Privacy Policy

Effective Date: August 12, 2026

Last Updated: October 7, 2026

PRIVACY AT A GLANCE

Before diving into the full policy, here is a plain-language summary of how Superblock handles your data:

• Your email is encrypted, never plaintext: We store your email address in encrypted form, plus a separate one-way hash used for account lookup and duplicate-account prevention. We never store it as readable plaintext. We use your email to send account, security, and service messages, and (unless you opt out) occasional product or marketing updates.
• All chats are end-to-end encrypted: Both match and group conversations use E2EE. We do not hold the keys needed to read your messages, so we cannot produce your message content in response to a legal request. The one exception is reported messages: when a user reports a specific message, that message is shared with our moderation team for review.
• Message content is destroyed quickly: Chat content is permanently deleted within 45 days. Only structural metadata (timestamps, IDs) is archived - never message text.
• We never sell or share your data: We do not sell personal information, and we do not share it for advertising. We run no advertising or ad-targeting tags on our website or in the app. The website uses analytics only, and you can opt out at any time through the cookie settings.
• Your exact location stays private: We store your current coordinates and reduce them to geohashes (coarse geographic zones) for matching. We do not keep a history of where you have been. Coordinates are never shown to other users and are never sent back to the app; the only place you can see your own is the data export you can request at any time. Other users see your city and approximate distance, plus an optional residence or neighborhood label only if you choose to add one.
• The map is self-hosted: The community map in the app is drawn from map tiles and fonts we serve from our own infrastructure. The areas you pan or zoom to are not sent to any third-party map provider.
• No photos, contacts, or browsing data: We don’t access your camera, photo library, contacts, call logs, or browsing history.
• You control your data: You can update your profile, toggle privacy settings, manage devices, and permanently delete your account at any time. Deletion is immediate and cannot be undone: there is no waiting period and we cannot restore your account afterwards.
• Local messages are encrypted too: Messages cached on your device are encrypted with a hardware-backed key. Local data is automatically pruned on the same retention schedule as the server. Uninstalling the app permanently destroys the local encryption key and all cached messages.

Full details follow below.

superblock.social LLC (“Superblock,” “we,” “our,” or “us”) operates the Superblock mobile application and related services (collectively, the “Service”). Superblock is a social platform that enables users to form groups, match with other groups, and communicate through real-time messaging.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Service. It applies to all users worldwide and is designed to comply with applicable data protection laws including the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and other applicable privacy frameworks.

