Privacy

What is stored about you

To sign you in. Your email address, and a session record containing its own token, its expiry, and the IP address and browser user-agent it was created from. Signing in with Google also stores the name and profile-image URL Google returns.

Because you chose it. Your handle. Optionally an Instagram handle, if you give one so a certified bloc can tag you. Your notification preferences, and — if you enabled push — the subscription endpoint and keys your browser issued.

Because you submitted it. Photographs of your blocs, and whatever else you chose to write: a name, a description, ingredients, a weight, dimensions, figures. Everything except the photograph is optional.

Because you inspected. The ratings you file are stored against your account. They are never shown to anyone as yours.

What Google is asked for

Two scopes and no others: userinfo.email and userinfo.profile. The registry cannot read your mail, your files, your contacts or your calendar, and does not ask to. Signing in with a magic link instead uses only the address you type.

What is public

Your handle, your blocs, and their scores. A certified bloc is published to a public Instagram account with credit to you — that is what the registry is for, and submitting a bloc is agreeing to it.

Your email address is never shown. Your individual ratings are never shown, to anyone, including the maker of the bloc you rated.

Anonymous audience measurement

Bloccers keeps first-party daily totals to understand whether the service works: guest sessions, active time, inspections, submissions and clicks on a short fixed list of controls. It stores no raw event history, page address, search text, IP address, referrer, device fingerprint or user agent. Nothing is sent to an analytics company.

A random marker stays in this browser for up to 180 days so the same browser is counted once as new and at most once on a returning day. The marker itself never leaves your device and is never joined to an account or activity. Another browser, device, private window or cleared browser storage will count separately, so these are browsers, not people.

Global Privacy Control and Do Not Track are honored automatically and stop this measurement. No advertising, nothing is sold, rented or shared for marketing, and your data is not used to train anything.

The registry uses a small number of services to function at all: a database and file storage to hold the archive, an email service to send sign-in links, and a hosting provider. A submitted photograph is sent to an automated screen that checks it is food and not abuse. None of these are given your data for their own purposes.

An accession number is permanent

This is the part worth reading twice. When a bloc is admitted it takes a permanent number, and that number is never reissued — not by you, and not by us. A registry that could be edited backwards would not be a registry.

Corrections are made by amendment rather than deletion, and the record shows both.

Deleting your account is different, and you choose what happens to your blocs. By default they stay in the archive, public under the licence you granted, credited to anonymous former Bloccer with no handle, no page and no identifier that could gather them back together. If you ask for them to be destroyed instead, each one goes through the expungement procedure in clause 6 and its number remains consumed, standing empty. Either way the account itself goes entirely. See deleting your account.

Erasure, and the exception that exists for it

Clause 5 is the rule, not a way of refusing a legal request. You can ask for your personal data to be erased and that request will be honoured: the account, the email address, the session records, the notification subscriptions.

For an admitted bloc there is a separate, deliberately rare procedure — the photographs, text and derivatives are destroyed, and the number itself remains consumed, with a record that says only that something was expunged and when. That is how the archive avoids gaps it cannot account for while still removing what has to go. It is used for legal erasure requests, for content involving someone who did not consent, and for material that should never have been admitted.

How long things are kept

Sessions expire on their own. Push subscriptions are deleted as soon as a browser reports them dead. Everything else is kept while the account exists, and the archive itself is intended to be permanent.

Reports

If you report a bloc, the registry stores which bloc, which category you chose, and when. It does not store anything you wrote, because there is nothing to write: the reasons are a fixed list. The maker is not told who reported them.

The registry answers reports within 48 hours. Blocking a Bloccer is private to you — they are not notified, and nothing about the archive changes.

Asking

To see what is held about you, to correct it, or to ask for erasure, write to registry@bloccers.com. If a request is refused you will be told why.