Privacy policy

Effective October 3, 2026 · Version 2026-10-03-llc · Block Library · Washington, United States

Block Library is an independent Minecraft schematic library operated by BlockLibrary LLC, a Washington, United States limited liability company, effective October 3, 2026. BlockLibrary LLC is responsible for the personal data described here and is the data controller where applicable data protection law uses that term. “We,” “us,” and “our” mean BlockLibrary LLC. This notice describes our data practices as of the effective date. Contact the site operator through our private contact and data request form.

Browse with optional collection off

Optional display preferences and Umami analytics are off until you choose each purpose separately. We use consent-based page-view analytics as described below. We also use aggregate download, file, and community activity counts and operational records to run and monitor the library. Google advertising is currently disabled. When you request a download, we record an aggregate request count for that file without attaching an IP address or account identifier to the count. Browsing and downloads do not require optional storage or analytics.

Your browser and our hosting providers must process your IP address, requested URL, and basic connection information to deliver and protect the site. This happens before a privacy prompt can appear. We do not use this essential network processing to build visitor profiles. Browser caches may retain public files. AWS security and operational processing is distinct from optional storage. Our custom banner runs in your browser and stores your separate display-preference and analytics choices, notice version, and date only in your browser's local storage; it does not send a consent record to a third party. See our cookie policy.

Optional Umami analytics

If you allow analytics in Cookie settings, we use Umami Cloud, provided by Umami Software, Inc., to count visits to broad public-page categories and improve the library. Your browser then loads Umami's script from cloud.umami.is and sends page-view requests to gateway.umami.is. We send only the site identifier, site hostname, and a fixed page-category path and title. We exclude actual search terms, URL query strings and fragments, referring URLs, account identifiers, file identifiers, submitted text, and uploaded content. Account, upload, administration, and contact-request pages are excluded. We do not enable custom events, visitor identification, session replay, or advertising features.

These requests necessarily expose your IP address and browser user-agent to Umami and its infrastructure providers. Umami can use network information to derive approximate location and browser/device information and to group activity into visits. These privacy measures do not mean that no personal data is processed. Umami's standard tracker sets no analytics cookies; this integration does not write an analytics identifier to browser storage. Visit state held by the script lasts in page memory. The site's separate privacy-choice record remains in local storage.

Where EU or UK data protection law applies, our basis for this optional analytics processing is your consent. Analytics does not start from a previous display-preference or account agreement. You can refuse it or withdraw through Cookie settings at any time without losing access to the library. Withdrawal stops future analytics requests; it does not recall requests already sent or automatically delete previously collected provider records. We also prevent analytics requests when your browser signals Do Not Track or Global Privacy Control.

Umami processes analytics under its Data Processing Addendum; it also describes its own service and security processing in its privacy policy. Its hosted services use United States and European infrastructure, with providers listed in its subprocessor list. Its standard DPA includes EU standard contractual clauses and UK and Swiss transfer provisions where applicable; choosing analytics is not a waiver of those protections.

Analytics retention: records remain subject to the Umami account's service-plan retention and deletion settings, rather than the 180-day browser-choice period. Umami's published standard plans currently provide six-month, two-year, or five-year retention; enterprise retention can differ. Provider backups can remain until the provider's backup cycle expires. Use our data request form for requests about collected records. Because we send no account identifier, we may be unable to associate a particular analytics record with you; we will assess your request without requiring unnecessary identifying information.

Advertising

Google advertising is currently disabled. The custom privacy controls do not authorize advertising or load advertising trackers. Analytics and advertising features may change. We provide notice and obtain consent when required by applicable law.