By using Superblock, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

TABLE OF CONTENTS

1. Eligibility

2. Information We Collect

3. How We Use Your Information

4. Legal Bases for Processing (GDPR)

5. How We Share Your Information

6. End-to-End Encryption

7. Data Retention

8. Your Rights and Choices

9. International Data Transfers

10. Data Security

11. Cookies and Local Storage

12. Do Not Track Signals

13. Third-Party Links and Services

14. Changes to This Privacy Policy

15. Contact Us

16. Supplemental Notice for California Residents

1. Eligibility

Superblock is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under the age of 18. If we learn that we have collected personal information from a person under 18, we will promptly delete that information and terminate the associated account. If you believe that a minor has provided us with personal information, please contact us at privacy@superblock.social.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: When you register, we collect your email address (which we store in encrypted form, along with a separate one-way hash used for account lookup and duplicate-account prevention) and display username. You authenticate through a third-party OAuth provider (Google, Apple, or Microsoft).
• Age Verification: When you register, we ask for your date of birth solely to confirm you meet our minimum age requirement (18 or older). We do not store it. We keep only a coarse age range (for example, “18 or over”, not your exact age), how your age was confirmed (self-declared, or confirmed through your device’s operating system), and the date we recorded it. Where available, we may use your device’s built-in age-assurance features (such as Apple’s Declared Age Range or Google Play’s age signals), which return an age range only and never your date of birth. If you indicate that you are under 18, we do not create an account; to prevent immediate repeat attempts, we store a hashed device identifier and the age you entered for up to 7 days, then delete it.
• Profile Information: You may provide your age, sex, biographical text (bio), and avatar preferences. These are optional and can be updated or removed at any time.
• Location Data: If you choose to share your location, we collect your latitude, longitude, city, region, and country. We store your current coordinates and derive geohashes (coarse geographic zones) from them for proximity-based matching. We keep only your most recent position; we do not build or retain a history of the places you have been. Coordinates are never sent back to the app and are never visible to other users. Your own coordinates are included in the data export you can request at any time, because that export contains everything we hold about you. Other users see your approximate location (city and region) and an approximate distance. You may also optionally set a residence or neighborhood label (for example, a residence hall name); this label is off by default, is shown to other users only if you choose to set it, and can be cleared at any time. You control location sharing through an in-app toggle and can disable it at any time.
• Communications: Messages you send through the Service, including match chat and group chat messages, reactions, and replies. All conversations are protected by end-to-end encryption (E2EE), meaning we cannot read message content unless a specific message is reported for moderation (see Section 6). System-generated messages (e.g., member join/leave notifications) are not encrypted.
• User-Generated Content: Group names, group descriptions, bios, reports you file about other users, and review content.
• Domain Verification: If you verify your affiliation with an organization (e.g., a university .edu domain), we store your verification status, verification type, and the associated domain display name. The underlying email address used for verification is hashed.
• Waitlist (superblock.social): If you sign up for launch updates on our website, we collect your email address, stored in the same encrypted form as an account email, and, only if you choose one from the dropdown, the name of your residence hall. We use these solely to notify you when Superblock becomes available and to plan our launch. You can opt out at any time by emailing privacy@superblock.social, and we will remove your address from the list.
• Subscription Information: If you subscribe to a paid plan, your payment is processed entirely by the applicable app store (Apple App Store or Google Play). Superblock never collects, receives, stores, or has access to your payment card numbers, bank account details, or other payment method information. Our subscription management provider, RevenueCat, receives subscription status updates from the app stores and relays your subscription tier, status, and transaction identifiers to us.

2.2 Information Collected Automatically

• Device Information: We collect device and installation identifiers when you log in, along with device name, operating system, device model, and app version. Device identifiers are hashed before storage; we never store them raw. When you open an invite link we also record your browser’s user agent alongside the invite record, to detect automated abuse. This information is used for session management, security (new device login alerts, one-account-per-device enforcement, ban evasion detection), and compatibility tracking.
• Device Integrity Status: At login, the app checks whether your device's security protections have been modified (e.g., rooted or jailbroken) and reports this status to our servers. We do not scan your files or installed apps. Compromised devices are denied access to protect platform integrity. This data is not stored beyond the login attempt.
• Session Data: We record session identifiers, session creation time, and last activity time. Your IP address is hashed at login time and your session record stores only that hash; a separate hash is used for ban evasion detection. We also retain your IP address in unhashed form in three narrow audit records, where it is needed to investigate abuse or to evidence your agreement to our terms: when you request or enter an email verification code, when you join a group through an invite link, and when you accept an updated version of these policies. Those records are deleted when you delete your account. At login, we also resolve your approximate location (city, region, and country) from your IP address and store this location data with your session so you can see where each device was last used. Separately, when you create your account we record the country you signed up from (derived once from your network address; the country only, never your city or coordinates). We use it to determine which privacy rules apply to your account—for example, accounts created in the EEA or UK are not enrolled in optional marketing email—and it is never shown to other users, is included in your data export, and is deleted when you delete your account.
• Presence Data: We track your online/offline status and the timestamp of your last activity (“last seen”). Other users in your groups or active matches can see whether you are currently online and when you were last active.
• Push Notification Tokens: If you enable push notifications, we store a device token to deliver notifications to your device.
• Location Validation Signals: When you share your location, we perform validation checks to ensure accuracy and detect spoofing. These checks are used solely for platform integrity and are not shared with other users.
• Usage and Interaction Data: We collect information about how you interact with the Service, including feature usage patterns and in-app actions. This is used for rate limiting, abuse prevention, and service improvement.
• Error and Diagnostic Data: We use a self-hosted error tracking system to collect crash reports and error logs. In production, each report is associated with your account and may include personally identifiable information such as your account user ID, your username, and your IP address to help us diagnose and fix issues.
• Encryption Reliability Telemetry: When an end-to-end encryption (E2EE) operation fails on your device (for example, a message cannot be decrypted), the app sends a failure report to our self-hosted error tracking system so we can diagnose the problem. These reports contain failure metadata only: the type of failure, truncated identifiers, retry counts, and timestamps. They never contain message content, ciphertext, encryption keys, or your full identifiers. You can turn this off in Privacy Settings; see Section 6.1.

