Privacy Policy

Last updated: May 24, 2026

Parcloud Oy ("we," "us," or "our") operates the BuyBlock mobile application, the BuyBlock Chrome browser extension, and the website buyblock.app (together, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are a Finnish company, and we process data in compliance with the EU General Data Protection Regulation (GDPR) and Finnish data protection legislation.

1. Information We Collect

1.1 Account Information

When you sign in with Apple or Google, we receive:

• Your name (as provided by the sign-in provider)
• Your email address
• A unique account identifier

We do not receive or store your Apple or Google password.

1.2 Product Data You Provide

When you add items to BuyBlock, we collect:

• Product URLs you paste
• Photos or screenshots you upload
• Product descriptions you type or dictate
• Estimated prices you enter
• Your buy/skip decisions

1.3 Automatically Collected Information

We automatically collect certain technical information:

• Device information: device model, operating system version, app version
• Usage data: features used, screens visited, cooldown durations selected
• Crash reports: diagnostic data when the app encounters errors
• Subscription status: whether you are on the free tier or Pro plan

1.4 Information We Do Not Collect

• We do not access your contacts, calendar, or browsing history
• We do not track your location
• We do not collect financial or banking information (subscriptions are handled entirely by Apple)
• We do not use advertising identifiers or serve ads

1.5 Chrome Extension Data

The BuyBlock Chrome extension is a companion to the BuyBlock mobile app. It is installed voluntarily from the Chrome Web Store and signs in to the same account as the mobile app. Its single purpose is to help you pause on impulse purchases while browsing product pages.

When you visit a web page and the extension is active, it reads limited product information to detect whether the page is a product page and to show a sidebar for starting a cooldown or viewing an AI research report:

• The page URL (only the tab you are actively viewing)
• Product name, price, currency, and image URL from structured metadata on the page (JSON-LD, Open Graph tags, or visible DOM elements — the same data retailers already publish to search engines)

This detection runs locally in your browser. Nothing is sent to our servers unless you explicitly click "Start cooldown," "Research this product," or a similar action inside the sidebar. When you do, the product URL, product name, and price are sent to our servers via the same authenticated API the mobile app uses.

The extension also stores the following locally in your browser using chrome.storage.local:

• Your Firebase authentication tokens (so you stay signed in across tabs)
• Your cached UI locale, mirrored from your account on first popup open
• Transient detection state for the currently active tab

The extension does not:

• Read or store your full browsing history — it only acts on the tab you are viewing
• Read form input, passwords, credit card numbers, or any data you type into pages
• Track you across sites for advertising, analytics, or any other purpose
• Inject ads, affiliate links, or any modified content into the pages you visit
• Sell or share the product data you act on with any party other than the third-party services listed in Section 3, which process the data to generate your research report

2. How We Use Your Information

We use your information to:

• Provide the Service: manage your account, process items you add, generate AI research reports, calculate savings
• Generate AI reports: product data you provide is sent to our AI model to produce research reports including price analysis, review synthesis, and recommendations
• Personalize reports: your past purchase decisions (last 12 months) are used as context to make AI reports more relevant to your spending patterns
• Send notifications: alert you when cooldown timers expire
• Improve the Service: analyze aggregated usage patterns to fix bugs and improve features
• Manage subscriptions: verify your subscription status and enforce usage limits

3. Third-Party Services

We use the following third-party services to operate BuyBlock:

• Firebase (Google Cloud): authentication, database, file storage, push notifications, analytics, and crash reporting. Firebase Privacy Policy
• Google Gemini AI: generates product research reports from the data you provide. Product data is processed by Google's AI models. Gemini Terms of Service
• Keepa: provides Amazon price history data for products with Amazon URLs. Only the product identifier is shared. Keepa Privacy Policy
• Serper.dev: provides current retailer pricing from Google Shopping. Only the product name and your country are shared; no personal data is transmitted. Serper Privacy Policy
• eBay Browse API: retrieves current marketplace listings for cross-retailer price comparison on supported items. Only the product name or identifier is shared; no personal data is transmitted. eBay Privacy Notice
• Google reCAPTCHA Enterprise: used by Firebase App Check to verify legitimate clients and block automated abuse of our backend. In the Chrome extension, it is loaded inside an offscreen document only when an App Check token is refreshed; it does not track you across sites. Google Privacy Policy
• RevenueCat: manages subscription status. Receives your anonymous user ID and subscription events. RevenueCat Privacy Policy
• Apple App Store: processes all payments and subscriptions. We never receive your payment details.

4. Data Storage and Security

Your data is stored in Firebase (Google Cloud) servers. We implement industry-standard security measures including:

• Encryption in transit (TLS) and at rest
• Firebase Security Rules that restrict data access to authenticated users
• Firebase App Check to prevent unauthorized API access
• No plaintext storage of sensitive credentials

5. Data Retention

• Active accounts: your data is retained for as long as your account is active
• Deleted accounts: when you delete your account (via Settings > Delete Account), all your personal data — including items, reports, and preferences — is permanently deleted within 30 days
• Anonymized analytics: aggregated, non-identifiable usage data may be retained indefinitely for service improvement

6. Your Rights Under GDPR

As a data subject under the GDPR, you have the right to:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate data
• Erasure: request deletion of your data (you can also delete your account directly in the app)
• Portability: request your data in a machine-readable format
• Restriction: request that we limit how we process your data
• Objection: object to processing based on legitimate interests
• Withdraw consent: where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at support@buyblock.app. We will respond within 30 days.

You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local data protection authority.

7. Legal Basis for Processing

We process your data under the following legal bases:

• Contract performance: processing necessary to provide the Service you signed up for (account management, report generation, cooldown tracking)
• Legitimate interests: analytics and crash reporting to improve service reliability and user experience
• Consent: push notifications (you can disable them in device settings at any time)

8. International Data Transfers

Your data may be processed in countries outside the EU/EEA, including the United States, through our third-party service providers (Google, RevenueCat, Keepa, Serper, eBay). These transfers are protected by:

• EU Standard Contractual Clauses (SCCs)
• The EU-US Data Privacy Framework, where applicable
• Adequate contractual and organizational safeguards

9. Children's Privacy

BuyBlock is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us at support@buyblock.app and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new "Last updated" date. For significant changes, we may also send a push notification or in-app notice.

11. Contact Us

If you have questions about this Privacy Policy or our data practices:

• Email: support@buyblock.app
• Company: Parcloud Oy
• Country: Finland