Privacy Policy

1. Data we process

Account data includes your name, email address, password hash, verification status and account role. Passwords are stored as hashes; administrators' authenticator secrets and sensitive delivery or purchase tokens are encrypted on the server.

Gameplay data includes wallet entries, digital block ownership, groups, listings, acquisitions, receipts, reports, blocked-player preferences and account deletion requests. Images, titles, descriptions and links that you submit are also stored.

Service and security logs may include your IP address, request time, route, response status and browser or app identification. Language, appearance and server preferences are stored on your device. The app stores its session using Android Keystore encryption; this version does not request location, contacts or camera permissions.

2. Why we use data

We use this information to provide accounts and gameplay, verify ownership, process B$ transactions, display permitted content, issue receipts and deliver requested verification or recovery emails. We also use it to prevent abuse, investigate reports, maintain backups and protect account access.

Where applicable, processing relies on providing the requested service, compliance with legal obligations and legitimate security interests. Optional content and features are used at your initiative. We do not promise anonymity for server transactions.

3. Public content

Approved images, titles, links and listing information can be visible to other players. Digital ownership and marketplace data may expose game account identifiers. Your acquisition receipts and account email are not intended for public display.

Avoid publishing personal information in your images or content that you do not want others to see. External links lead to services with their own privacy practices.

Optional owner cards publish only the display name you choose, the neighborhood, city block, selected virtual blocks and a verification code. Your email, wallet and private receipts are not published. You can make the card private; when ownership changes, the former owner page and certificate verification are disabled. Transfers validate an existing verified account by email and retain the ownership and fee history.

4. Providers and sharing

Cloudflare handles public traffic protection, DNS and the encrypted tunnel; Cloudflare Access protects administrator access. The game is hosted on the operator's server and uses restricted local backups. When SMTP is enabled, the configured email provider receives recipient addresses and message contents needed for delivery.

Google Play processes purchases of game currency. Payment status is verified before currency is credited, and refunds are reflected in the game balance. The game does not store payment card details or offer cash withdrawals.

We do not sell personal information. Data may be disclosed when needed to provide these services, protect rights or comply with a lawful request. Providers may process data in other countries, under their applicable safeguards and terms.

When the administrator enables reCAPTCHA v2 for web sign-in or registration, Google processes connection and browser signals to assess automated activity. The verification token is sent to our server for validation. This feature is not embedded in the Android app. See Google privacy terms at https://policies.google.com/privacy and https://policies.google.com/terms.

When optional metrics are enabled by the administrator and accepted by you, Google Analytics/Firebase processes installation identifiers, usage events and technical device/app information. Android uses the Firebase project configured in the application; the website uses its GA4 web stream. Advertising ID collection, Google Signals and ad personalization are disabled in this implementation. We do not add account email, password, public display names, wallet balance or authentication codes to our custom usage events. Analytics retention follows the responsible party’s Google property settings. The SDK can also derive approximate location from masked IP addresses and record store purchase events when purchases are enabled.

Optional Android notifications use Firebase Cloud Messaging, which processes a registration token and Firebase installation identifier to deliver game news. The Android app asks for notification permission when applicable. You may disable notifications in the app or in Android settings. Message sending can be managed in the Firebase Console. These technical identifiers do not grant access to your MyBlocks account or wallet.

5. Cookies and device storage

The site uses essential language and session cookies. Optional Google Analytics cookies are enabled only when the administrator enables web metrics and you accept them. You can change the choice using Metrics preferences. Administration uses session and Cloudflare Access cookies. You can choose metrics in the Metrics preferences section of this Privacy Policy, without notices while browsing.

The visitor language is selected from an explicit choice, a saved preference, browser language or, as a fallback, a country indicator supplied by Cloudflare. We do not request GPS location for this purpose. You can change language on the website and in the app.

New password sign-ins require a single-use, six-digit code delivered to your email. You may enable biometric access on compatible Android devices to reopen an authenticated session. The game does not collect fingerprints or facial templates and does not save your password for this feature; Android authorizes access to a cryptographic key held on the device.

Browser gameplay uses an essential HttpOnly session cookie. Its inactivity limit is 45 minutes, with a maximum duration of 12 hours. Authentication tokens remain on the server. The browser stores the chosen theme and, temporarily within its tab, a pending transaction identifier and request details to prevent duplicate operations; it does not store your password. Browser and Android use the same game account, wallet and properties.

6. Retention and deletion

Account and gameplay information remains while needed to operate your account and service. Account deletion requests are reviewed for ownership, balances, properties and applicable retention duties. A request is not an instant deletion of all transaction history.

Security request logs rotate daily with 14 retained log files. Authentication attempt records are cleaned after approximately one day; expired verification tokens and sessions are periodically removed. Daily backups retain 14 completed sets, so deleted data can remain in restricted backups until those sets expire.

Transaction and idempotency history is retained to prevent repeated operations and fraud and to meet applicable obligations. Where retention is necessary after account deletion, the operator must limit the data to that purpose and explain the applicable grounds when responding to your request.

7. Your rights and contact

You may request information about processing, access, correction, deletion or anonymization when applicable, information about sharing, and withdrawal of consent where consent is the basis. You can also raise a complaint with the competent data protection authority.

Contact the responsible operator shown on this page. We may ask for information necessary to verify ownership and protect your account. Do not provide passwords, complete payment data or authenticator secrets. Requests are reviewed in accordance with applicable law.

8. Security and updates

The service uses HTTPS, access controls, server-side transaction checks, limited database permissions and restricted backups. Administrator authentication follows the authenticator policy configured by the responsible operator. No system can guarantee complete protection against all incidents.

This policy may change when features, providers or processing practices change. The update date is displayed at the top. Google Play publication, real payments and the operator's privacy procedures require their own review before release.

Metrics preferences

Google Analytics helps us understand website usage. Optional collection stays off until you enable it in this browser. You can change your choice on this page at any time.