Privacy
What the registry stores, why it stores it, and what it never does with it.
What is stored about you
To sign you in. Your email address, and a session record containing its own token, its expiry, and the IP address and browser user-agent it was created from. Signing in with Google also stores the name and profile-image URL Google returns.
Because you chose it. Your handle. Optionally an Instagram handle, if you give one so a certified bloc can tag you. Your notification preferences, and — if you enabled push — the subscription endpoint and keys your browser issued.
Because you submitted it. Photographs of your blocs, and whatever else you chose to write: a name, a description, ingredients, a weight, dimensions, figures. Everything except the photograph is optional.
Because you inspected. The ratings you file are stored against your account. They are never shown to anyone as yours.
What Google is asked for
Two scopes and no others: userinfo.email and userinfo.profile. The registry cannot read your mail, your files, your contacts or your calendar, and does not ask to. Signing in with a magic link instead uses only the address you type.
What is public
Your handle, your blocs, and their scores. A certified bloc is published to a public Instagram account with credit to you — that is what the registry is for, and submitting a bloc is agreeing to it.
Your email address is never shown. Your individual ratings are never shown, to anyone, including the maker of the bloc you rated.
What is never done
No analytics. No tracking pixels. No advertising, and nothing sold, rented or shared with anyone for marketing. Your data is not used to train anything.
The registry uses a small number of services to function at all: a database and file storage to hold the archive, an email service to send sign-in links, and a hosting provider. A submitted photograph is sent to an automated screen that checks it is food and not abuse. None of these are given your data for their own purposes.
An accession number is permanent
This is the part worth reading twice. When a bloc is admitted it takes a permanent number, and an admitted bloc is not deleted — not by you, and not by us. Closing your account does not remove your blocs from the archive. A registry that could be edited backwards would not be a registry.
Corrections are made by amendment rather than deletion, and the record shows both.
Erasure, and the exception that exists for it
Clause 5 is the rule, not a way of refusing a legal request. You can ask for your personal data to be erased and that request will be honoured: the account, the email address, the session records, the notification subscriptions.
For an admitted bloc there is a separate, deliberately rare procedure — the photographs, text and derivatives are destroyed, and the number itself remains consumed, with a record that says only that something was expunged and when. That is how the archive avoids gaps it cannot account for while still removing what has to go. It is used for legal erasure requests, for content involving someone who did not consent, and for material that should never have been admitted.
How long things are kept
Sessions expire on their own. Push subscriptions are deleted as soon as a browser reports them dead. Everything else is kept while the account exists, and the archive itself is intended to be permanent.
Asking
To see what is held about you, to correct it, or to ask for erasure, write to registry@bloccers.com. If a request is refused you will be told why.