2.3 Information from Third Parties

• OAuth Providers: When you sign in via Google, Apple, or Microsoft, we receive your email address and basic profile information as authorized by the provider. If you use Apple's "Hide My Email" feature, we receive only the Apple private relay email address, not your real email.
• RevenueCat: For subscription management, RevenueCat sends us webhook events containing subscription status changes, transaction identifiers, and tier information.

2.4 Data We Do Not Collect

Superblock is designed to minimize the personal data we handle. We do not collect, access, or store the following:

• Photos, videos, or media files from your device
• Contacts or address book data
• Call logs or SMS/text message history
• Browsing history or data from other apps
• Biometric data (fingerprints, face scans)
• Financial information or payment card numbers (handled exclusively by the Apple App Store and Google Play Store)
• Precise health, fitness, or sensor data
• Advertising identifiers (IDFA/GAID) or cross-app tracking data
• Your email address in readable plaintext form (we store it encrypted and as a one-way hash, never as plaintext)

3. How We Use Your Information

We use the information we collect for the following purposes:

• Providing the Service: To create and manage your account, enable group creation and matching, facilitate messaging, and deliver notifications.
• Location-Based Features: To match groups based on geographic proximity, using your coordinates and geohash when you have opted in to location sharing.
• Security and Fraud Prevention: To detect and prevent unauthorized access, abuse, and fraudulent activity. This includes hashed device fingerprints for new-device alerts, duplicate account prevention, and ban evasion detection; device integrity verification; bot detection; login anomaly detection; rate limiting; location validation; and automated moderation systems.
• Content Filtering: We automatically check usernames, bios, group names, and group descriptions against content filters to prevent the use of profanity, slurs, and other prohibited content.
• Age Verification: To confirm you meet our minimum age requirement (18+) at registration and to limit immediate repeat sign-up attempts from a device where a visitor has indicated they are under 18.
• Moderation and Safety: To enforce our community guidelines through user reports, AI-assisted content review (see Section 5.3), reputation scoring, infraction tracking, and suspension/ban processes, with human review available on request (see Section 5.4).
• Communication: To send you service-related notifications including match updates, group invitations, security alerts, and moderation notices.
• Product and Marketing Communications: To send you product updates, announcements, platform notifications, and promotional messages about Superblock by email or push notification, including launch and availability updates if you joined our waitlist. These messages are optional: you can opt out at any time using the unsubscribe link in any marketing email or through your app and notification settings, and opting out will not affect service-related or security messages.
• Improvement and Analytics: To understand usage patterns, diagnose technical issues, monitor system performance, and improve the Service.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or governmental requests.

4. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction that requires a legal basis for processing personal data, we rely on the following:

5. How We Share Your Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We run no advertising or ad-targeting tags anywhere: not in the Superblock mobile application, and not on our marketing website. The website uses analytics only, and you can opt out of non-essential cookies at any time through the cookie settings. We may share information in the following limited circumstances:

5.1 With Other Users

Your display username, avatar, bio, age, sex, and group memberships are visible to other Superblock users in the context of group profiles, matching, and messaging. Domain verification badges are visible if you choose to display them.

If you enable location sharing, other users may see your city and region (e.g., “Austin, TX”) and an approximate distance (e.g., “3.2 miles away”). If you choose to set a residence or neighborhood label (for example, your residence hall), that label is also shown to other users; it is optional, off by default, and can be removed at any time. No other user can retrieve your coordinates from Superblock in any form (see Section 2.1).

