Privacy policy

Effective October 10, 2026 · Version 2026-10-10-campaigns · Block Library · Washington, United States

Block Library is an independent Minecraft schematic library operated by BlockLibrary LLC, a Washington, United States limited liability company, effective October 3, 2026. BlockLibrary LLC is responsible for the personal data described here and is the data controller where applicable data protection law uses that term. “We,” “us,” and “our” mean BlockLibrary LLC. This notice describes our data practices as of the effective date. Email the operator with questions about your data.

Browse with optional collection off

Optional display preferences and Umami analytics are off until you choose each purpose separately. We use consent-based page-view analytics as described below. We also use aggregate download, file, and community activity counts and operational records to run and monitor the library. Google advertising choices are separate and off until you request them. Ad serving also depends on publisher approval. When you request a download, we record an aggregate request count for that file without attaching an IP address or account identifier to the count. Browsing and downloads do not require optional storage or analytics.

Your browser and our hosting providers must process your IP address, requested URL, and basic connection information to deliver and protect the site. This happens before a privacy prompt can appear. We do not use this essential network processing to build visitor profiles. Browser caches may retain public files. AWS security and operational processing is distinct from optional storage. Our custom banner runs in your browser and stores your separate display-preference, analytics, and Google advertising-load choices, their notice versions, and dates in your browser's local storage. The local record is not sent to a third party; Google separately manages its advertising consent record only after you request Google advertising choices. See our cookie policy.

Optional Umami analytics

If you allow analytics in Cookie settings, we use Umami Cloud, provided by Umami Software, Inc., to count public-page visits and completed file transfers and measure which approved campaigns bring downloads. Your browser loads cloud.umami.is and sends requests to gateway.umami.is. We send the site identifier, hostname, fixed page-category path and title, and approved campaign source, medium, campaign, and creative labels. Only campaign labels configured by the operator are accepted; arbitrary URL values are excluded. A download-success event means your browser received the complete file and started the save; it does not confirm saving to disk or importing into Minecraft. Refusing analytics does not prevent downloading. We exclude search terms, raw URL queries and fragments, referring URLs, account and file identifiers, submitted text, and uploaded content. Account, upload, administration, contact pages, and documents with retained account-session data are excluded. We do not enable visitor identification, session replay, or advertising tracking pixels.

These requests expose your IP address and browser user-agent to Umami and its infrastructure providers. Umami can derive approximate location and browser/device information and group activity into visits. These measures do not mean that no personal data is processed. The tracker sets no analytics cookies. After your analytics choice, this tab stores only an approved campaign label and expiry in session storage for up to 30 minutes, to retain attribution between public pages. It contains no visitor identifier, ends with the tab, and is cleared on withdrawal or when an excluded page is visited. If storage is unavailable, attribution lasts only in page memory. The site's separate privacy-choice record remains in local storage.

Where EU or UK data protection law applies, our basis for this optional analytics processing is your consent. Analytics does not start from a previous display-preference or account agreement. You can refuse it or withdraw through Cookie settings at any time without losing access to the library. Withdrawal stops future analytics requests; it does not recall requests already sent or automatically delete previously collected provider records. We also prevent analytics requests when your browser signals Do Not Track or Global Privacy Control.

Umami processes analytics under its Data Processing Addendum; it also describes its own service and security processing in its privacy policy. Its hosted services use United States and European infrastructure, with providers listed in its subprocessor list. Its standard DPA includes EU standard contractual clauses and UK and Swiss transfer provisions where applicable; choosing analytics is not a waiver of those protections.

Analytics retention: records remain subject to the Umami account's service-plan retention and deletion settings, rather than the 180-day browser-choice period. Umami's published standard plans currently provide six-month, two-year, or five-year retention; enterprise retention can differ. Provider backups can remain until the provider's backup cycle expires. Email the operator for requests about collected records. Because we send no account identifier, we may be unable to associate a particular analytics record with you; we will assess your request without requiring unnecessary identifying information.

Optional Google advertising

On the public catalog, you can separately choose to load Google advertising choices. This is optional: refusal does not block browsing or downloads. Before that choice, or when Do Not Track or Global Privacy Control is enabled, our integration makes no Google advertising or consent-management request. Display preferences, analytics consent, and account agreements do not enable Google advertising.

