Privacy Policy
In short
Blocus Tracker shows no ads, uses no third-party analytics tool, and neither sells nor shares your data for advertising. With your agreement only, we measure our QR campaigns in-house. We also offer an optional question about how you discovered the app, separate from that measurement. We also collect what the app needs to work: your account, your study activity, and what you choose to post.
This text describes what the code actually does. If the app seems to contradict it, write to us: that is a bug, not a nuance.
1. Who is responsible for your data
Blocus Tracker is a personal project created and run by Mathias Dock, a student at ICHEC Brussels Management School (Belgium). He is the data controller under the GDPR.
For any question about your data: mathias.dock.management@gmail.com.
2. The data we process
What you give us directly:
- Account: username, email address, first name, institution. Your LAST NAME is optional — you can create an account without one, and remove it at any time from your profile by clearing the field. Field and year of study, bio and profile picture are optional too.
- Password: handled by Supabase Auth and stored hashed — a one-way fingerprint, not the password itself. We never have access to it.
- Study activity: timed sessions (course, duration, notes, timestamps), subjects, goals, planning, exams, study periods, revision checklists.
- Social content: feed posts (photos and captions), comments, reactions, private messages, group and community messages, attachments, friendships.
- Feedback sent from the "Improve the app" page.
What the app produces or derives:
- Progress: experience (XP), levels, badges, streaks, daily missions, streak freezes, referrals.
- Two aggregate counters: how many posts you have made in total and how many reactions you have given. No dates, no content — they exist only for badges, whose progress must survive the daily deletion of posts.
- "Currently studying" presence, visible to your friends while your timer runs.
- Your device time zone, so daily statistics are computed in your own time.
- Preferences: theme, language, sound and haptics, privacy settings.
- If you allow analytics: the code of your first known QR campaign, a temporary random visit ID, and—after a new account is created—the campaign associated with that account. We store no IP address or device fingerprint for this measurement.
What our servers see technically:
- IP address: used in memory only, to rate-limit sign-in attempts and abuse. It is not stored in the database and is not linked to any account.
- Session tokens, kept in your browser to keep you signed in.
- If you enable notifications: a device identifier created by OneSignal, linked to your Blocus Tracker identifier.
- If you enable notifications: the list of your subscribed devices, kept in our database — an identifier drawn at random by the device itself (not OneSignal's), its family (iPhone, Android, Mac…) and when it was last active — so we know how many members a notification can reach. A device is marked as detached when you sign out.
- The notifications sent to you: their type, date and the outcome of the send, so the same reminder never reaches you twice and their number stays limited.
- If turning on notifications fails: a technical diagnostic stored in our database (app version, system and browser, loading steps and timings, no IP address or email), to find the fault. Readable by the team only.
- Technical logs from our host (Vercel) and from Supabase, produced automatically on each request and retained by them for a limited period.
2a. How you discovered Blocus Tracker
The question “How did you discover Blocus Tracker?” is entirely optional. You can choose a category, including “Other” without a free-text description, or skip without losing access to the app. Simply displaying the question saves no presentation or analytics answer on the server.
A confirmed answer or skip creates two separate items: a marker containing only your account identifier to prevent further prompts, and a temporary analytics row. The row contains answer or skip, a category only for an answer, the decision date, expiry date and whether the account was new or already existed at launch. No free text is requested or stored. Only the first ordinary decision is accepted; retries cannot replace it.
This information helps us understand discovery channels and improve the project's visibility. The marker separately ensures the question stays handled, including after objection or erasure. The chosen basis is legitimate interest (GDPR art. 6(1)(f)), with a right to object on grounds relating to your particular situation. Answering does not consent to cookies or analytics tools: the declaration remains separate from QR campaigns measured with consent. Changing analytics preferences does not erase the declaration, and answering does not change those preferences.