5.2 With Service Providers

We use the following third-party service providers who process data on our behalf:

5.3 Content Moderation

Superblock enforces its community guidelines primarily through automated systems. Reported content is assessed by automated review, and enforcement actions, including decisions on appeals, are usually applied automatically. A person can review any decision and can take or reverse any enforcement action, including content removal, account suspension, and permanent bans. See Section 5.4 for how to request that.

In addition to human review, when content is reported by users for potential community guideline violations, we may send that content to third-party large language model (LLM) providers for automated review. This process works as follows:

• What is sent: Only the specific content that has been flagged by a user report. This may include reported message text, usernames, bios, group names, and group descriptions, along with surrounding context messages (a limited window of messages before and after the reported one, which may include messages from other participants) to help assess the report. For appeals, the user’s appeal statement and non-identifying infraction history (offense number, duration, and category) are also sent.
• What is never sent: User IDs, email addresses, IP addresses, device information, location data, or any other account identifiers are never included in requests to AI moderation providers. The content is evaluated in isolation without any information that could identify the user.
• Providers: We use Anthropic (Claude) and OpenAI (GPT) for AI-assisted moderation. These providers process the content solely to return a moderation verdict and do not retain the content for their own training purposes under our data processing agreements.
• When it is used: AI review is used in two ways. First, when content is actively reported by another user, the reported content is sent for AI-assisted review as described above. Second, we proactively scan public-facing content fields (usernames, bios, group names, and group descriptions) using a background AI system that detects offensive content, including attempts to evade text-based filters. This proactive scanning only applies to public profile fields, never to private chat messages. When the proactive system identifies potentially offensive content, it is flagged for review or automatically actioned.
• Safeguards and human review: Automated moderation is subject to safeguards intended to improve accuracy, including confidence thresholds and fallbacks when a provider is unavailable. Content flagged as involving child safety is always routed to a person. You may appeal any moderation decision, including automated actions, and you can ask a person to review any decision as described in Section 5.4.

5.4 Automated Decision-Making

Enforcement decisions on Superblock are made by automated systems. These include suspending or permanently banning an account, replacing offensive public-facing content, deleting accounts that remain banned past the appeal window, and deciding appeals. They are based on the reported or detected content, the outcome of automated review, your prior enforcement history, and the number and credibility of reports.

When we take an enforcement action, we tell you what was actioned and why.

You can ask a person to review any automated decision. Write to support@superblock.social. We cannot commit to a response time and we may uphold the decision, but a person will look at it, and we are able to reverse any enforcement action, including restoring a suspended or banned account.

5.5 For Legal Reasons

We may disclose your information if required to do so by law, in response to valid legal process (such as a subpoena or court order), or where we believe disclosure is necessary to protect the rights, property, or safety of Superblock, our users, or the public.

5.6 Business Transfers

If superblock.social LLC is involved in a merger, acquisition, bankruptcy, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

6. End-to-End Encryption

All conversations in Superblock - both match chats and group chats - are protected by end-to-end encryption (E2EE). Messages are encrypted on your device before transmission and can only be decrypted by the intended recipient(s). This means:

• We do not hold the keys needed to decrypt message content, whether in transit or at rest on our servers, so we cannot produce it in response to a legal request. The one exception is specific messages that are reported for moderation (see below).
• Encryption keys are generated and stored on your device. Your device also sends us one sealed copy of your own message keys, locked with your own device key so that only your device can open it. We cannot read it, and it is not readable by anyone else. It exists so that you can still read your own past messages if you reinstall the app on the same device. If you lose access to the device itself, that copy cannot be opened either, and encrypted message history may be unrecoverable.
• Metadata such as timestamps, sender/recipient identifiers, and message existence is still visible to us for delivery purposes.
• System messages (such as notifications that a member joined or left a group) are not end-to-end encrypted, as they are generated by the server.

