Privacy Policy
Last updated: July 27, 2026
This policy explains what personal information Flatblox collects, why, who it goes to, and what you can do about it. It covers flatblox.com, the pixel art editor, the dashboard, public profiles, the desktop app and everything else we offer under the Flatblox name (the "Service"). It works alongside our Terms of Service.
Who's responsible. Flatblox is run by Nico Pellerin, sole proprietor, in Montreal, Quebec, Canada. I'm also the person in charge of protecting personal information here — reach me at nico@flatblox.com.
1. What we collect
Account information. When you sign in with a magic link, we store your email address. When you sign in with Google, we receive your email address, name and profile picture from Google. Sign-in is handled by Supabase, which also records the timestamps and IP address of your sign-ins for security.
Profile information. Your username, bio, avatar image, and display preferences such as theme and block style. You choose all of this, and you can change it any time from your dashboard.
Content you create. Pixel art, drafts, characters, textures, tilesets, palettes, tags and descriptions, comments, hearts, Blast high scores, and the record of which published artwork a remix came from.
AI usage records. Each time you use an AI feature we record which endpoint you called, how many tokens it used, what it cost us, and when. We do not store your prompts or the reference images you attach — they pass through our server to the AI provider and are not written to our database.
Billing information. If you subscribe, we store your Stripe customer ID, your plan, and your subscription status and renewal date. Card numbers go directly to Stripe — we never see or store them.
Messages you send us. If you use the contact form, we receive your name, email address and message so we can reply.
Technical information. Our host, Cloudflare, processes IP addresses and request metadata to serve pages, block abuse and enforce rate limits.
Analytics. We use Plausible, a privacy-focused analytics tool that doesn't use cookies, doesn't collect personal information and doesn't track you across websites. It tells us aggregate things like how many people visited the pricing page.
2. Why we use it
- To run the Service — authenticate you, save and display your work, apply your plan's limits, show your public profile. (Legal basis: performance of our contract with you.)
- To process payments — create and manage your subscription through Stripe. (Contract, and legal obligation for tax records.)
- To keep the Service working and safe — rate limits, abuse prevention, moderation, debugging, and understanding what AI features cost us. (Legitimate interests.)
- To communicate with you — reply to your messages, and send service emails such as sign-in links, billing notices, and notice of material changes to our terms. (Contract and legitimate interests.)
- To understand usage in aggregate — see which pages and features get used. (Legitimate interests, using analytics that don't identify you.)
We don't sell your personal information, we don't share it with advertisers, and we don't use it to build advertising profiles. We don't make automated decisions that produce legal or similarly significant effects about you.
3. What's public
Some things are public by design. Your username, avatar, bio, published artworks and characters, comments, hearts and Blast high scores are visible to anyone on the internet, appear in the community gallery, can show up in search engines and link previews, and can be remixed by other users under our Terms.
Your email address is never shown publicly. Neither are your unpublished drafts, your billing details or your usage records.
If you'd rather something weren't public, unpublish it or delete it. Copies other people already downloaded, cached or shared are outside our control.
4. Who we share it with
We use these service providers ("processors"), each of which handles only what it needs to:
| Provider | What it handles |
|---|---|
| Supabase | Accounts, database, file storage |
| Cloudflare | Hosting, edge delivery, abuse protection |
| Stripe | Payments and subscriptions |
| Resend | Sending email from the contact form |
| Sign-in, if you choose it | |
| OpenAI, Anthropic | AI prompts and reference images, to generate a result |
| Plausible | Cookieless, aggregate analytics |
We may also disclose information if the law requires it, to enforce our Terms, to protect someone's safety, or as part of a sale or transfer of Flatblox (in which case we'll tell you first).
International transfers. These providers process data outside Canada, mainly in the United States and the European Union. Where required, transfers rely on standard contractual clauses or equivalent safeguards. We've assessed these providers as offering adequate protection, but privacy laws in those countries differ from Canadian and European ones.
A note on AI. Prompts and reference images you send to an AI feature are transmitted to OpenAI or Anthropic and are subject to their policies and retention periods, which we don't control. Please don't put confidential or personal information into a prompt.
5. Cookies and local storage
We don't use advertising or tracking cookies, and our analytics are cookieless — which is why you don't see a cookie banner.
We do store a session token in your browser's local storage so you stay signed in, and some preferences (like editor settings) locally on your device. Clearing your browser storage signs you out and resets those preferences.
6. How long we keep it
- Account, profile and content: until you delete them or delete your account.
- AI usage records: kept while your account exists, so we can enforce quotas and track costs.
- Billing records: retained as long as tax and accounting law requires, typically seven years, even after you close your account.
- Contact form messages: kept in our email as long as they're useful for support history.
- Technical logs: short-lived, generally days to a few weeks.
7. Your rights
Wherever you live, you can ask us to:
- access the personal information we hold about you,
- correct anything inaccurate,
- delete your account and your personal information,
- export your data in a portable format,
- object to or restrict certain processing, and
- withdraw consent where we relied on it.
You can delete your account yourself from your dashboard, which removes your profile and published content from the Service. For anything else, email nico@flatblox.com — we'll respond within 30 days.
If you're in Quebec, you also have the right to have information about you de-indexed or ceased to be disseminated in certain circumstances, and you can complain to the Commission d'accès à l'information du Québec. If you're in the EU or UK, you can complain to your local data protection authority. We'd appreciate the chance to fix it first.
8. Children
Flatblox isn't intended for children under 13, and we don't knowingly collect their personal information. If you're a parent or guardian and believe your child under 13 has an account, email us and we'll delete it. Users between 13 and the age of majority should have a parent or guardian involved, as set out in our Terms.
9. Security
Accounts are protected by row-level security in the database, traffic is encrypted in transit, and privileged operations run server-side with credentials that never reach your browser. No system is perfectly secure, so we can't guarantee absolute security. If a breach ever creates a risk of serious harm, we'll notify affected users and the relevant authorities as the law requires.
10. Changes to this policy
We may update this policy. When we make a material change, we'll update the date at the top and notify account holders by email or in the app. Continuing to use Flatblox after that means you accept the updated policy.
11. Contact
Questions, requests or complaints about privacy? Email nico@flatblox.com or use the contact form.