Privacy at Block and Paper.
Block and Paper is operated by Heap Labs LLC. This page describes the information used by the map studio and store.
Searching and drawing a map
The map requests tiles from OpenFreeMap. Location searches are processed through our server and Photon, and additional boundary requests may use OpenStreetMap services. Those requests reveal the searched location or map area to the services involved. Your browser shares the connection information needed to load external resources. The browser only supplies your device location if you choose that control and grant permission.
Saved designs
As you edit, we automatically keep draft map settings, location, text, and markers in this browser. Drafts can be recovered for 30 days after your last change, on the same device and browser, independently of analytics choices. It does not store your delivery or payment details or create a public design link. “Start over” replaces the current draft with a fresh design; clearing this site’s browser data removes all local drafts. Use Save design if you want a link for another device.
When you save, we store the map settings, location, text, and markers and create a design link. Anyone with that link can view the design and customize a copy. Avoid putting information in a saved design that you do not want its viewers to see. Saved design pages are excluded from our sitemap and marked not to appear in search results.
Orders
When print ordering is available, we collect the delivery and order details needed to fulfill the purchase. Stripe processes payments; Prodigi receives the details needed to make and ship the print. Resend receives your email address, order summary and private order link to deliver order and cancellation confirmations. Keep your order link private: it lets its holder view order status and cancel within the cancellation window. Production artwork is stored privately, with temporary access used for fulfillment. We do not publish payment details or delivery addresses in design links.
Analytics and cookie choices
We use Google Analytics to measure visits, traffic sources, engagement, map product choices, design saves, checkout steps, and completed purchases. Google receives a pseudonymous browser identifier, device information, approximate location, and these events. Confirmed purchase events include a transaction reference, product options, price, currency, and shipping amount. They are associated with your browsing session only when analytics is enabled. We do not send Google your name, email, address, map captions, searched locations, coordinates, or private saved-design links.
In regions where our analytics requires prior consent, a banner asks you to allow or decline it before Google Analytics loads. In supported regions where prior consent is not required, analytics runs unless you opt out. If your region is unknown or not yet covered by our regional rules, analytics stays off unless you choose to allow it. Our hosting provider supplies an approximate country and region from your connection; we do not request your device location for this decision.
Use “Privacy choices” on any page to change your choice. Allow and decline choices last 180 days in this browser. We honor Global Privacy Control and Do Not Track by disabling analytics. Declining stops future analytics and removes our Google Analytics cookies. It does not delete previously collected statistics or essential order records. A purchase already sent to checkout may be reported according to the choice made at checkout.
Google Analytics uses _ga and _ga_* cookies to recognize a browser and its sessions, with a lifetime of up to 180 days, renewed by activity. We also keep campaign attribution in session storage while analytics is enabled, and a local preference record to remember your choice. These choices do not affect essential saving, payment, shipping, or security functions. We do not enable Google signals, personalized advertising, advertising cookies, or user-provided data collection.
Google may process analytics data in the United States and other countries. Read how Google uses information from sites that use its services. Contact us using the link below to exercise applicable privacy rights.
Hosting and retention
Our hosting services process routine request and security logs. Saved designs and order records are stored on AWS; private production artwork is configured to expire after 90 days. Other records may be kept for support, fulfillment, and business recordkeeping. Contact us about access or deletion requests, including the relevant design link or order reference where available.