Privacy Policy

Who we are and what this covers

GlassBlockers ("we", "us") runs the website at glassblockers.com, a community-built archive of glass block architecture spotted in movies, on TV and in real buildings. This policy explains what information the site collects, why, who it is shared with, how long it is kept, and the choices you have. It applies to the website and the emails we send. Copyright questions are covered separately on our DMCA page.

What we collect, and why

Browsing without an account

You can read every published sighting without signing in. Our hosting and network providers (Lovable and Cloudflare) keep standard server logs, which include your IP address, browser type, the pages requested and timestamps. These are used to serve the site, keep it secure and diagnose errors. Our hosting platform also runs a small script on the site that reports page errors and basic usage signals back to the platform so we can see when something breaks.

Creating an account with an email address

• Your email address, used to sign you in, to confirm your account, and to reset your password.
• Your password, stored only as a one-way hash by our sign-in provider. We cannot read it.
• A username, which is public and appears on the sightings you submit. You can change it in your profile.
• Optionally, a display name and a profile photo you upload.
• Your role (member, moderator or admin), the sightings you have submitted, and any badges you earn.

Signing in with Google

If you choose "Continue with Google", Google asks you to approve sharing your basic profile with GlassBlockers. We request only the email, profile and openid scopes, which give us:

• your email address, used as the identity of your GlassBlockers account;
• your name and the link to your Google profile picture, kept in your account record;
• a Google account identifier, so we can recognise you the next time you sign in with Google.

That is all we receive. We do not get your Google password, contacts, calendar, Drive files, YouTube data or anything else, and we never post, send or change anything in your Google account. The token Google issues during sign-in is used only to complete that sign-in; we do not store it for later use. Your username on GlassBlockers is generated from the part of your email address before the @ sign; your Google name and picture are not shown publicly unless you choose to set them as your display name or upload the picture yourself. You can revoke GlassBlockers' access at any time at myaccount.google.com/permissions; your GlassBlockers account then stays usable with an email address and password.

GlassBlockers' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain words: Google data is used only to sign you in and run your account, it is never sold, used for advertising, or shared with anyone except as this policy describes.

Submitting a sighting

• The photos you upload. They are resized in your browser before upload and stored in our file storage.
• What you type: a title, a description, and either the movie or show title, year and timestamp, or the place name, city, state and country.
• The name shown with the sighting: your display name if you set one, otherwise your username.
• When you upload photos, a hashed (one-way scrambled) form of your IP address is kept for up to one hour to limit uploads to ten per hour per connection. The record is anonymised automatically within 24 hours.

Every sighting is reviewed by a moderator before it is published. Approved sightings are public: the photo, the details and the name shown with it appear on the site, in link previews when the page is shared, and in our sitemap for search engines.

Looking up a city on the submit form

When you type a city, the text you typed goes through our own server to komoot's Photon service, which suggests matching towns and cities from OpenStreetMap data. Photon receives that text and our server's address, not yours, and nothing else about you. The list of countries is built into the site, so nothing is fetched for it.

Sharing a location on the map (optional)

An In the World sighting can carry a map location. You can type an address or a place name on the submit form: the text you type is sent, through our own server and with nothing else about you, to komoot's Photon service to find matching places, and the match you pick becomes the location. Or you can tap "Use my location". Nothing is read from your device unless you tap that. Your browser then asks your permission and gives us the position; we send those coordinates, and nothing else, to OpenStreetMap's Nominatim service through our own server to fill in the city, state and country for you. You choose the precision: "Exact spot" keeps the position to about a metre; "Neighborhood only" rounds it to about a kilometre before it is stored, so the exact spot never reaches us. The location is published with the sighting as a pin or a circle on a map and as links to map apps. Photo metadata is never used for this: photos are stripped of location data when they are resized. To change or remove a sighting's location, email us.

Newsletter

If you subscribe, we store your email address and a confirmation token. You receive a confirmation email first and only get the newsletter after you click it. Every newsletter has an unsubscribe link.

Reporting a sighting

A report stores the reason, any notes you add, and, if you give one, a hashed form of your email address. Reports are visible to moderators only and trigger an email to our admin inbox.

Who can see your information

Public

Your username, display name if set, profile photo if uploaded, your published sightings and your badges. Your email address, Google account details, pending or rejected sightings, and IP address are never public.

Service providers that process data for us

• Lovable Cloud hosts the site, the database, file storage and the sign-in system (built on Supabase).
• Cloudflare delivers the site and protects it from abuse.
• Google, only if you sign in with Google, as described above.
• Resend sends our emails (account, newsletter and report notifications).
• OpenStreetMap draws the map on sighting pages that have a location (your browser loads its map tiles directly, so OpenStreetMap sees your IP address), and its Nominatim service turns a shared position into a place name through our server.
• komoot Photon answers the address, place and city searches on the submit form through our server, using OpenStreetMap data; it receives the text you type and nothing else about you.

These providers process data only to provide their service to us. We do not sell personal information, we do not run advertising, and we do not share your data with data brokers or ad networks.

Legal requests

We may disclose information if required by law or legal process, or to protect the rights, property or safety of GlassBlockers, its members or others.

Cookies and browser storage

• Your sign-in session is kept in your browser's local storage, not in a cookie, and is removed when you sign out.
• Cloudflare sets a short-lived bot-protection cookie (__cf_bm) that expires within about 30 minutes. It is required to keep the site reachable.
• We set no advertising or cross-site tracking cookies.

How long we keep it, and how to delete it

• Account data is kept while your account exists.
• Published sightings are kept as part of the archive. If you delete your account, your profile and personal details are removed; your sightings stay in the archive credited to “Former member” unless you ask us to remove them, which we will do.
• Pending and rejected sightings are kept for moderation records while your account exists, and are deleted with it, photos included.
• Upload rate-limit records hold a hashed IP address for up to one hour and are anonymised within 24 hours.
• Newsletter addresses are kept until you unsubscribe.
• Server logs are kept by our providers for their standard retention periods.

To delete your account yourself, open your profile page, choose the Settings tab and use the Delete account button. It works immediately: your profile, achievements, roles, sign-in and any pending or rejected sightings (with their photos) are removed, and approved sightings stay in the archive credited to “Former member”.

If you cannot sign in, or want a published sighting or a newsletter subscription removed, email privacy-mail@glassblockers.com from the address on your account and we will do it and confirm by reply. You can also ask for a copy of the data we hold about you, or for a correction, the same way.

Security

The site is served over HTTPS. Database access is restricted by row-level rules so that members can see only their own private data and moderators only what moderation needs. Passwords are hashed by the sign-in provider. No internet service is perfectly secure; if we learn of a breach affecting your data we will tell you.

Children

GlassBlockers is not intended for children under 13 and we do not knowingly collect their personal information. If you believe a child has created an account, email us and we will remove it.

Where data is processed

Our providers store and process data in the United States and other countries where they operate. By using the site you understand that your information may be processed there.

Changes to this policy

When this policy changes we update it here and change the date at the top. Material changes to how we handle sign-in or submitted content will also be announced on the site.