The analytics row expires 12 calendar months after the decision, calculated in UTC; rectification does not extend that deadline. Once expired, it is no longer readable by the app or used in statistics. Daily cleanup physically removes it on the next successful run: normally within the following 24 hours; during an incident, expired rows remain excluded and deletion waits for cleanup to recover. The minimal marker stays while the account exists to prevent further prompts. Objection or erasure is never turned into a fictitious “Skip”.
Other members cannot read these data. You can export your marker and still-available analytics row. Authorized admins see counts and distributions over 7 days, 30 days or the still-available data from the last 12 months. They can also find the accounts that answered a source and view the still-available declared category or skip from an Admin profile. For an answer, the list contains its date and associated account (username, first/last name and avatar when provided), without email or free text. This access helps check and understand declared sources; it is not used to make decisions about your studies or send targeted advertising. Expired answers, erased answers and answers removed after objection are not accessible in these views; the minimal marker cannot distinguish these reasons. Rates change after expiry, erasure or objection and do not describe the complete history of answers. Small counts do not guarantee anonymity. Authorized database operators may act on a rights request; Supabase hosts the data.
To access your data, rectify the category of an available answer, request erasure or restriction, or object to its use, write to mathias.dock.management@gmail.com. An account-scoped procedure allows rectification without renewing retention, or erasure/objection while keeping the no-prompt marker. You do not have to delete your whole account. Account deletion cascades to both items in the active database. Any backups follow the provider's conditions; no backup erasure deadline is guaranteed here.
3. What other members can see about you
This is the most concrete point for you, so it deserves a straight answer. Once signed in, any other member can see: your username, your first name, your last name if you gave one, your institution, your field and year of study, your bio, your profile picture, your level, your badges, your study time and your ranking.
The names and colours of your active courses are also visible in your profile to other signed-in members, even if you are not friends. This profile does not give them access to your notes, deadlines, goals or sessions. The study time shown in this profile remains visible only to friends.
That is exactly why the last name is optional: it is of no use to anyone here, and your username is enough to recognise you. Your post and reaction counters, on the other hand, are visible only to you.
Your email address is NEVER shown to other members, nor returned by our servers to their browser. It is protected at the database level itself, not merely hidden in the interface.
Your session notes, your planning (unless you make it public), your private messages and your privacy settings are visible only to you — and, for a private message, to the person you write to.
4. Why we process it, and on what basis
- Providing the service — account, timer, statistics, planning, social features. Legal basis: performance of the contract formed by the terms you accept when signing up (GDPR art. 6.1.b).
- Account emails — address confirmation, password reset. Legal basis: performance of the contract.
- Security and abuse prevention — rate limiting of sign-in attempts, moderation. Legal basis: legitimate interest in protecting the service and its members (art. 6.1.f).
- QR campaign measurement — visits and the path to activation, only after agreement to the analytics category. Legal basis: your consent, withdrawable in Privacy preferences.
- Study reminders by notification — exam tomorrow or in 7 days, streak at risk, help to get started after signing up or back after a break; at most one an evening and two nudges a week, never between 10 pm and 8 am in your time zone. Legal basis: your consent, given by enabling notifications, withdrawable in one tap from your profile.
- Social notifications — friend request received or accepted, new private message. A message notification contains neither the text nor the attachment: only the sender's first name. Legal basis: your consent to notifications, with a separate opt-out ("Social") in your profile.
- App announcements by notification — news, service information. Legal basis: your consent to notifications, with a separate opt-out in your profile.
- Loading third-party services on your device (OneSignal) — legal basis: your consent, given in the privacy banner or by enabling notifications.
We do not use your data for advertising profiling, and no automated decision produces legal effects concerning you.
5. Who receives your data
We do not sell your data and do not share it for advertising. To run the app, we rely on technical providers (processors) that process data on our behalf, on our instructions:
- Supabase — database, authentication, file storage (profile pictures, feed photos, attachments) and realtime. Receives all of your account data.
- Vercel — application hosting. Receives your IP address and the technical metadata of each request (page requested, browser), like any web host.
