Privacy policy

Last updated 3 November 2026

This policy covers growblocks.xyz and the GrowBlocks Dev Kit: the growblocks command-line tool and MCP server (on npm), the GrowBlocks plugin for Claude Code and the Claude Desktop extension. Short version: we keep what we need to run your account and your games, we do not sell it, and we do not use ads or outside analytics; we only count, ourselves, how our games are played.

Who we are

GrowBlocks is run by Ground Agents Solutions S.L. (CIF B40274763), Benicàssim (Castellón), Spain, which is the controller of the personal data described here. This policy covers the website growblocks.xyz and the GrowBlocks app for Android. Contact: privacy@growblocks.xyz.

What we collect

• Your account. When you sign in with Google we receive your Google account ID, name and email address. Developers who request Dev Kit access are stored with that name, email and the request date.
• Dev Kit sign-in (CLI, MCP server, plugin). When you sign the tool in, we store a token linked to your account, the label of the device that asked (for example your computer's name followed by "MCP"), and when it was created and expires. We keep only a SHA-256 hash of the token, never the token itself. Tokens last 90 days and growblocks logout revokes them. The token is saved on your own computer in ~/.growblocks/credentials.json. Your IP address is used briefly in memory to limit sign-in attempts and is not stored.
• Your games and blocks. The files you upload (code, art, sound), the game's name, address, tagline, description, studio name and logo, its builds and review status, and the blocks you publish. Test builds are unlisted but reachable by anyone with the link; live games and published blocks are public.
• Playing. Your nickname, character, position and chat in multiplayer rooms, your game wallet's public address, and game progress such as scores, SEED (formerly XP) and GROWN.
• Game visits. When you open one of our games, signed in or not, we record which game, how long it was on screen, how much of that time you were pressing keys or tapping, whether you are on a phone, tablet or computer (and its screen size), and the site or page you came from. A random visitor ID kept in your browser connects your visits; if you are signed in, the visit is linked to your account. No cookies, no IP address, and nothing is shared with anyone. We use it only to see which games people play and for how long, and keep it for up to 400 days. Clearing your browser's site data gives you a new visitor ID.
• Onchain activity. Purchases, trades, mints and coin launches happen on a public blockchain. That record is public and permanent, and nobody, including us, can change or delete it.

The Dev Kit itself does not read your project files except to check them and to upload them when you push, and it never sends your files anywhere when you only run the checker locally.

Why we use it

• To sign you in, run your account and games, review builds before players get them, show your games and blocks, and pay earnings (performing our agreement with you).
• To understand which games are played and for how long, so we can improve them (our legitimate interest).
• To keep GrowBlocks safe: stopping abuse, fraud and impersonation (our legitimate interest).
• To meet legal obligations.

Who processes it for us

• Google (Firebase and Google Cloud): sign-in, database and file storage.
• Vercel: hosting the website and its API.
• Fly.io: the multiplayer match server.
• LiveKit: voice chat and live trades.
• Privy: game wallets.
• Telegram: only if you link your Telegram account or use the Telegram Mini App.
• Sage by Levanto Labs: only when a game uses gb.ai, which sends the game's own question, not your account details.

Some of these providers process data outside the European Economic Area, under safeguards such as the European Commission's standard contractual clauses. We do not sell or rent personal data, and we do not use advertising or outside analytics trackers.

How long we keep it

• Account and developer records: while your account is active.
• CLI and MCP tokens: until they expire (90 days) or you sign out, then removed.
• Game builds, game details and published blocks: until you or GrowBlocks remove them. Blocks other games already ship may stay available to those games.
• Blockchain records: permanent, by the nature of the chain.

Your rights

You can ask to see, correct, export or delete your personal data, or object to or restrict how we use it, by writing to privacy@growblocks.xyz. We answer within one month. You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es).

Delete your account

To delete your GrowBlocks account, email privacy@growblocks.xyz with the subject "Delete my GrowBlocks account", from the email address of the Google account you sign in with (or tell us that address and your player name). Within 30 days we delete your account and the personal data tied to it: your profile, nickname, character, game progress, SEED, friends and chat history, and your game wallet link. We confirm by email when it is done. We may keep only what the law requires us to keep (for example records of payments) for as long as it requires. Anything recorded on a public blockchain, such as NFTs your wallet holds or past transactions, is public and permanent and cannot be deleted by anyone, including us.

Children

GrowBlocks games are not directed at children under 13. The GrowBlocks Dev Kit is meant for developers aged 18 and over, and we do not knowingly collect personal data from children through it.

Changes

If this policy changes, we update this page and the date above. For big changes we also tell signed-in developers.