End-to-end encryption protects your messages while they travel and while they sit on our servers. It cannot prevent someone you are talking to from screenshotting, photographing, or exporting what you send them.

Moderation exception: When a user reports a specific message, the reporting user’s device captures a snapshot of the reported message and surrounding context. This snapshot is transmitted to our servers and stored with separate server-side encryption (not E2EE). This allows us to review reported content for community guideline violations, including through human review and AI-assisted moderation as described in Section 5.3. The snapshot includes a limited window of messages sent immediately before and after the reported message so our reviewers can assess it in context. This window may include messages sent by other participants in the conversation. It does not give us the rest of the conversation outside that window, and we do not gain ongoing access to the conversation.

6.1 Encryption Reliability Telemetry

When end-to-end encryption fails on a device the failure is often silent and hard to diagnose, so the app reports those failures to us. We collect only failure metadata: the type and severity of the failure, truncated match, group, and user identifiers, error categories, retry counts, and timestamps.

We never collect message content or anything that could be used to read your messages: no plaintext or partial plaintext, no ciphertext, no encryption keys or key material of any kind, no full identifiers, and no user-generated text.

Failure reports go to our self-hosted error tracking system and are stored with our other operational error logs. They are not shared with third parties, sold, used for advertising, or used to profile users.

You can turn this off. Open Privacy Settings in the app and toggle “Encryption Reliability Telemetry” off. Your device stops sending reports and our servers stop recording failures attributed to your account. Anonymized system-level errors that cannot be attributed to an individual user may still be collected for platform reliability.

Our legal basis under the GDPR is legitimate interests: this data is essential to keeping the end-to-end encryption that protects your messages reliable, and its privacy impact is minimized by truncating identifiers and excluding anything that could be linked to message content.

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. The following table summarizes our retention practices:

7.1 What Happens When a Match or Group Ends

Within 45 days, all message content, edit history, encryption keys, read receipts, reviews, and reactions are permanently deleted. The match and group records are archived later on the schedule in the table above, and group names, descriptions, member lists, and invitations are deleted at that point.

At no point does any archive contain message text, group names, group descriptions, bios, or other user-generated content. Archives hold only structural identifiers, timestamps, and aggregate counts.

7.2 Account Deletion

When you delete your account, we perform a comprehensive data removal across all databases. The following data is permanently deleted or anonymized:

• Your email address, authentication credentials, and auth provider information are erased.
• Your profile data (username, avatar, bio, age, sex, location) is cleared and your username is replaced with an anonymized identifier.
• Your group memberships, invitations, push notification tokens, notifications, votes, reputation scores, message reactions, and read receipts are deleted, together with every encryption key addressed to you. That is everything needed to read messages other people sent you, and the sealed copy of your own keys described in Section 6.
• Reports you filed are anonymized (your identity as reporter is removed).

The following limited data is retained after account deletion:

• Block records are retained to ensure that users you blocked cannot contact you and vice versa.
• Anonymized infraction history is retained for platform safety.
• Records of when you were active, and of when you reached milestones such as your first group or first match, are retained so we can understand how the Service is used over time. These records hold no message content and nothing you wrote. When you delete your account they are anonymized, so they can no longer be traced back to you.
• A record of when your account was deleted, and of whether you closed it yourself or we closed it (for example for a safety or eligibility reason), is retained with the records above. It holds no other detail about the closure.
• A minimal record that you accepted our Terms of Service and Privacy Policy is retained as proof of consent, consisting of the document type, the version's effective date, and the date you accepted. The IP address associated with your acceptance is deleted, and the retained record cannot be used to identify you.
• Messages you had already sent stay in the conversations you sent them to, and the people who received them can still read them. Deleting your account replaces your name on those messages with an anonymized identifier, but it does not remove them from the other person's copy of the conversation, and we keep the encryption keys those recipients need until the messages themselves are deleted. This works the same way as email: you can close your account, but you cannot recall what you have already sent. The messages are deleted on the normal retention schedule in the table above, within 45 days of the match or group chat ending.