- Resend — sending confirmation and reset emails, via Supabase. Receives your email address and the content of those messages.
- OneSignal — push notifications. Receives a device identifier, your Blocus Tracker identifier and the content of notifications, only if you enable notifications. When you delete your account, your identifier and all your subscriptions are erased at OneSignal too.
One honest detail about OneSignal: our installable app (PWA) downloads a technical file from OneSignal's servers when it installs on your device, including if you never enable notifications. OneSignal then sees your IP address and your browser. No identifier is created and no subscription exists until you enable notifications yourself.
We pass your data to no one else, except where the law requires it (judicial order) or to defend our rights in case of serious abuse.
6. Transfers outside the European Union
Good news first, and it is verified: the database holding your account, your study sessions and your messages is hosted in the European Union, in the Stockholm region. Your data does not cross the Atlantic to be stored.
That does not remove every transfer, though. Supabase, Vercel, Resend and OneSignal are US companies: their teams can technically access the infrastructure they operate, and depending on how each service is configured some data — technical logs, emails sent, notification identifiers — may be processed in the United States.
The GDPR does not forbid these transfers, but requires them to be framed. The available mechanisms are the European Commission's standard contractual clauses — usually built into the data processing agreement (DPA) each provider publishes — and, for companies that join it, the EU–US Data Privacy Framework.
We would rather be accurate than reassuring: this page cannot certify which mechanism is actually in force for each of these providers on the day you read it, because that depends on each service's own contractual terms and on how our account there is configured. If you want to know for a specific provider, write to us: we will answer with the real situation, not with boilerplate.
In practice, those companies may be subject to access requests from US authorities. If that matters to you, you can use only the timer and statistics, without posting content or enabling notifications.
7. How long we keep it
- Account and associated data (profile, sessions, planning, progress, messages): as long as your account exists. Everything is deleted when you delete your account.
- QR campaigns: random visit IDs are purged daily after 30 days; account-linked source remains until account deletion or consent withdrawal. Daily aggregate counts retain no individual identifier.
- Feed posts: a post stops being visible 24 hours after it goes up. It is then deleted for good — photo, caption, database row, and with it its comments and reactions. Nothing tied to you remains.
- When exactly: deletion is carried out by an automatic cleanup scheduled once a day. Under normal operation a post is therefore deleted at the latest within 48 hours of going up. We write "under normal operation" because a scheduled run can fail (an outage, an incident at our host): deletion then happens on the next run, and the post stays invisible in the meantime.
- Aggregate statistics: two counters per account — how many posts you have made in total, and how many reactions you have given. No dates, no content, no link to any particular post. They exist only so your badges ("first post", "influencer", "motivator") do not reset every night as your posts are deleted. They are kept as long as your account exists and disappear with it.
- Deletion log: when an account is deleted, we keep only an anonymous line — date, origin (self-requested or administrative), account age in months. No name, no username, no identifier.
- IP address: in memory only, for a rate-limiting window of a few minutes. Never written to the database.
- Technical logs from Vercel and Supabase: retained by those providers under their own schedules, in the order of days to weeks.
- Notification activation failure diagnostics: 30 days, then deleted automatically.
- History of notifications sent: 180 days for what concerns you; the summary of each send (how many members were targeted, excluded, reached — no list of names): one year.
- List of your subscribed devices: a detached device is erased after 6 months, a device inactive for a year too; everything disappears with your account.
- Privacy preferences and the record of terms acceptance: as long as your account exists, because that is what evidences what you accepted and refused.
8. Deleting your account
From your profile, "Privacy" section, the "Delete my account" button immediately and permanently erases: your sign-in account, your profile, your courses, your sessions, your goals, your planning, your exams, your posts, comments and reactions, your private, group and community messages, your friendships, your XP, your badges, your referrals, your preferences, your no-prompt marker and any discovery analytics row — and every file you uploaded (profile picture, feed photos, attachments).