After you request Google advertising choices, your browser loads Google's AdSense and Privacy & messaging software. These connections disclose your IP address, browser/device information, and our site origin to Google and its infrastructure providers. Existing Google cookies may be read while ad requests are paused. Google manages the consent message and its consent storage; a paused ad request does not mean there is no connection or data processing. We use origin-only referrers while this software runs, so the referrer header omits page paths, queries, and fragments.

Google's certified consent platform presents advertising purposes and vendors where applicable. We request only non-personalized ads, which can still use storage for frequency limits, reporting, and fraud prevention. Our manual catalog unit remains paused until the required consent signal is available, the page is eligible, and ad serving is enabled after approval. Rejecting the Google message does not grant advertising consent. The download countdown displays only a Block Library promotion, without a Google ad.

Google and the partners identified in its message process consent and advertising information under their own notices. See how Google uses information from partner sites, Google's privacy policy, and Google's cookie information for purposes, recipients, international processing, retention, and controls. Provider retention is separate from our 180-day local choice record. Where consent is required, these optional connections and advertising depend on your affirmative choices.

Use Cookie settings to withdraw permission to load Google, or its separate advertising-choice control to revise the Google consent decision. Withdrawal stops future requests and reloads the page to unload Google's software; it does not recall data already sent or erase provider records. Account, upload, private-library, and administration screens do not load this advertising integration. Moving from the consented catalog into account screens opens a fresh document before private forms are shown.

Information you choose to provide

• Signup consent: creating an account requires affirmative agreement to account data use and the Terms. Your first Google or Microsoft sign-in also creates an account; the provider supplies your identity without requiring you to enter an email here. We do not ask for an age range or date of birth, or impose a minimum account age. Native email signup records a hashed email. First-time provider signup records hashed provider identifiers and a temporary registration handle, hashed in the application database, that expires after five minutes. Signup authorization expires after one hour. Separately, we retain a minimal history of affirmative account-data and Terms choices, their versions, methods, and timestamps. Signup evidence receives an operator review deadline after 35 days. The review checks whether registration succeeded, including unconfirmed accounts, and determines deletion of unnecessary evidence or limited justified retention. Expiry of an authorization does not itself erase an unconfirmed authentication account or its evidence. These hashes are still personal data. Automatic deletion of expiring authorization rows is asynchronous, and database recovery backups can retain earlier records longer. Signing in to an already-created account does not create a new signup record.
• Sign-in and account data: when accounts are enabled, signing in to an existing account asks for your consent to account data use and agreement to the Terms, without asking for your age range or date of birth. This also applies to passkey sign-in. After you agree, Amazon Cognito handles your email address, account identifier, optional profile name, authentication credentials or passkey records, and security/session information. If you choose Google or Microsoft sign-in, that provider also processes your sign-in. We do not receive your provider password. Use a pseudonym for public display.
• Profile photo: you can choose an optional PNG, JPEG, or WebP image up to 5 MiB and 24 megapixels for your account avatar. Your browser crops and resizes it to a 128 × 128 PNG before upload; the original image stays on your device. We validate the uploaded photo and remove image metadata before storing it in our application database. Your photo is private to your signed-in account, remains available across sessions and devices, and is not published with your uploads or comments. You can replace or remove it in My account. The browser holds the displayed photo in memory and clears it when you sign out; we do not save the image in browser storage. Account data exports and erasure requests include your stored photo.
• Uploads and edits: a separate prompt explains that files and submitted metadata become public after checks. Files may contain creator names or other embedded data. Inspect them before sharing. We retain ownership information and private processing status. Daily upload limits use a hash of your account identifier, the UTC day, an attempt count, and an expiry time. The hash remains personal data; the quota contains no file identifier. Files wait in a private queue and staging area before malware scanning.
• Community: submitted comments, display names, creator identifiers, and timestamps are public. Reactions and favorites affect public totals. Account-linked favorites, follows, and collections are stored to provide your private library.
• Email correspondence: when you email us, we use your address, message, and necessary handling records to respond to your request.

