Privacy policy
Draft for review - not yet checked by a lawyer. Items in [square brackets] must be completed before publication.
This policy explains what personal data Blockshot collects on blockshot.app (the website) and in the Blockshot application at blockshot.app/app (the app), why, and what rights you have. We collect as little as we need and we do not sell data or use it for advertising.
1. Who is responsible
The controller is Matúš Kukuča, [address], [company ID if applicable] (“Blockshot”, “we”). Contact for anything about your data: privacy@blockshot.app.
2. Beta access requests (the form on the website)
What: name, email, role, country, the tool you schedule in today, your note about your next project, website language, the fact and time of your consent. For spam protection we also store a one-way hash of your IP address (not the address itself) and your browser’s user-agent string.
Why: to review your request, invite you to the beta and contact you about it. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to the address above; withdrawal does not affect processing before it. The IP hash and user-agent are processed on the basis of our legitimate interest in preventing abuse of the form (Art. 6(1)(f)).
How long: until the end of the beta and at most 12 months after your last contact with us, or until you withdraw consent - whichever is first. If you become a user, your details move to your account (section 3).
When you send the form, a notification with its contents is emailed to us so that we can reply.
3. The app and your account
What: your email address and sign-in data; the schedules, scripts, templates, settings and feedback you create or upload; technical logs (time, IP address, error messages) kept by our hosting providers for security and operation.
Why and legal basis: to provide the service you signed up for (Art. 6(1)(b) GDPR), and to keep it secure and working (Art. 6(1)(f)).
Data about other people in your schedules. Schedules often contain names and availability of cast and crew. For that data you decide what is entered and why, and Blockshot processes it on your behalf only to provide the service. [A data processing agreement for productions will be available on request.]
How long: while your account exists. In the app, under Profile › Account and data, you can download everything you have in the cloud as a .zip file and delete your account yourself. When you delete it there, your account, your schedules with all their revisions, your templates, scripts, feedback and any beta request with the same email are deleted straight away. If you ask us to delete your account by email, we do it within 30 days. Backups are overwritten within a further [30] days.
Place lookup for sunrise and sunset: to show sunrise and sunset times, the app sends place names (ones you type, or the locations in your schedule) to the Open-Meteo geocoding service (Switzerland) to find their coordinates. Only the place name is sent, no account data; results are kept in your browser.
4. Cookies and storage in your browser
The website sets no cookies and uses no analytics or tracking. The app stores your sign-in session, settings and unsaved work in your browser’s local storage so that it works; this is strictly necessary and needs no consent. If spam protection by Cloudflare Turnstile is switched on for the form, it may process technical browser data to tell people from bots.
5. Who processes data for us
| Provider | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, sign-in, server functions | Data stored in the EU (Frankfurt, Germany) |
| Cloudflare, Inc. | Website hosting, DNS, network security, Turnstile | Global network; requests are handled at the nearest data centre |
| Resend, Inc. | Delivering emails (sign-in codes and the notification about a beta request) | USA |
| Google LLC (Gmail) | Our mailbox that receives notifications and your emails | EU / USA |
| Open-Meteo (Switzerland) | Place lookup for sunrise and sunset (place name only) | Switzerland |
Where data leaves the EU/EEA, the transfer is based on an adequacy decision (e.g. the EU-US Data Privacy Framework or Switzerland) or on the European Commission’s Standard Contractual Clauses. [Check each provider’s current DPA and transfer mechanism before publication.]
6. Your rights
You can ask us for access to your data, its correction or deletion, restriction of processing, a copy in a portable format, and you can object to processing based on legitimate interest. You can download a copy of your cloud data and delete your account yourself in the app (Profile › Account and data), or write to privacy@blockshot.app; we reply within one month. You also have the right to lodge a complaint with a data protection authority - in particular in the EU country where you live or work - or with [the Czech Office for Personal Data Protection (ÚOOÚ), www.uoou.cz].
7. Changes
If we change this policy, we will publish the new version here with a new date, and tell users of the app about important changes in advance.