

1. Introduction

This Privacy Policy describes how BlockAtlas ("we," "us," or "our") collects, uses, and discloses information when you use our website and services at blockatlas.com (the "Service"). It applies whether you create an account or use the Service as an anonymous visitor. BlockAtlas is operated by Hugh Thomas in Illinois, United States.

2. Definitions

• Cookie: a small file placed on your device to enable certain features and functionality.
• Personal Data: information that, alone or combined with other information, identifies a natural person.
• Service: the BlockAtlas website and tools, including maps, place pages, area tools, games, and purchased Place Reports.
• You: any person who accesses or uses the Service, whether or not you have an account.

3. Information We Collect

3.1 Account Information

When you create an account, we collect:

• Email address
• Name
• Username (optional)
• Password (stored only as a salted hash; we never see it)

Your username is public: it is what identifies you on leaderboards and on results you share. It is optional — you may leave it blank when you register, or clear it later from your profile, in which case you appear publicly as "Anonymous User." Your name and email address are not shown publicly — they are used for billing, account email, and your own account screens. Anonymous players appear publicly as "Guest."

3.2 Payment Information

Paid subscriptions and one-time site-report purchases are processed through Stripe Managed Payments, under which Stripe acts as merchant of record for the transaction. Checkout is hosted by Stripe and presented through Stripe's Link service — your purchase will appear as "sold through Link" and on your statement as LINK.COM*. Card details are submitted directly to Stripe; we never receive or store full card numbers, though Stripe may show us limited details such as card brand and last four digits.

As merchant of record, Stripe collects the billing and location details it needs to take payment and to calculate and remit sales tax, VAT, and GST; sends your receipts, invoices, refund notices, and certain subscription emails directly; and handles payment- and subscription-related support requests. Stripe processes that information as an independent controller under its own privacy policy, not on our behalf. You may be prompted to create a Link account, through which you can view order history, cancel or update your subscription, and change your payment method or billing address.

We retain the non-card records needed to run a subscription or deliver a report: your email address, Stripe transaction identifiers, purchase or plan, status, and billing history. A report buyer does not need a BlockAtlas account.

3.3 Correspondence and Notification Requests

If you email us — to request access while accounts are invitation-only, or with a question — we store the address and the message so we can reply. If you ask to be told when a feature opens, we store the address for that too. We also still hold addresses collected by an earlier interest-list form that used to run here; you can have any of these removed at any time (section 6).

3.4 Usage Data

We record how the Service is used: pages visited, time and date, the tools you run, browser and device information, and your IP address. IP addresses are truncated to their network before storage (for IPv4, the first three octets), so we do not retain the precise address your device connected from, and we do not look up a location from it.

3.5 Locations You Search

The area tools work from a point you choose. When you drop a pin, search an address, or open a place page, we store that location — including its coordinates — against your player identifier, so the tool can show your recent activity and so we can avoid recomputing the same area twice.

We do not collect your device's location. The Service never asks your browser for GPS or device positioning. A location we hold is one you typed, clicked, or navigated to.

When you configure or purchase a Place Report, we store every submitted report location and the selected report options. We use them to prepare, deliver, and, during the editing period, regenerate the purchased document.

3.6 Purchased Report Links and Delivery

Report viewing, PDF, checkout, and editing URLs contain random capability tokens. Anyone who receives a valid link can use the access it grants, so treat it like a private document link. We suppress page analytics, shared caching, referrer transmission, and unmasked request-path logging on those routes. We send report-ready and regeneration email to the purchase address; these are transactional messages needed to deliver the purchase.

3.7 Game and Activity Data

When you play, we store your answers, scores, and preferences so your history and standings persist across sessions. For anonymous visitors this is linked to a randomly generated player identifier stored in a cookie, not to a name or email. For registered users it is linked to your account.

3.8 Cookies and Local Storage

We use cookies and browser local storage to operate the Service:

• Session cookies: essential for sign-in and cross-site request forgery protection.
• Preference cookies and local storage: your theme, difficulty setting, and similar choices.
• Identity cookie: maintains your anonymous player identity so your game history persists.

We do not use advertising cookies or third-party tracking cookies, and we do not run a third-party analytics product — usage measurement happens on our own servers. You can clear or block these in your browser; doing so will reset anonymous game progress and may break features that need them.

4. How We Use Your Information

• Provide, operate, and maintain the Service
• Keep your game progress, saved work, and activity history
• Process payments, manage subscriptions, and deliver purchased reports
• Send transactional email — password resets, confirmations, report links, receipts, and account notices
• Send product news and updates, if you asked to be notified or opted in
• Understand aggregate usage so we can decide what to build
• Detect, prevent, and address abuse, security problems, and technical faults
• Comply with legal obligations

Every marketing email includes an unsubscribe link. Opting out does not stop transactional email, which we must send to operate your account.

We do not sell your personal information, and we do not share it with third parties for their own advertising.