Deletion is immediate and cannot be undone. When you confirm deletion we begin erasing your data straight away. There is no waiting period and no way for us to restore your account afterwards, so please be certain before you confirm. We do this deliberately: a grace period would also let a suspended or banned account be deleted and re-created to escape enforcement.

Encrypted backups. We take a nightly encrypted backup of our databases and keep each one for 30 days before it is automatically destroyed. Your data is removed from our live systems immediately on deletion, but a copy may remain inside an existing backup until that backup expires, which is never more than 30 days later. Backups exist only for disaster recovery. We never use them to restore a deleted account, and we do not search them to answer requests about individual users.

Where one of our service providers holds personal data on our behalf, we instruct them to delete it in accordance with our agreements with them.

When deletion may be delayed. We may suspend or delay deletion of specific data where we are required to preserve it, including in connection with a legal hold, an active investigation, pending or threatened legal proceedings, or a valid preservation request from law enforcement or a regulator. In those cases we preserve only the data covered by the obligation, we do not use it for any other purpose, and we delete it once the obligation ends.

7.3 Additional Retention for Banned or Suspended Users

If your account was banned or suspended at the time of deletion, we additionally retain:

• Your hashed email address to prevent re-registration with the same email. This hash cannot be reversed to recover your email address.
• Hashed device fingerprints to detect ban evasion from the same device. These are one-way hashes and cannot be used to identify your device outside of a direct match comparison.

These records are retained for the duration of the ban. For permanent bans, they are retained indefinitely. For temporary suspensions, they are retained until the suspension period expires.

7.4 Auto-Deletion

We automatically delete accounts and groups in the following circumstances:

• Inactive Groups: Groups that are auto-paused due to unresponsiveness during matches and are not reactivated by an admin within the allowed period are permanently deleted. Members are notified before deletion occurs.
• Suspended or Banned Groups: Groups that are suspended or banned for content violations and where the issue is not resolved within the remediation window are permanently deleted.
• Banned User Accounts: Accounts with permanent bans that go unappealed past the appeal window are automatically deleted.
• Suspended User Accounts: Accounts with content-fix suspensions that remain unresolved after the remediation window expires are automatically deleted.

Inactive user accounts (where the user simply stops using the app) are not automatically deleted. Your account will remain available until you choose to delete it or until an enforcement action described above applies.

8. Your Rights and Choices

8.1 All Users

Regardless of where you are located, you have the following controls:

• Profile Management: Update or remove your bio, age, sex, avatar, and other profile information at any time.
• Privacy Controls: Toggle profile visibility, invitation acceptance, location sharing, domain verification display, and encryption reliability telemetry in app settings.
• Notification Preferences: Enable or disable push notifications and configure notification categories.
• Marketing Preferences: Opt out of product and marketing emails at any time using the unsubscribe link in any such message or through your app settings. You will continue to receive service-related and security messages.
• Session Management: View all active login sessions and revoke access from specific devices.
• Account Deletion: Permanently delete your account and associated data through the app or by contacting us.

8.2 EEA, UK, and Swiss Residents (GDPR)

Under the GDPR, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete personal data.
• Erasure: Request deletion of your personal data, subject to legal retention requirements.
• Restriction: Request that we restrict processing of your personal data in certain circumstances.
• Portability: Receive your personal data in a structured, commonly used, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Withdraw previously given consent at any time without affecting the lawfulness of prior processing.

To exercise these rights, contact us at privacy@superblock.social. We will respond within 30 days (extendable by 60 days for complex requests). You also have the right to lodge a complaint with your local data protection authority.