Downloads and abuse prevention

When you request a download, we create temporary records to deliver the file, prevent repeated or automated downloads, and keep shared transfer capacity available. You can download without an account or optional cookie consent. The download requires these security records and a separate affirmative agreement to the Terms; it does not require a separate privacy agreement. Terms acceptance is recorded only with the short-lived ticket, not as a permanent visitor profile.

• Hourly quotas: we process your IP address and store its hash, the quota hour, a request count, and an expiry time. Signed-in downloads also use a separate hash of your account identifier for an account quota. These hashes are personal data; hashing does not make them anonymous. Quota records contain no file identifier and are used only to enforce limits.
• Download ticket: a random, single-use ticket records the requested file path, its validity times, and the Terms version affirmatively accepted for that request, without an IP address or account identifier. It is usable after five seconds and expires about 60 seconds after becoming usable. Your browser sends it in the download URL. Redeeming the ticket deletes its server record; unused tickets become eligible for automatic deletion after expiry. A cancelled or failed transfer can still consume quota and a transfer reservation.
• Aggregate totals: after the quota and transfer-capacity checks, we add one to the file’s public request count, without attaching your IP address, account identifier, or ticket to that count. This shows requests, including abandoned attempts, rather than confirmed completed transfers. Monthly transfer reservations track shared capacity and contain no IP address, account identifier, or ticket. We do not use download security records to build visitor profiles, contact people, or target advertising.

Lawful basis: where EU or UK data protection law applies, we rely on legitimate interests for this download processing: securely providing files, preventing abuse, managing shared transfer capacity, and showing aggregate file-request totals. This applies to new requests under this notice; it does not change the basis, purpose, or retention of previously collected consent-based records. Account creation and use, and uploads keep their separate consent requirements.

Retention and access: hourly quota records become eligible for deletion within two hours of their last update. Expired tickets and quota records are deleted asynchronously by AWS DynamoDB and may remain for several days. Monthly totals become eligible for deletion 62 days after their last update, with the same provider deletion delays. Per-file request counts remain while the listing exists. Authorized operators and AWS providers process the security records; they are not public. See below for hosting, logs, and backup retention.

Your right to object: where EU or UK data protection law applies, you can object to this legitimate-interests processing for reasons relating to your situation by emailing the operator. We will stop the affected processing unless we demonstrate compelling legitimate grounds overriding your interests, rights, and freedoms, or need it for legal claims. You may also request access, correction, deletion, or restriction where applicable, and complain to your privacy regulator. There is no separate download-consent setting to withdraw.

Browser storage and external content

Optional theme and layout storage requires an affirmative choice; rejecting it does not prevent browsing. We save your privacy choice after you select it; optional display storage follows that choice. Sign-in session and upload-progress storage starts after account consent. See the storage inventory. Creator-hosted images and videos are not loaded in the library. External media submissions are disabled. External links you choose to follow open services with their own policies.

Purposes, recipients, and location

We use submitted data to provide the feature you request, prevent abuse, respond to requests, and meet applicable legal duties. Consent controls optional storage, the separate Umami analytics purpose, account features, and consent-based submissions. The download processing described above relies on legitimate interests where EU or UK data protection law applies. Other essential delivery, security, and legal duties may rely on other lawful grounds where applicable. Authorized operators, AWS service providers, and selected identity providers process data in the United States or under their service terms. We may disclose necessary information to comply with valid legal process or protect people and the service. Public content is accessible worldwide.

Retention

Your explicit privacy choice, including refusal, is remembered in local storage for up to 180 days and is replaced when you change your choice. Optional theme and layout values are removed when consent is rejected, withdrawn, or expires on a subsequent visit. Login tokens expire after one hour; tab session storage can remain until sign-out, withdrawal, or the tab session ends (browser session restoration may preserve it). See Downloads and abuse prevention for ticket, quota, and aggregate retention. Daily upload-account quotas become eligible for deletion at the next midnight UTC; AWS deletion may take several days. Other hourly quota records become eligible for deletion within two hours of their last update and are deleted asynchronously by DynamoDB; expired records may remain for several days. Quarantine current versions expire after seven days; noncurrent versions expire seven days after becoming noncurrent. Unchanged file bytes can therefore remain about 14 days plus asynchronous lifecycle delays. Upload queue messages can remain for seven days; upload and scan failure messages can remain for 14 days. Regional application logs are configured for 14 days. API error logs omit request payloads and exception details; Cognito signup-trigger errors can include the temporary registration handle. The handle expires after five minutes and cannot sign in to an account. It passes through the provider callback URL, which the app immediately removes from the address bar; browser history and service logs can retain it longer. Download-edge application logging is disabled for new requests; historical edge log retention must be reconciled in every execution region before launch.

