Privacy Policy

BLOCKREQ TECHNOLOGY LIMITED, a company registered in Hong Kong, runs BlockReq and is responsible for the personal data described here. You can reach us at support@blockreq.com; please put "Privacy" in the subject line.

We collect only what we need to run the service:

• Account details: your email address and, if you sign in with Google or GitHub, the name, email address, and profile picture those services share. With wallet sign-in we store your wallet address. Passwords are stored only as a hash.
• Sign-in records: for each sign-in session we keep the IP address and browser user agent, to protect your account.
• Payment details: Stripe processes all payments. We receive and keep the amount, the payment method type, and for cards the brand, last four digits, and expiry date. We never see or store full card numbers.
• RPC usage: for each endpoint we count requests, methods, and bytes so we can bill usage and show it in the Dashboard.
• Request logs for keyed endpoints: for a sample of requests sent with your API key (every error, and successful requests up to a daily cap per key, then about 1 in 100), we record the time, network, method, status, duration, client IP address, and the request body up to 15,000 bytes. Only you and the people you give access to your account can see them in the Dashboard.
• Public endpoints: when you use a public endpoint without a key, we keep no request logs. Your IP address is used only for rate limiting, in a counter that expires within seconds.
• Support and forms: what you send us by email or support ticket, and what you enter in forms such as Developer Boost (name, email, and GitHub repository).
• Website analytics: how pages on blockreq.com are used, collected with PostHog and Google Analytics as described under Cookies below.

• To create and secure your account and sign you in.
• To run the RPC service: routing requests, applying rate limits and plan quotas, and preventing abuse.
• To bill you, keep payment records, and send receipts and usage alerts.
• To answer support requests.
• To understand how the site is used and improve it.
• To meet legal obligations such as tax and accounting rules.

We do not sell personal data, we do not use it for advertising, and we do not send marketing email.

• Contract: to provide the account, RPC service, billing, and support you asked for.
• Legitimate interests: to keep the service secure, apply rate limits, prevent fraud and abuse, and fix problems.
• Consent: for analytics cookies. You can withdraw it at any time under Cookie settings.
• Legal obligation: to keep payment and tax records.

• Necessary: the sign-in session cookie, the language cookie (1 year), and the cookie that remembers your analytics choice (180 days). The site does not work properly without them, so they are always on.
• Preferences: browser storage for things like dismissed banners and cached chain lists. If you enter an API key in the API documentation playground, it is kept in your browser so you do not have to enter it again; it is sent only with the requests you make.
• Analytics: PostHog (product analytics and session replay, with form inputs masked and API keys removed) and Google Analytics. Visitors in the EEA, the UK, and Switzerland get them only after choosing Accept. Anyone can turn them off with Cookie settings at the bottom of the home and pricing pages.

Our documentation and blog use no analytics cookies. Blog posts show an X (Twitter) share button that loads a script from X, which X handles under its own privacy policy.

These providers process data on our behalf to run BlockReq:

• Hosting and infrastructure providers: website hosting, content delivery, databases, email delivery, request log storage, and the servers that run our RPC service.
• Stripe: card and crypto payments.
• PostHog and Google: website analytics, with consent where required. Google and GitHub also handle sign-in when you choose them.
• Reown (WalletConnect): connecting your wallet for wallet sign-in.
• Team tools: the services our team uses to handle support requests and Developer Boost applications.
• Third-party node providers: when one of them serves your request, we send it the RPC request itself (the method and its parameters), but never your IP address, API key, or account details.

We may also disclose data when the law requires it, or to protect our users and the service from fraud and abuse.

We are based in Hong Kong, and our providers process data in several countries, including the United States. When data leaves the EEA, the UK, or Switzerland, we rely on the safeguards our providers offer, such as the European Commission's Standard Contractual Clauses.

• Account data: while your account exists.
• Request logs: up to 3 months. The Dashboard shows the last 24 hours on the Free plan and the last 7 days on paid plans.
• Usage counts: 15-second counts for 24 hours, then daily totals for 60 days.
• Payment records: as long as tax and accounting law requires.
• Developer Boost applications: 90 days.
• Support conversations: while your account exists, or as long as needed to resolve the request.

When you ask us to delete your account, we delete or anonymize your data, except records the law requires us to keep.

Depending on where you live, you can ask us to:

• give you a copy of the personal data we hold about you;
• correct it;
• delete it, including your account;
• restrict or object to how we use it;
• stop analytics, by withdrawing consent, which does not affect anything done before.

Email support@blockreq.com from the address on your account and we will reply within 30 days. If you are in the EEA, the UK, or Switzerland, you can also complain to your local data protection authority.

All traffic uses HTTPS, passwords are stored only as hashes, and access to personal data is limited to the people who need it to run the service. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.

BlockReq is a service for developers and is not meant for children under 16. We do not knowingly collect their data.

We post changes on this page and update the date at the top. For significant changes, we email account holders before they take effect.