There is no bin, no grace period, and no "deactivated" account kept just in case. It is irreversible.
One nuance worth knowing: messages you sent to someone else also disappear from that person's conversation. What others wrote about you in their own messages, however, belongs to them and is not erased.
9. Your rights
Under the GDPR you have the following rights — and the app is built so you can exercise them yourself, without writing to us:
- Access: "Export my data" in your profile downloads a file with everything the app holds about you.
- Rectification: most of your information is editable directly in your profile.
- Erasure: "Delete my account" in your profile, Privacy section.
- Portability: the export is JSON, readable by a human and by a machine.
- Objection and restriction: write to us and we will handle your request.
- Withdrawal of consent: "Privacy preferences", from your profile or the footer. Withdrawing consent does not undo what was already done, but it does effectively stop what follows.
For a right not available directly in the app, email mathias.dock.management@gmail.com. We reply within one month.
You may also lodge a complaint with the Belgian Data Protection Authority (APD/GBA — www.dataprotectionauthority.be), or with the authority of your country of residence.
10. United States residents
First, a point of honesty. US privacy laws such as California's CCPA/CPRA only apply to businesses that cross certain thresholds — annual revenue, number of residents whose data is processed, or revenue derived from selling data. Blocus Tracker is a free student project with no advertising and no revenue: nothing suggests it meets those thresholds, so we do not claim to be formally subject to those laws.
That changes nothing about what you can do. Wherever you are reading this from, and without having to show that a particular law applies to you, we voluntarily give you the same rights as everyone else: to know what categories of information are collected and why, to obtain a copy, to correct them, to delete them, and to face no negative consequence for exercising them. They are exercised with the tools described above, directly in the app.
If one of those laws did come to apply to us, or if you live in a state that grants you additional rights, those legal rights are added to what we offer here — this page never replaces them.
We do not sell your personal information and do not share it for cross-context behavioral advertising within the meaning of California law. No advertising tool and no measurement network is installed in the app — which the Cookies tab lets you verify. There is therefore no separate "Do Not Sell or Share" link: there would be nothing to switch off.
We nonetheless honour the Global Privacy Control (GPC) signal, everywhere and for everyone, without checking where you come from: if your browser sends it, the "analytics" and "advertising" categories stay refused, permanently and with nothing for you to do.
We do not collect categories of information deemed sensitive under California law (origin, health, orientation, biometrics, precise geolocation).
11. Security
Access to data is enforced by the database itself (row-level security), not only by the interface: a query that has no right to read a piece of data does not receive it, even bypassing the app.
Server admin keys are never exposed to the browser. Email addresses are barred from being read at the column level. Traffic is encrypted (HTTPS), and the app enforces a content security policy that strictly limits the external domains allowed.
No system is perfect, so choose a password you use nowhere else.
12. Minors
You must be 16 or over to use Blocus Tracker. The service is not directed to children and we do not knowingly collect data about anyone under 16.
Why 16 and not lower. The GDPR lets each EU country set the age at which a minor can consent on their own to an online service: it ranges from 13 to 16 depending on the Member State. Belgium sets it at 13, but that Belgian threshold does NOT automatically apply to someone reading this from Germany, the Netherlands or France, where the age is higher. We have neither a parental-authorisation system nor a reliable way to determine everyone's country of residence, so we apply the most protective threshold — the one that holds everywhere in the Union.
We do not ask for proof of age and we run no identity verification: that would mean collecting far more data than we are trying to protect. This age limit therefore rests on your own declaration.
If you are a parent or guardian and find that a younger minor has created an account, email mathias.dock.management@gmail.com: the account and its data will be deleted.
13. Changes
This policy may change. Its current version is 2026-10-26T18:05:35Z and the last-updated date is shown at the top of this page.
For a significant change — a new purpose, a new recipient, a new category of data — a reminder appears in the app. Adding a tracker cannot activate without going through the consent banner again anyway.