Privacy policy
This policy explains what personal data Blockshot collects on blockshot.app (the website) and in the Blockshot application at blockshot.app/app (the app), why, and what rights you have. We collect as little as we need and we do not sell data or use it for advertising.
1. Who is responsible
The controller is Matúš Kukuča, company ID (IČO) 09837558, Janského 2505/109, 155 00 Prague 5, Czech Republic (“Blockshot”, “we”). Contact for anything about your data: info@blockshot.app.
2. Early access requests (the form on the website)
What: name, email, role, country, the tool you schedule in today, your note about your next project, website language, the fact and time of your consent. For spam protection we also store a one-way hash of your IP address (not the address itself) and your browser’s user-agent string.
Why: to review your request, invite you to early access and contact you about it. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to the address above; withdrawal does not affect processing before it. The IP hash and user-agent are processed on the basis of our legitimate interest in preventing abuse of the form (Art. 6(1)(f)).
How long: at most 12 months after you sent the request (it is then deleted automatically), or until you withdraw consent - whichever is first. If you become a user, your details move to your account (section 3).
When you send the form, a notification with its contents is emailed to us so that we can reply.
3. The app and your account
What: your email address and sign-in data; the schedules, scripts, templates, settings and feedback you create or upload; technical logs (time, IP address, error messages) kept by our hosting providers for security and operation.
Your profile: first and last name, email and country; and only if you fill them in, city, company, profession, age range, gender and the short questionnaire about your work (role, experience, the tools you schedule in, what you want Blockshot to solve, how you heard about it). Your name is shown to the people in projects you work on. The optional answers help us understand who Blockshot is for; they are given voluntarily (consent, Art. 6(1)(a) GDPR) and you can change or delete them at any time in your profile.
Why and legal basis: to provide the service you signed up for (Art. 6(1)(b) GDPR), and to keep it secure and working (Art. 6(1)(f)).
Automatic error reports: when an error or a schedule inconsistency occurs in the app, it sends a short technical report linked to your account (app version, browser, error description, number of scenes and boards), never the schedule's content, names or scene texts. Reports are used only to fix bugs (legitimate interest, Art. 6(1)(f) GDPR) and are deleted together with your account. You can turn them off in the app in the menu under your name › Preferences › Error reports.
Data about other people in your schedules. Schedules often contain names and availability of cast and crew. For that data you decide what is entered and why, and Blockshot processes it on your behalf only to provide the service. If your production needs a data processing agreement, write to info@blockshot.app.
Emails to your crew. When you publish a version of a schedule or invite someone to a project in the app, we send an email to the addresses you enter (including people without a Blockshot account). The addresses stay in your project; about the sending we keep only the number of recipients, the time and the delivery status. For invitations we also keep a one-way fingerprint (hash) of the address, only to enforce sending limits. Our email provider keeps its own delivery logs for 30 days. Inviting someone to a project creates an account for them (only the email address, plus the name and department you enter, if any) and a project membership; the account is deleted at the invitee’s request or when they delete it in the app. The invitee can also be added to the project’s distribution list (preselected when inviting, can be turned off); they drop off the list when you remove them from the project, or any time on request.
How long: while your account exists. In the app, under Profile › Account and data, you can download your schedules with all their revisions, your templates, scripts and feedback as a .zip file and delete your account yourself. When you delete your account there, your account, your schedules with all their revisions, your templates, scripts, feedback and any early access request with the same email are deleted straight away. If you ask us to delete your account by email, we do it within 30 days. Encrypted backups are overwritten within 14 days at the latest. Comments and change suggestions you made in other people's projects belong to those projects; your name may stay in their change history.
Place lookup for sunrise and sunset: to show sunrise and sunset times, the app sends place names (ones you type, or the locations in your schedule) to the Open-Meteo geocoding service (Switzerland) to find their coordinates. Only the place name is sent, no account data; results are kept in your browser.
4. Cookies and storage in your browser
The website sets no cookies and uses no analytics or tracking. During early access the app at blockshot.app/app is open only to invited people: you sign in with a one-time code that we email to you (only if your address is on our invitation list). The app stores your sign-in session, settings, unsaved work, offline copies of schedules, the list of recent projects and scripts you keep “only on this computer” in your browser’s storage (localStorage, IndexedDB) so that it also works offline; this is strictly necessary and needs no consent. You can delete it in the app (Profile › Account and data › Delete data from this computer) or in your browser settings. The form on the website is protected against bots by Cloudflare Turnstile: it loads with the main page and processes technical browser data (no tracking cookies). Videos and images on the website and in the app load from our domain media.blockshot.app (Cloudflare R2), so Cloudflare sees your IP address.
5. Who processes data for us
| Provider | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, sign-in, server functions, daily backups (7 days) | Data stored in the EU (Frankfurt, Germany) |
| Cloudflare, Inc. | Website hosting, DNS, network security, Turnstile, videos and images (R2, media.blockshot.app) | Global network; requests are handled at the nearest data centre |
| Resend, Inc. | Delivering emails (sign-in codes, the notification about an early access request, project invitations and published schedule versions for your crew) | USA |
| GitHub, Inc. | Storing encrypted nightly backups (encrypted before upload, GitHub cannot read them), 14 days | USA |
| Google LLC (Gmail) | Our mailbox that receives notifications and your emails | EU / USA |
| Open-Meteo (Switzerland) | Place lookup for sunrise and sunset (place name only) | Switzerland |
Where data leaves the EU/EEA, the transfer is based on an adequacy decision (e.g. the EU-US Data Privacy Framework or Switzerland) or on the European Commission’s Standard Contractual Clauses. We have data processing agreements with Standard Contractual Clauses with both Supabase and Resend; Resend is also certified under the EU-US Data Privacy Framework.
6. Your rights
You can ask us for access to your data, its correction or deletion, restriction of processing, a copy in a portable format, and you can object to processing based on legitimate interest. You can download a copy of your cloud data and delete your account yourself in the app (Profile › Account and data), or write to info@blockshot.app; we reply within one month. You also have the right to lodge a complaint with a data protection authority - in particular in the EU country where you live or work - or with the Czech Office for Personal Data Protection (ÚOOÚ, www.uoou.cz).
7. Changes
If we change this policy, we will publish the new version here with a new date, and tell users of the app about important changes in advance.