Information you choose to provide

• Signup consent: creating an account requires affirmative agreement to account data use and the Terms. Your first Google or Microsoft sign-in also creates an account; the provider supplies your identity without requiring you to enter an email here. We do not ask for an age range or date of birth, or impose a minimum account age. Native email signup records a hashed email. First-time provider signup records hashed provider identifiers and a temporary registration handle, hashed in the application database, that expires after five minutes. Signup authorization expires after one hour. Separately, we retain a minimal history of affirmative account-data and Terms choices, their versions, methods, and timestamps. Signup evidence receives an operator review deadline after 35 days. The review checks whether registration succeeded, including unconfirmed accounts, and determines deletion of unnecessary evidence or limited justified retention. Expiry of an authorization does not itself erase an unconfirmed authentication account or its evidence. These hashes are still personal data. Automatic deletion of expiring authorization rows is asynchronous, and database recovery backups can retain earlier records longer. Signing in to an already-created account does not create a new signup record.
• Sign-in and account data: when accounts are enabled, signing in to an existing account asks for your consent to account data use and agreement to the Terms, without asking for your age range or date of birth. This also applies to passkey sign-in. After you agree, Amazon Cognito handles your email address, account identifier, optional profile name, authentication credentials or passkey records, and security/session information. If you choose Google or Microsoft sign-in, that provider also processes your sign-in. We do not receive your provider password. Use a pseudonym for public display.
• Profile photo: you can choose an optional PNG, JPEG, or WebP image up to 5 MiB and 24 megapixels for your account avatar. Your browser crops and resizes it to a 128 × 128 PNG before upload; the original image stays on your device. We validate the uploaded photo and remove image metadata before storing it in our application database. Your photo is private to your signed-in account, remains available across sessions and devices, and is not published with your uploads or comments. You can replace or remove it in My account. The browser holds the displayed photo in memory and clears it when you sign out; we do not save the image in browser storage. Account data exports and erasure requests include your stored photo.
• Uploads and edits: a separate prompt explains that files and submitted metadata become public after checks. Files may contain creator names or other embedded data. Inspect them before sharing. We retain ownership information and private processing status.
• Community: submitted comments, display names, creator identifiers, and timestamps are public. Reactions and favorites affect public totals. Account-linked favorites, follows, and collections are stored to provide your private library.
• Contact requests: we store your reply email, request text and type, submission time, notice version, and necessary handling records. A hashed IP quota limits spam. No account, Terms agreement, or optional processing consent is required. Where EU or UK law applies, new requests are processed to meet applicable legal duties or, where no such duty applies, our legitimate interests in handling requests, protecting rights and safety, and preventing abuse. We assess any additional legal condition needed for sensitive information in a report; please include only what is necessary. Do not send passwords, government IDs, payment details, or health information.

Downloads and abuse prevention

When you request a download, we create temporary records to deliver the file, prevent repeated or automated downloads, and keep shared transfer capacity available. You can download without an account or optional cookie consent. The download requires these security records and a separate affirmative agreement to the Terms; it does not require a separate privacy agreement. Terms acceptance is recorded only with the short-lived ticket, not as a permanent visitor profile.

• Hourly quotas: we process your IP address and store its hash, the quota hour, a request count, and an expiry time. Signed-in downloads also use a separate hash of your account identifier for an account quota. These hashes are personal data; hashing does not make them anonymous. Quota records contain no file identifier and are used only to enforce limits.
• Download ticket: a random, single-use ticket records the requested file path, its validity times, and the Terms version affirmatively accepted for that request, without an IP address or account identifier. It is usable after five seconds and expires about 60 seconds after becoming usable. Your browser sends it in the download URL. Redeeming the ticket deletes its server record; unused tickets become eligible for automatic deletion after expiry. A cancelled or failed transfer can still consume quota and a transfer reservation.
• Aggregate totals: after the quota and transfer-capacity checks, we add one to the file’s public request count, without attaching your IP address, account identifier, or ticket to that count. This shows requests, including abandoned attempts, rather than confirmed completed transfers. Monthly transfer reservations track shared capacity and contain no IP address, account identifier, or ticket. We do not use download security records to build visitor profiles, contact people, or target advertising.

Lawful basis: where EU or UK data protection law applies, we rely on legitimate interests for this download processing: securely providing files, preventing abuse, managing shared transfer capacity, and showing aggregate file-request totals. This applies to new requests under this notice; it does not change the basis, purpose, or retention of previously collected consent-based records. Account creation and use, and uploads keep their separate consent requirements.

Retention and access: hourly quota records become eligible for deletion within two hours of their last update. Expired tickets and quota records are deleted asynchronously by AWS DynamoDB and may remain for several days. Monthly totals become eligible for deletion 62 days after their last update, with the same provider deletion delays. Per-file request counts remain while the listing exists. Authorized operators and AWS providers process the security records; they are not public. See below for hosting, logs, and backup retention.

Your right to object: where EU or UK data protection law applies, you can object to this legitimate-interests processing for reasons relating to your situation using our private contact and data request form. We will stop the affected processing unless we demonstrate compelling legitimate grounds overriding your interests, rights, and freedoms, or need it for legal claims. You may also request access, correction, deletion, or restriction where applicable, and complain to your privacy regulator. There is no separate download-consent setting to withdraw.

Browser storage and external content

Optional theme and layout storage requires an affirmative choice; rejecting it does not prevent browsing. We save your privacy choice after you select it; optional display storage follows that choice. Sign-in session and upload-progress storage starts after account consent. See the storage inventory. Creator-hosted images and videos are not loaded in the library. External media submissions are disabled. External links you choose to follow open services with their own policies.

