blockdeco – Privacy Policy

Effective Date: October 27, 2026

This Privacy Policy explains how blockdeco collects, uses, stores, shares, and protects personal data and uploaded content, including data processed through blockdeco First, our optional Instagram and Flickr publishing feature.

blockdeco is a non-commercial hobby project operated privately by its founders. It is not currently operated through a company or separate legal entity.

1. Data Controllers

Personal data is managed by:

Dániel Sasvári, Hungary
Dávid Sándor, Hungary

Contact for all privacy, GDPR, deletion, export, copyright, and legal requests:

[email protected]

2. What Data We Collect

blockdeco may collect and process the following categories of data.

Account data

email address;
password hash;
email verification status;
account status;
account creation and update timestamps, including last login and last token refresh timestamps;
two-factor authentication or security-related data, if enabled or used;
invitation records, when an account is created by accepting an artist invitation: the invited email address, invitation token, invitation expiry, and acceptance status;
policy acceptance records: which Terms of Use and Privacy Policy version was accepted, the acceptance timestamp, and the IP address and browser/device information recorded at the time of acceptance.

Passwords are hashed and are never stored in plain text.

Artist profile data

If a user becomes an artist, blockdeco may collect and display:

artist name;
social profile links;
donation links;
founding-artist status or similar badges;
artist profile creation date;
public artist-related information provided by the artist.

Artwork and uploaded content

Artists may upload or provide:

artwork images;
artwork titles;
descriptions;
dimensions;
tags;
BrickStudio files or similar model files;
related metadata;
other information connected to an artwork submission.

Connected social account data — blockdeco First

If an artist connects Instagram or Flickr, blockdeco processes information received through the platform's authorization and account-information interfaces, including:

the platform, currently Instagram or Flickr;
the platform-scoped account identifier;
the platform username or handle;
the account type, such as business or creator, where the platform reports it;
the platform-issued access token, stored in encrypted form;
for Flickr, the access-token secret required to sign API requests, also stored in encrypted form;
token expiry information, where provided;
permissions or scopes granted by the platform;
connection status, such as active, revoked, expired, or error;
the connection date and the most recent token refresh date, where applicable;
temporary authorization information needed to complete and validate the connection.

blockdeco does not receive or store the artist's Instagram or Flickr password. Stored social credentials are separate from the credentials used to sign in to blockdeco.

First publishing content, instructions, and execution records

For artwork versions prepared for First publication, blockdeco stores:

the selected target platform and associated connected account;
platform-specific publishing text;
the selected artwork images;
Flickr tags, where supplied;
artwork-version and platform-specific publishing instructions, including whether automatic publication is enabled;
publication status, successful publication records, and completion times;
platform-issued technical identifiers used to prepare, complete, or track publication, including Instagram media-container identifiers and Flickr photo identifiers.

These records allow blockdeco to carry out the artist's instructions, show publication results, and maintain the relevant artwork-version and publishing history.

Moderation and operational data

blockdeco may process:

moderation decisions;
rejection reasons;
review status;
internal notes;
duplicate or previously rejected submission detection data;
technical identifiers used to protect the Platform and enforce submission rules.

blockdeco may use technical measures to detect previously rejected or duplicate submissions.

Logs and technical data

blockdeco may collect:

IP addresses;
request logs;
browser and device information;
security logs;
error logs;
performance logs;
audit logs;
authentication logs;
CDN or hosting-related logs;
analytics identifiers if analytics consent is granted.

Cookie and analytics data

If a user consents to analytics cookies, blockdeco may use Google Analytics 4 to collect analytics information about website usage.

If analytics cookies are rejected, blockdeco will not load analytics cookies or collect analytics data through Google Analytics for that user.

3. Public Data

blockdeco is a public gallery.

Content submitted by artists or uploaded with written approval for publication may become publicly visible.

Public content may include:

artist name;
uploaded images;
artwork title;
artwork descriptions;
artwork dimensions;
artwork tags;
BrickStudio or model files;
donation links;
social profile links;
founding-artist status or similar badges;
the year the artist profile was created;
other artist-provided public information.

The following are not intended to be public:

email address;
password hash;
security logs;
internal moderation data;
internal account metadata;
private support communications;
stored social access tokens and token secrets;
internal social connection, permission, and publishing-instruction records;
unpublished platform-specific publishing drafts and internal execution records.

Connecting a social account does not, by itself, make its connection records public. When First is used, the selected publishing content is sent to the artist's chosen platform and becomes visible according to that platform's rules and the applicable publishing or account settings. Some identifiers of published content may also be publicly visible on that platform.

