GambitBlock privacy

Who We Are

GambitBlock is operated from Japan by an individual operator. In this policy, "GambitBlock," "we," and "us" refer to that operator. Contact us at [email protected]. Legal operator details are available as described in the Seller Disclosure.

Scope

This policy applies to GambitBlock's extension, gambitblock.app, account and subscription services, support communications, and waitlist. It does not govern third-party websites you visit or services with their own privacy policies.

Extension Data

The extension handles the following data in your Chrome profile:

• Blocked domains and URLs needed to decide whether a top-level tab should be blocked
• Blocking settings, schedules, unlock windows, hard-mode settings, and challenge preferences
• Challenge progress, recent puzzles, attempts, streaks, and focus statistics
• An account session token and Pro status when you connect an account

GambitBlock checks top-level tab and navigation URLs against your blocked-site list. This happens locally. We do not send your general browsing history, page content, form entries, or the URLs of sites you visit to our servers. A blocked domain may appear in the extension interface because you chose to add it.

Website And Account Data

When you use an account or online feature, we may process:

• Your email address and sign-in method
• Hashed authentication tokens, session status, expiration and revocation records
• Hashed extension link codes and whether an extension is connected
• Pro entitlement, subscription status, billing-period end, and cancellation status
• Security and request data such as time, route, browser metadata, IP-derived rate-limit identifiers, and audit events

An email address is required for an online account because it identifies the account and supports authentication. You can use the extension's local free features without creating an account.

Google Sign-In

If you choose Continue with Google, Google provides your verified email address and the information needed to complete that sign-in. We use it only to create or find your GambitBlock account, authenticate you, prevent abuse, and provide account features. GambitBlock does not request access to Gmail, Google Drive, contacts, calendars, or Chrome browsing history.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Billing Data

Stripe processes checkout, payment methods, invoices, subscription changes, and cancellations. GambitBlock receives Stripe customer and subscription identifiers, your billing email, payment and subscription status, renewal dates, and cancellation status. We do not receive or store your full card number or card security code.

Waitlist And Support

If you join the app-update waitlist, we store your email address, consent time, and subscription status so we can send product updates and offers. You can leave without an account at gambitblock.app/unsubscribe. We may retain a minimal suppression record so we do not add you back by mistake.

If you contact support, we process your email address, message, attachments, and related account details to answer you and resolve the request.

Why We Use Data

We use personal data to provide and secure the extension and accounts, authenticate users, connect Chrome profiles, manage Pro access and billing, answer support, improve reliability, prevent fraud and abuse, comply with law, and send waitlist messages when you consent.

For people in the EEA or United Kingdom, our legal bases are performance of a contract for requested account and subscription features; legitimate interests in security, support, fraud prevention, and service reliability; consent for optional marketing; and compliance with legal obligations for billing, tax, and valid legal requests.

How We Share Data

We disclose data only as needed to operate GambitBlock:

• Cloudflare hosts the website, API, and database and provides network security
• Stripe processes payments, subscriptions, invoices, and the billing portal
• Google provides optional OAuth sign-in and email services
• Resend delivers magic links, waitlist messages, and unsubscribe confirmations

We may also disclose information when required by law, to protect users or the service, or as part of a merger, financing, acquisition, or transfer of the business. Where required, we will provide notice and obtain consent. We do not sell personal information, serve behavioral advertising, or share browsing activity with data brokers or advertising networks.

International Transfers

GambitBlock is operated from Japan, and our providers may process data in Japan, the United States, and other countries where they operate. Those countries may have different privacy laws. Where required, transfers rely on an applicable adequacy decision, contractual safeguards, or another lawful transfer mechanism. Contact us to request information about safeguards relevant to your data.

Retention And Deletion

• Local extension data remains in your Chrome profile until you remove it, clear extension storage, or uninstall the extension
• Account and subscription records remain while your account is active and afterward only as needed for billing, tax, disputes, security, and legal obligations
• Expired authentication, link-code, rate-limit, and audit records are retained only as reasonably needed for security and troubleshooting
• Waitlist data remains until you unsubscribe; a minimal suppression record may remain to honor that choice
• Support records remain as long as needed to resolve the request and protect legal rights

You can request account deletion at [email protected]. We may first verify your identity. Deletion does not include records we must keep by law or reasonably need for security, fraud prevention, billing, or legal claims.

Your Privacy Choices And Rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of your personal data. You may withdraw consent at any time without affecting earlier lawful processing. You may object to direct marketing at any time by using the unsubscribe link or page.

Residents of Japan may request disclosure, correction, suspension of use, or deletion as provided by the Act on the Protection of Personal Information. People in the EEA may complain to the data protection authority where they live or work, and people in the United Kingdom may complain to the Information Commissioner's Office. You may also contact Japan's Personal Information Protection Commission.

Send a request to [email protected]. We may need to verify your identity and may deny or limit a request where the law permits. We will not discriminate against you for exercising a privacy right.

Automated Decisions

GambitBlock automatically checks whether a session and Pro subscription are active. This controls access to product features but is not used to make decisions that produce legal or similarly significant effects about you. Contact support if you believe an entitlement decision is wrong.

Security

We use measures such as encrypted network connections, hashed authentication secrets, expiration and revocation controls, rate limiting, and restricted service access. No online service can promise absolute security. Keep your email account and devices secure, and contact us if you suspect unauthorized access.

Children

GambitBlock accounts and paid services are not directed to children under 16. A person under the age of legal majority where they live must have permission from a parent or guardian to purchase Pro. If you believe a child provided personal data without required permission, contact us.

Changes To This Policy

We may update this policy when the product, providers, or law changes. We will post the new effective date and provide additional notice before a material change where required. We will request consent if a new use of data requires it.

Contact

Privacy questions and requests can be sent to [email protected].