Purposes, recipients, and location

We use submitted data to provide the feature you request, prevent abuse, respond to requests, and meet applicable legal duties. Consent controls optional storage, the separate Umami analytics purpose, account features, and consent-based submissions. Contact and rights requests use the grounds described above; historical consent-based requests are assessed under their original basis rather than silently relabelled. The download processing described above relies on legitimate interests where EU or UK data protection law applies. Other essential delivery, security, and legal duties may rely on other lawful grounds where applicable. Authorized operators, AWS service providers, and selected identity providers process data in the United States or under their service terms. We may disclose necessary information to comply with valid legal process or protect people and the service. Public content is accessible worldwide.

Retention

Your explicit privacy choice, including refusal, is remembered in local storage for up to 180 days and is replaced when you change your choice. Optional theme and layout values are removed when consent is rejected, withdrawn, or expires on a subsequent visit. Login tokens expire after one hour; tab session storage can remain until sign-out, withdrawal, or the tab session ends (browser session restoration may preserve it). See Downloads and abuse prevention for ticket, quota, and aggregate retention. Other hourly quota records become eligible for deletion within two hours of their last update and are deleted asynchronously by DynamoDB; expired records may remain for several days. Quarantine current versions expire after seven days; noncurrent versions expire seven days after becoming noncurrent. Unchanged file bytes can therefore remain about 14 days plus asynchronous lifecycle delays. Scan failure messages can remain for 14 days. Regional application logs are configured for 14 days. API error logs omit request payloads and exception details; Cognito signup-trigger errors can include the temporary registration handle. The handle expires after five minutes and cannot sign in to an account. It passes through the provider callback URL, which the app immediately removes from the address bar; browser history and service logs can retain it longer. Download-edge application logging is disabled for new requests; historical edge log retention must be reconciled in every execution region before launch.

Your profile photo remains until you replace or remove it, or your account is erased. Database recovery backups can retain earlier photos for up to 35 days. Accounts, published files (including stored versions), comments, saved library activity, and related consent records remain until removed through an operator-reviewed request or moderation. Open contact cases remain while being handled, with regular review; ordinary closed cases become eligible for deletion 90 days after closure. A documented legal hold can extend retention for necessary records. Selected evidence may be copied to a separate private, access-restricted preservation store with a documented retention deadline; ordinary file lifecycle rules and account erasure do not override a valid hold. We review scope, necessity, and release of holds. Deletion runs asynchronously. We may retain limited records for an applicable legal obligation or dispute. Database recovery backups may retain prior records for up to 35 days. We must remove or reapply deletions after any recovery. Copies downloaded by other people are outside our control.

Your choices and requests

Use Cookie settings to reject optional storage or analytics separately. Use the separate “Withdraw account permission” control in the library footer to withdraw this tab's account permission and clear its local session; provider cookies may require clearing in your browser or signing out at the provider. The account control also requests a server-side withdrawal. When confirmed, further account operations and approval of pending uploads are blocked, and a private retention review is opened. The review considers deleting consent-only data and retaining only data with a separate, documented lawful justification. Reaccepting account permission does not automatically republish previously withdrawn uploads or comments; a new contribution decision and review are required. If the request fails, the browser explains that server withdrawal was not confirmed. Withdrawal does not instantly erase existing records or undo completed transfers. We record withdrawal and subsequent choices separately instead of overwriting the earlier agreement history. To access, correct, export, delete, or withdraw consent for existing records, use the data request form. You can use it without an account. We verify identity proportionately before disclosing or deleting data, explain any lawful retention, and respond within applicable legal deadlines. Depending on your location, you may have rights to object, restrict processing, appeal a decision, or complain to your privacy regulator. No optional consent is required to submit a rights request.

Children’s privacy and security

Public browsing does not require an account. We do not collect age declarations or operate an age-verification or verified parental-consent service. If you are a parent or guardian with a concern about a child’s information, use our private contact and data request form to request review or deletion. We assess these requests and any applicable consent or deletion obligations. We use encrypted connections, restricted access, private upload processing, and file checks. No system or file check can guarantee security.

Changes

This version identifies BlockLibrary LLC as the operator and data controller effective October 3, 2026. We ask for new account agreement and separate optional display-preference and analytics choices under this notice. Terms, account, contribution, and download permissions remain separate and do not authorize analytics. Earlier account agreement records are preserved as evidence of the choices made at that time; this change does not automatically authorize new uses of previously collected data.

This policy may be updated. Additional notice or renewed consent is provided only where required by applicable law. We preserve the notice presented with current choices, the previous notice, the earlier analytics notice, and the earlier account and download notice. Earlier notices remain available.