8.3 California Residents (CCPA/CPRA)

Under California law, you have the following rights:

• Right to Know: You may request the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of your personal information. As permitted by the CCPA, we may retain information where it is reasonably necessary to complete a transaction or provide a service you requested, detect or resolve security incidents or fraudulent or illegal activity, debug and repair errors, exercise a legal right such as free speech, comply with a legal obligation, or make an internal use that is reasonably aligned with the context in which you provided the information. Section 7.2 describes the limited categories of data we retain after account deletion and the circumstances in which deletion may be delayed.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the CCPA. Analytics cookies are enabled by default for California visitors, and you may opt out at any time through the cookie settings on the website or by sending a request to privacy@superblock.social. We also honor Global Privacy Control (GPC) signals as a valid opt-out request; when your browser sends that signal we do not set analytics cookies at all.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To submit a request, email privacy@superblock.social. We will verify your identity before processing your request and respond within 45 days.

8.4 Other Jurisdictions

If you are located in Brazil (LGPD), Canada (PIPEDA), Australia, or another jurisdiction with applicable data protection laws, you may have similar rights. Contact us at privacy@superblock.social and we will address your request in accordance with applicable law.

9. International Data Transfers

Superblock is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States and potentially other countries where our service providers operate.

For transfers from the EEA, UK, or Switzerland to the United States, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, and we ensure that our service providers maintain adequate data protection measures. Where applicable, we also rely on adequacy decisions by the European Commission or UK government.

10. Data Security

We follow a data minimization approach: we collect and retain only what is necessary to provide the Service, and we delete it when it is no longer needed. Sections 2, 7, and 7.2 describe what we hold, how long we hold it, and what happens when you delete your account.

We implement technical and organizational measures designed to protect your personal information, including:

• Encryption in Transit: All communications between your device and our servers are encrypted, as are our internal database connections.
• Encryption at Rest: Email addresses are stored encrypted, with a separate one-way hash used for account lookup. All chat messages (match and group) are end-to-end encrypted. Local message storage is encrypted with a hardware-backed key. Sensitive fields in moderation records are additionally encrypted at the application level.
• Access Controls: Authenticated sessions you can revoke per device, and role-based administrative access.
• Infrastructure Security: DDoS protection, bot detection, device integrity verification, login anomaly detection, and rate limiting.
• Monitoring: Automated error tracking and security event logging.

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

10.1 Data Breach Notification

In the event of a security breach that affects your personal data, we are committed to the following:

• We will notify the relevant supervisory authority within 72 hours of becoming aware of a breach, as required by Article 33 of the GDPR, and we will notify affected users without undue delay where the breach poses a high risk to your rights and freedoms.
• We will notify the relevant supervisory authorities as required by applicable law.
• Our notification will include the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address the breach.
• For California residents, we will provide notification as required under California Civil Code § 1798.82.

We maintain incident response procedures to detect, investigate, contain, and remediate security incidents promptly.

11. Cookies and Local Storage

11.1 Mobile Application

The Superblock mobile application does not use browser cookies. We use the following local storage mechanisms on your device:

• Local App Storage: To store authentication tokens, user preferences, and app state locally on your device.
• Local Message Cache: To cache messages for offline access and faster loading. Message content is encrypted on your device before it is stored, using a key held in your device’s hardware-backed secure storage. Cached messages are pruned on the same retention schedule as our servers (up to 45 days). Uninstalling the app or clearing app storage permanently destroys the key and every locally cached message.
• Secure Storage: Encryption keys for E2EE are stored in your device’s hardware-backed secure storage.

These are necessary for the Service to function and are not used for advertising or third-party tracking.

11.2 Marketing Website (superblock.social)

Our marketing website at superblock.social uses cookies to understand how visitors interact with the site and to support our marketing efforts. We use the following categories of cookies:

• Essential Cookies: Required for the website to function properly, including session management and user preferences. These cookies are set automatically and do not require consent.
• Analytics Cookies: Used to understand how visitors interact with the website, including page views, traffic sources, and navigation patterns. We use Google Analytics for this purpose, which sets cookies and shares website usage data with Google in the United States (see Section 5.2). These cookies help us improve the website experience.
• Advertising Cookies: None. We do not use them.