Your profile photo remains until you replace or remove it, or your account is erased. Database recovery backups can retain earlier photos for up to 35 days. Accounts, published files (including stored versions), comments, saved library activity, and related consent records remain until removed through an operator-reviewed request or moderation. Existing request and account-withdrawal records remain while being handled, with regular review; ordinary closed records become eligible for deletion 90 days after closure. A documented legal hold can extend retention for necessary records. Selected evidence may be copied to a separate private, access-restricted preservation store with a documented retention deadline; ordinary file lifecycle rules and account erasure do not override a valid hold. We review scope, necessity, and release of holds. Deletion runs asynchronously. We may retain limited records for an applicable legal obligation or dispute. Database recovery backups may retain prior records for up to 35 days. We must remove or reapply deletions after any recovery. Copies downloaded by other people are outside our control.

Your choices and requests

Use Cookie settings to reject optional storage, analytics, or Google advertising connections separately. Use the separate “Withdraw account permission” control in the library footer to withdraw this tab's account permission and clear its local session; provider cookies may require clearing in your browser or signing out at the provider. The account control also requests a server-side withdrawal. When confirmed, further account operations and approval of pending uploads are blocked, and a private retention review is opened. The review considers deleting consent-only data and retaining only data with a separate, documented lawful justification. Reaccepting account permission does not automatically republish previously withdrawn uploads or comments; a new contribution decision and review are required. If the request fails, the browser explains that server withdrawal was not confirmed. Withdrawal does not instantly erase existing records or undo completed transfers. We record withdrawal and subsequent choices separately instead of overwriting the earlier agreement history. To access, correct, export, delete, or withdraw consent for existing records, email the operator. We verify identity proportionately before disclosing or deleting data, explain any lawful retention, and respond within applicable legal deadlines. Depending on your location, you may have rights to object, restrict processing, appeal a decision, or complain to your privacy regulator. No optional consent is required to submit a rights request.

Children’s privacy and security

Public browsing does not require an account. We do not collect age declarations or operate an age-verification or verified parental-consent service. If you are a parent or guardian with a concern about a child’s information, email the operator to request review or deletion. We assess these requests and any applicable consent or deletion obligations. We use encrypted connections, restricted access, private upload processing, and file checks. No system or file check can guarantee security.

Changes

October 10, 2026: campaign attribution and completed-transfer counts require a fresh analytics choice under the campaign notice. Existing display preferences and Google choices retain their own permissions; account agreements remain unchanged.

October 10, 2026: added the separate opt-in for Google advertising choices and the certified consent flow. Existing display-preference and analytics choices do not grant this new permission; account, contribution, and download agreements remain separate.

October 4, 2026: contact is by email. This notice also includes queued upload processing, daily upload limits, and their retention details. Each upload has a separate prompt describing this processing.

BlockLibrary LLC remains the operator and data controller. Account agreements continue to refer to the frozen October 4, 2026 notice; this new optional advertising choice links to the October 10 notice. Existing display-preference choices under the October 3, 2026 LLC notice remain valid. Earlier analytics choices do not authorize campaign attribution or transfer events. Terms, account, contribution, and download permissions remain separate and do not authorize analytics. Earlier account agreement records are preserved as evidence of the choices made at that time; this change does not automatically authorize new uses of previously collected data.

This policy may be updated. Additional notice or renewed consent is provided only where required by applicable law. We preserve the campaign analytics notice, the advertising-choice notice, the account and analytics notice, the previous notice, the earlier analytics notice, and the earlier account and download notice. Earlier notices remain available.