Platform Privacy Policy

1. Information We Collect

When you register an account or interact with the BLOCS 3D platform, we collect the minimum necessary information to provide virtual real-estate services:

• Account Data: Email address, encrypted authentication tokens, and user profile information (display name, brand moniker, public avatar).
• Creative Submissions: Advertising text (headlines, taglines), destination website links, and uploaded raster image files (JPEG, PNG, WebP).
• Financial & Game Ledger: Virtual wallet balances, promotional credit awards, supply drop claims, takeover records, and timestamped transaction entries.

2. Media Storage & Quarantine Processing

Uploaded billboard artwork and logos are transmitted to a secure, private quarantine storage bucket. Prior to public serving:

• Images are sanitized using the Sharp image processor (metadata stripped, resolution capped to 1600×1600 max, converted to optimized WebP).
• Unapproved or draft media is restricted from public caching (`Cache-Control: private, no-store`).
• Only assets associated with approved, active skyline placements are served publicly.

3. Automated AI Content Moderation

To protect users and maintain high-quality city aesthetics, submitted headlines, brand names, and sanitized image rasters are processed by automated AI models (Google Gemini) via secure server-side Edge functions.

The model receives only the minimal necessary creative payload required for safety classification. The model does not store your content for training or have arbitrary access to database records.

4. Cookies & Security Tokens

BLOCS utilizes secure, HTTP-only session cookies (`block_session`) and cryptographic CSRF tokens (`block_csrf`) for authentication and cross-site request forgery prevention. We do not use third-party advertising tracking cookies.

5. Your Rights & Data Deletion

You have the right to request a copy of your personal data or request deletion of your account and submitted creative assets. Contact privacy@blocs.city with your registered email address to initiate a data request.