Our approach to cookie consent depends on your location:

• EEA, UK, and Switzerland visitors: All non-essential cookies (analytics and marketing) require your explicit opt-in consent before they are set. When you first visit superblock.social, a cookie consent banner will appear. No non-essential cookies are placed on your device unless you affirmatively consent. You may withdraw your consent at any time through the cookie settings on the website.
• All other visitors: Analytics cookies are enabled by default when you visit superblock.social. A notice will inform you that cookies are in use. You may opt out at any time through the cookie settings on the website, and we will immediately stop setting non-essential cookies on your device. If your browser sends a Global Privacy Control signal, we treat that as an opt-out and set no analytics cookies at all, without you having to interact with the notice.

Your location is determined by your IP address at the time of your visit using Cloudflare's geolocation data. You may change your cookie preferences at any time through the cookie settings on the website, regardless of your location.

Cloudflare Web Analytics: We also count visits to our website, including the beer pong game, with Cloudflare Web Analytics. It does not use cookies or local storage and does not follow you across other sites; it records which pages were viewed along with general details such as browser type and approximate location, so we can see overall traffic.

Analytics without cookies: Some links on our website send you straight to another site instead of to a page of our own. The link superblock.social/get, for example, forwards you to the Apple App Store or Google Play depending on the device you are using. When you follow a link like this, we may record that it was used, the general type of device you used it from, and, where we have tagged the link ourselves, which of our channels you came from. Nothing is stored on or read from your device, no cookie is involved, and the record is not connected to your account or to any identifier that lasts beyond that single click. Because no cookie is set, this does not depend on your cookie choice. If your browser sends a Global Privacy Control signal, we do not record it at all.

11.3 Beer Pong Game (superblock.social/pong)

Our website has a beer pong game you can play alone or online with a friend. It is separate from the Superblock app and does not use your Superblock account.

• On your device: The game saves the name you enter, the character you design, and a random ID in your browser's local storage so it can remember your setup and put you back in your seat if you reload during an online game. You can clear these at any time in your browser settings. The picture made by "Share to story" is created on your device and goes only where you choose to share it.
• Online games: When you play a friend online, our servers (operated by Cloudflare, see Section 5.2) keep both players' names, characters and random IDs, the state of the game, and the most recent chat messages, so both players see the same game and can reconnect. Taunts are passed to the other player and not stored. All of this is deleted when the game ends: after 30 minutes with no activity, 10 minutes after a game ends without a rematch, or once both players have left. Chat messages are seen only by the other player in that game and are not reviewed by us, so please don't share anything sensitive.
• Analytics: Game activity, such as games started, finished and shared, is measured with Google Analytics under the consent choices described in Section 11.2. Names, chat messages and characters are never sent to Google Analytics.

12. Do Not Track Signals

The Superblock mobile application does not track users across third-party websites or services. On our marketing website (superblock.social), the use of non-essential cookies depends on your location as described in Section 11.2. For visitors in the EEA, UK, and Switzerland, analytics cookies are only set with explicit opt-in consent. For all other visitors, analytics cookies are enabled by default but you may opt out at any time through the cookie settings on the website. We honor Do Not Track (DNT) and Global Privacy Control (GPC) signals on our marketing website by treating them as an opt-out of non-essential cookies; a Global Privacy Control signal takes effect immediately, with no interaction required.

13. Third-Party Links and Services

The Service may contain links to third-party websites or services (such as app store links). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the “Last Updated” date at the top of this policy.
• Provide in-app notification of significant changes.
• Where required by law, obtain your consent before implementing material changes.

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have a complaint about our data practices, please contact us:

Entity: superblock.social LLC

Address: 202 N Cedar Ave, STE #1, Owatonna, MN 55060

Email: privacy@superblock.social

For EEA or UK residents, if you are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority.

16. Supplemental Notice for California Residents

The following table describes the categories of personal information we collect, the purposes for collection, and whether we sell or share the information, as required by the CCPA/CPRA:

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the CCPA. We have no advertising partners. On our website, analytics cookies are enabled by default for California visitors; you may opt out at any time through the cookie settings, and a Global Privacy Control signal opts you out automatically. We do not use or disclose sensitive personal information for purposes other than those permitted under the CCPA/CPRA.