Privacy statement.

Last updated: 20 July 2026

The short version: we track scans on your links, never you. No ad pixels, no profiles, no selling anything to anyone. The longer version follows.

1. Who is responsible.

blok.je is operated by Robot Kittens B.V., Netherlands, which is the controller for the processing described here. Reach us at info@blok.je for anything privacy-related.

2. What we collect about account holders.

Email address: to create and confirm your account, let you log in, and send strictly account-related mail (confirmation links, password resets).
Password: stored only as a modern one-way hash (scrypt). We cannot read it, and neither can anyone who ever gets hold of the database.
Google sign-in: if you use "Continue with Google" we receive your email address, name, and a Google account identifier from Google. We use them for exactly the same purposes as above, nothing more.
Consent records: when you accepted the terms, and whether you opted in to partner email.
Your blokjes: the destinations you set, the styling you chose, and any logo you uploaded (stored as a small image on the blokje itself).

3. What we collect when someone scans a blokje.

Every scan of a blokje records:

device class and operating system (iPhone, Android, desktop), derived from the browser's user agent;
browser family and preferred language;
the referring page, when the browser sends one;
a coarse location (country, sometimes city) when the network provides it;
a one-way, day-salted hash of the IP address. It lets us count "roughly how many different people scanned today" without storing the IP itself, and it cannot be linked across days or traced back to a person.

Scan data exists to show blokje owners how their blokjes perform, as patterns and totals: never as individual people.

4. What we deliberately do not do.

No advertising trackers, analytics beacons, or fingerprinting, on the site or behind blokjes.
No raw IP addresses in the scan history.
No profiles of people who scan blokjes; scanners are visitors, not products.
No selling or renting of any data to anyone, full stop.

5. Legal bases.

We process account data to perform our contract with you (the terms). Scan statistics rest on the legitimate interest of blokje owners in knowing whether their printed blokjes work, implemented with the minimization described above. Partner email rests solely on your explicit opt-in consent, which you can withdraw at any time via info@blok.je.

6. Cookies and browser storage.

We set no advertising or third-party cookies. Your browser's local storage holds your login session, and, for blokjes made without an account, the secret claim proof for those blokjes. Both stay on your device until you log out, claim the blokje, or clear your browser data.

7. Who else touches the data.

Amazon Web Services (EU region, Frankfurt) hosts the service: servers, database, image storage, and email delivery run there under a data processing agreement.
Google is involved only if you choose Google sign-in, under Google's own terms.
Partners receive nothing. If you opted in to partner email, the mail goes out through us; your address is not handed over.
Authorities, only when the law genuinely obliges us.

8. Retention and deletion.

Account data lives as long as the account does.
Deleting your account permanently deletes it together with every blokje you own and all their scan statistics. No undo, no recovery window.
Deleting a single blokje deletes its scan history with it.
Server logs used for abuse prevention and debugging are pruned after 90 days.
Login sessions expire after 30 days; expired sessions are cleaned up continuously.

9. Your rights.

Under the GDPR you can ask for access, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Most of it you can do yourself (the profile page changes your password and deletes your account); for the rest, mail info@blok.je and we respond within a month. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

10. Security.

Traffic is encrypted (HTTPS), passwords are hashed, secrets never live in source code, and access to production systems is restricted. No internet service can honestly promise perfection; if a breach ever affects your data, we will tell you and the authority as the law requires.

11. Children.

Accounts are for people 16 and over. We do not knowingly hold personal data of younger children; if that happened anyway, contact us and it will be removed.

12. Changes and contact.

When this statement changes meaningfully, account holders hear about it by email or in the service before it takes effect. Questions, requests, complaints: info@blok.je.