5. Service Providers

We share data only with the vendors needed to run the Service, each under its own privacy terms and only to perform work on our behalf:

• Render — application hosting, and short-lived operational state such as rate-limiting counters (United States)
• Supabase — hosting of the primary application database (United States)
• Amazon Web Services — file and document storage
• Postmark — delivery of transactional email
• Sentry — error reporting, so we learn when a page breaks
• Stadia Maps — address search and base map imagery

Stripe is the exception. For paid subscriptions and report purchases Stripe acts as merchant of record rather than as our service provider, and processes payment, tax, and transaction-support data as an independent controller under its own privacy policy — not on our behalf and not under our instructions. See Section 3.2.

Some of these are contacted by your browser rather than by our servers, which means they receive your IP address and browser information as a normal part of serving a request. That applies to Stadia Maps (map tiles), to Google Fonts (typefaces), and to the unpkg and jsDelivr content delivery networks (mapping libraries). The public datasets we display — census data and OpenStreetMap — involve no exchange of your personal data.

6. Retention

We keep Personal Data only as long as needed for the purposes in this policy, or as required to meet legal, tax, and accounting obligations, resolve disputes, and enforce our agreements.

Network identifiers age out automatically. Visit and event logs, and the truncated IP address and browser user agent recorded against a player, are deleted or cleared after 12 months.

Game history is kept indefinitely, deliberately, so that leaderboards and personal statistics stay accurate over time. It is stored against a random player identifier rather than your name or email.

Purchased report records and documents are retained so the permanent viewing link continues to work and so we can meet support, accounting, and dispute obligations. This includes the submitted locations, report configuration, buyer email, capability tokens, and generated HTML and PDF files. Contact us under Section 11 if a link has been disclosed or you want to ask whether a record can be removed subject to those obligations.

Account deletion removes your account and the location history associated with it, and rotates your player identifier to a fresh random value — which severs the link between the surviving game records and you. The game rows themselves remain, now unlinked, so that other players' standings are not altered. Deleting your account also cancels any paid subscription with immediate effect — including one in a failed-payment retry state — so it cannot bill you again; if that cancellation cannot be confirmed with Stripe, the deletion is refused rather than left to keep charging you. We retain the subscription records we need to resolve disputes and meet our own accounting obligations; the sales tax, VAT, and GST obligations on your purchases are Stripe's rather than ours, as merchant of record.

Deleting your BlockAtlas account does not delete Stripe's payment records, which Stripe holds as merchant of record and retains under its own policy and legal obligations. You can request deletion directly from Stripe: doing so cancels any Managed Payments subscription and removes your data from Stripe's records, which may in turn remove it from the billing records we hold. A Stripe-side deletion can therefore reach our data without going through us.

7. International Transfers

We operate in the United States, and your information is stored and processed there. If you use the Service from outside the United States, you understand that your information will be transferred to and processed in a country whose data protection laws may differ from your own. We take steps reasonably necessary to ensure it is treated securely and in accordance with this policy.

8. Disclosure

We may disclose Personal Data:

• To comply with a legal obligation or a valid request from public authorities
• To protect and defend our rights or property
• To investigate possible wrongdoing in connection with the Service
• To protect the personal safety of users or the public, or to protect against legal liability
• In connection with a merger, acquisition, or sale of assets — in which case we will give notice before your Personal Data becomes subject to a different privacy policy

9. Security

We use reasonable technical measures to protect your data, including encryption in transit, hashed password storage, secure cookies, and restricted access to production systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect Personal Data from them. If you are a parent or guardian and believe your child has provided us with Personal Data, contact us and we will delete it.

11. Your Rights

Wherever you live, you may ask us to:

• Access your data — receive a copy of the personal information we hold about you, in a structured, commonly used, machine-readable format.
• Correct your data — fix anything inaccurate, which for most fields you can do yourself in account settings.
• Delete your data — remove your personal information, subject to records we must keep by law. See Section 6 for exactly what deletion does.

Depending on where you live — for example the EEA or UK under the GDPR, or California under the CCPA/CPRA — you may have additional statutory rights, including the right to object to or restrict processing and to complain to your data protection authority. We honor verified requests as required by law and will not treat you differently for making one.

To make a request, email [email protected]. We respond within 30 days and may need to verify your identity first.

Payment data is the exception. Because Stripe is the merchant of record and an independent controller for it (Sections 3.2 and 5), requests about your payment, billing, invoice, or tax records — including access and deletion — have to go to Stripe or Link, which is also where subscriptions can be cancelled and payment methods changed. We cannot fulfil those on Stripe's behalf. Ask us anyway if you are not sure who holds what, and we will point you to the right place.

12. Links to Other Sites

The Service may link to sites we do not operate. We have no control over their content or privacy practices, and we encourage you to read the privacy policy of every site you visit.

13. Changes to This Policy

We may update this policy. We will post the new version on this page and revise the date at the top, and we will announce material changes on the site or by email.

14. Contact Us

Questions, or a data access or deletion request: [email protected].

By post:
BlockAtlas
1449 S Michigan Ave STE 13935, Chicago, IL 60605