Public content may appear on:

https://blockdeco.com;
blockdeco-operated social media channels, including Instagram, TikTok, Pinterest, Facebook, and similar platforms;
the artist's own selected Instagram or Flickr account when publication is instructed through First;
search engines;
AI indexing systems;
public previews;
archive systems;
third-party caches;
external websites or forums outside blockdeco's control.

Because the Platform is public, blockdeco cannot guarantee that public content will not be copied, indexed, cached, downloaded, reposted, archived, discussed, or redistributed by third parties.

4. Ownership of Uploaded Content

Uploaded content remains the property of the artist or the relevant rights holder.

blockdeco does not obtain ownership of uploaded images, descriptions, model files, or related artist content.

blockdeco stores, displays, distributes, caches, indexes, and promotes artist content only under the permissions described in the Terms of Use and granted by the artist.

5. Why We Process Data

blockdeco processes data for the following purposes:

creating and managing user accounts;
verifying email addresses;
enabling login and security features;
issuing and validating artist invitations;
allowing artists to submit artworks;
reviewing and moderating artwork submissions;
displaying approved artworks publicly;
hosting downloadable files;
operating the public gallery;
maintaining sitemaps and public discoverability;
publishing public artist content on blockdeco-operated social channels;
connecting, validating, maintaining, refreshing, and disconnecting the artist's optional social connections;
preparing and transmitting approved artworks to the selected platform under the artist's publishing instructions;
recording publishing settings, execution results, and relevant artwork-version history;
handling copyright, privacy, deletion, export, and support requests;
protecting the Platform against abuse, spam, unauthorized access, and security threats;
maintaining logs, backups, and operational records;
improving the Platform;
complying with legal obligations;
collecting analytics only where consent has been granted.

6. Legal Bases for Processing

Where GDPR applies, blockdeco relies on the following legal bases:

Contractual necessity

Used where processing is necessary to provide account functionality, login, artist upload features, content hosting, and related Platform services.

When an artist uses First, this also covers processing the connection data, publishing content, instructions, and execution records needed to provide the requested integration and carry out the artist's publication instruction.

Consent

Used for optional analytics cookies and Google Analytics.

Users may reject analytics cookies. If rejected, analytics will not be collected through Google Analytics.

Legitimate interests

Used for security, abuse prevention, moderation, service maintenance, logs, backups, technical operations, public gallery operation, and protection of blockdeco and its users. It may also cover maintaining records needed to investigate a First publication issue or demonstrate what publication action was requested or completed.

Legal obligations

Used where blockdeco must keep or process data to comply with applicable legal requirements, respond to lawful requests, or handle disputes and rights claims.

7. Hosting, Storage and Infrastructure

blockdeco uses DigitalOcean infrastructure for:

application hosting;
database hosting;
object storage;
uploaded image storage;
uploaded file storage;
backups;
CDN distribution;
technical infrastructure.

Primary database and file storage are located in London.

Some cached content may temporarily be distributed globally through CDN infrastructure or other technical caching layers. blockdeco cannot guarantee immediate removal of cached copies from all caching systems.

blockdeco may also use third-party services for email delivery, analytics, security, monitoring, managed key storage, or other technical purposes if needed to operate the Platform.

8. Cookies and Google Analytics

blockdeco uses cookies and similar technologies.

Essential cookies may be used for login, security, authentication, session handling, and basic website operation. This includes a refreshToken cookie, which is HttpOnly and Secure and has a set expiration date, so it is not automatically removed simply by closing the browser tab or window — it remains valid until it expires or the user logs out.

The access token used to authenticate requests after login is kept in the browser’s local storage rather than as a cookie, for the duration until it expires or the user logs out.

Analytics cookies are optional. blockdeco uses Google Analytics 4 only if the user gives consent through the cookie consent window.

If the user rejects analytics cookies, blockdeco will not collect analytics data through Google Analytics for that user.

Users may change or withdraw cookie consent where the Platform provides this functionality, or by clearing cookies in their browser.

A separate Cookie Policy may provide additional details.

blockdeco does not show advertising and does not use advertising networks.

Some content on blockdeco is served by third parties rather than by blockdeco itself: web fonts from Google Fonts, icons from the cdnjs content delivery network, and, in the 3D model viewer, model parts from the jsDelivr content delivery network. When a page loads this content, the user's browser connects to these providers directly, so they receive the user's IP address and browser information. These third parties, and Google Analytics where consent is granted, may place or read cookies or use similar technologies under their own privacy policies.

The blockdeco sign-in token described in this section is different from the Instagram and Flickr access credentials used by First. Social access tokens and Flickr token secrets are stored in encrypted form on the server side; they are not the blockdeco access token kept in browser local storage. The external platform may use its own cookies or similar technologies during its sign-in and authorization process, under its own policies.

9. Email Communications

blockdeco may send essential service emails, including:

email verification emails;
two-factor authentication or security emails;
account-related notices;
policy update notices;
important service or operational notifications.

blockdeco does not currently send marketing newsletters.

10. Social Media Publication

Artists understand that approved public artworks and artist-provided public information may be displayed on blockdeco-operated social media channels, including Instagram, TikTok, Pinterest, Facebook, and similar platforms.

These posts may include uploaded images, artwork titles, artist names, descriptions, tags, and similar public information.

If an artist later deletes their account or requests removal from blockdeco, previously published social media posts may remain available unless removal is legally required or separately agreed.

Social media platforms may process data according to their own privacy policies. blockdeco does not control how those platforms process data.

10.1 blockdeco First

First allows an artist to connect Instagram or Flickr through the relevant platform's authorization process. The platform provides the authorized account information and access credentials described in Section 2. Connecting an account does not, by itself, instruct blockdeco to publish.

Instagram publishing requires the permissions and account eligibility supported by the platform. Flickr uploading requires its write permission, which can technically permit additional actions; blockdeco uses the granted access only to provide the requested First functions.

Publication occurs only after the relevant artwork version has been approved. While editing an artwork, the artist may enable automatic publication for a selected platform, in which case approval triggers publication. For manual publication, the artist may choose to publish an artwork that has already been approved and sets the platform-specific publishing content and settings when choosing to publish. The publication is then carried out for that approved artwork version.

To carry out the artist's instruction, blockdeco sends the relevant content and necessary technical data to the selected platform using the authorized connection. The platform may process the content while preparing publication, including creating a media container, and returns status information and identifiers that blockdeco records.

Preparing a publishing draft does not make it public. Submitted content is processed by the chosen platform, and published content is visible under the relevant publishing options, account settings, defaults, and platform rules.

Disconnecting in blockdeco deletes the access token and, where applicable, token secret from active systems. Expired stored credentials are also deleted. Account deletion likewise removes stored social access credentials. Deleting credentials does not necessarily delete non-credential connection metadata or publication history, which may be retained for the purposes described in this Policy. The history of the connection is kept for at most one year (see Section 13).

The artist can also remove blockdeco's authorization in the relevant Instagram, Meta, or Flickr account settings. A local disconnection does not necessarily revoke the provider-side authorization.

Disconnecting, deleting an artwork, or deleting a blockdeco account does not automatically delete posts already published to the artist's own social account. Those posts remain with the platform until removed there or otherwise handled under that platform's rules. blockdeco cannot guarantee removal of independently held copies, reposts, or caches.

Instagram and Flickr process data for their own services under their respective policies. They are not simply blockdeco's hosting providers. See the Instagram Privacy Policy and Flickr Privacy Policy.

This product uses the Flickr API but is not endorsed or certified by SmugMug, Inc.

11. Search Engines, AI Systems and Third-Party Indexing

Public content on blockdeco may be indexed by search engines, AI systems, social platforms, automated discovery systems, public previews, archives, and similar services.

blockdeco may include approved artworks in sitemaps and metadata to support public discoverability.

blockdeco cannot guarantee removal from third-party indexes, caches, AI systems, archives, screenshots, reposts, or external websites after content is deleted from blockdeco.

12. Data Sharing

blockdeco does not sell personal data.

blockdeco may share or make data available as follows:

public artist content may be visible publicly;
uploaded public content may be distributed through hosting and CDN infrastructure;
Google Analytics may process analytics data if consent is granted;
Google Fonts, cdnjs, and jsDelivr receive the user's IP address and browser information when the browser loads fonts, icons, or 3D model parts from them, as described in Section 8;
DigitalOcean may process hosting, storage, infrastructure, logging, and backup data;
Instagram/Meta and Flickr may receive connected-account authorization requests, credentials used for authenticated API requests, and the content and technical information needed to carry out the artist's selected First publishing instruction;
email service providers may process email delivery data if used;
legal or security requests may require disclosure where required by law;
service providers may process data where necessary to operate the Platform, including limited managed key-storage functions.

Connecting one platform does not authorize sending publishing content to another platform.

blockdeco does not process payments directly.

Donation links and external payment pages are controlled by the artist or third-party services, not by blockdeco.

13. Data Retention

blockdeco keeps data only as long as reasonably necessary for the purposes described in this Privacy Policy.

General retention principles:

account data is kept while the account exists;
public artist content is kept while the artist account and artwork remain active;
artist invitation records are retained as-is after acceptance or expiry, and are not automatically deleted; blockdeco may manually delete an invitation record;
deleted public content is removed from public visibility as soon as reasonably possible;
hard deletion is generally completed within five business days where technically and legally possible;
logs may be retained for security, audit, abuse prevention, diagnostics, and legal purposes;
backups may temporarily retain deleted data until backup rotation or deletion processes remove it;
moderation records and technical duplicate-detection information may be retained where necessary to protect the Platform and prevent repeated abuse or reuploads;
social access tokens and Flickr token secrets are deleted from active systems when a connection is disconnected or an account is deleted, and expired stored credentials are also deleted;
the history of a social connection (the platform, account identifier, username, and connection events such as connected, renewed, disconnected, or removed) is deleted one year after it was recorded;
artwork-version publishing instructions, publication results, completion times, and platform identifiers may be retained as part of the relevant artwork and publication history while they are needed for that purpose.

blockdeco does not promise instant permanent deletion from every technical system, backup, cache, index, or third-party service. Backup copies may retain encrypted records until the hosting provider's backup rotation or deletion process removes them; they are restricted recovery copies and are not used for routine publishing operations.

14. Account and Content Deletion

Users may request deletion of their account, profile, uploaded content, or First connection data by contacting:

[email protected]

A social account can also be disconnected through blockdeco account settings. Disconnecting a social account deletes its stored access credentials from active systems, but does not necessarily delete all non-credential connection metadata or publication history. The history of the connection is kept for at most one year (see Section 13).

Deletion process:

public content is soft-deleted immediately or as soon as reasonably possible;
hard deletion is generally completed within five business days where technically and legally possible.

Some information may remain temporarily or permanently in:

security logs;
audit logs;
server logs;
backups;
moderation records;
legal records;
abuse-prevention systems;
artwork-version and publication-history records where needed for a specific lawful purpose;
third-party caches or indexes outside blockdeco's control.

Deleting data from blockdeco does not automatically delete First posts from the artist's own Instagram or Flickr account. Artists can manage those posts on the relevant platform. blockdeco cannot guarantee deletion of independently held search results, archives, screenshots, reposts, or other third-party copies.

Deletion from blockdeco does not guarantee deletion from search engines, AI systems, social media platforms, archive systems, screenshots, mirrors, reposts, or external websites.

15. Data Export and GDPR Rights

Where applicable, users may have the right to:

access their personal data;
request correction of inaccurate data;
request deletion;
request restriction of processing;
object to certain processing;
request data portability;
withdraw consent for analytics cookies;
lodge a complaint with a data protection authority.

Requests can be sent to:

[email protected]

blockdeco may need to verify the identity of the requester before fulfilling certain requests.

16. Security

blockdeco uses reasonable technical and organizational measures to protect user data, including hashed password storage and account verification.

First access tokens and Flickr token secrets are encrypted at rest. The keys used to protect them are themselves protected using separately managed key material held through a key-vault service. Access to the encrypted database alone is therefore not intended to provide the means to decrypt those credentials.

Credentials are used by server-side components that operate the integration and are not published as gallery or artist-profile content. They are different from the blockdeco sign-in token described in Section 8.

Security vulnerabilities can be reported to [email protected]; see also https://blockdeco.com/.well-known/security.txt.

However, no website, hosting provider, storage system, or internet transmission is completely secure.

Users are responsible for keeping their account credentials secure and for protecting access to their own email accounts, browsers, and devices.

17. International Access

blockdeco is globally accessible.

Although the Platform is operated from Hungary and hosted primarily using DigitalOcean infrastructure with primary database and file storage in London, users may access the Platform from other countries.

Public content may be visible worldwide.

Some technical processing, caching, analytics, or third-party service processing may occur outside the user’s country of residence.

18. Children and Minors

blockdeco is not intended for users under 16 years old.

Users must be at least 16 years old to use the Platform.

If blockdeco learns that a user under 16 has created an account, blockdeco may delete or restrict the account.

19. Changes to This Privacy Policy

blockdeco may update this Privacy Policy from time to time.

If changes are material, blockdeco may notify users through the Platform, email, or another reasonable method.

Continued use of the Platform after an updated Privacy Policy becomes effective means that you acknowledge the updated Privacy Policy.

20. Contact

For privacy requests, GDPR requests, deletion requests, export requests, copyright complaints, legal notices, or support matters, contact:

[email protected]