Last updated: October 24, 2026
The short version. Block Hero helps Shopify merchants schedule promotional content on their store and shows them how that content performs. We do not collect shoppers' names, email addresses, phone numbers, postal addresses or payment details. We do not sell any data. We do not use data for advertising or to make automated decisions about anyone.
Block Hero is run by Three Two Studio LLC (doing business as Block Hero), 9510 Timberline Drive, Indianapolis, Indiana 46256, United States. In this policy "we" and "us" means Three Two Studio LLC. You can contact us about privacy at accounts@blockhero.io.
For shopper data, the merchant decides to use Block Hero and we process the data on the merchant's behalf: the merchant is the controller and we are its processor (a "service provider" under California law). For merchant account data, we decide how it is used, so we are the controller.
Visits to blockhero.io. We count visits to this website with PostHog, in its cookieless mode: the pages viewed, the links and buttons clicked, the page you came from, and your browser, device type and screen size. Nothing is stored on your device, so there is no cookie banner. To count unique visitors, PostHog combines your IP address and browser details with a value that changes every day into a code that cannot be turned back into either, then deletes the IP address before saving the visit. We do not try to identify website visitors, and we decide how this information is used.
We collect as little as we can to show merchants how their blocks perform.
Impressions and clicks. When a block appears on screen or is clicked, the shopper's browser tells us which block and which piece of content it was, plus the store domain and block type. Our server adds the time. Nothing in this record identifies the shopper. These are recorded only if the shopper has allowed analytics, the same way Shopify's own analytics work.
Click sessions, only with analytics consent. If a shopper has allowed analytics in the store's cookie banner and clicks a block, we start a session:
bh_session_id, bh_content_id and bh_placement_id. Shopify copies cart attributes onto the order, so the merchant can see them on the order.Checkout and orders, only with analytics consent and only for click sessions. A Shopify checkout pixel tells us when a shopper in a click session reaches checkout and, if they buy, the order's ID. We then ask Shopify for that order's ID, the time it was placed, whether it was a test order, its attributes, and its total and subtotal in the store's currency. We keep the order ID, the two amounts, the currency, the session ID and the times. We do not read the shopper's name, email, phone, address, the items bought, or how they paid.
Block size measurements. For some custom blocks, the browser reports the screen width and the block's height so the page can reserve the right amount of space next time. This is saved against the block, not against the shopper.
What we do not collect from shoppers: names, email addresses, phone numbers, postal addresses, payment details, account logins, IP addresses in our analytics database, or device fingerprints. We set no cookies. Like any website, the shopper's IP address reaches Shopify and our hosting provider when the browser sends these requests; our code does not save it. When a shopper is logged in to the store, Shopify adds their customer ID to requests sent through the app proxy. Our code uses it only to check that the request really came from Shopify and does not save it, but our hosting provider's request logs record the full request address, including that ID, and keep it for 30 days.
We do not use any of it for advertising, we do not build profiles of shoppers, we do not combine one store's data with another's, and we do not make automated decisions that have legal or similar effects on anyone.
We do not sell or rent data. We share it only with the services that run Block Hero for us:
| Service | What it does for us | What it receives |
|---|---|---|
| Shopify | The platform the app runs on; billing | Content we publish to your store; billing requests |
| Gadget | Hosts the app, its database and its storefront endpoints (on Google Cloud) | All merchant data in section 3; shopper events pass through it on the way to Tinybird |
| Tinybird | Stores and totals the analytics events (US East region) | The shopper events in section 4 |
| PostHog | Admin usage analytics; visit counts for blockhero.io | Section 3 admin usage (including admin session recordings), store ID and domain, Block Hero plan status, trial end date, Shopify plan and store creation date; blockhero.io visits as described in section 2. No shopper data |
We may also share information if the law requires it, or with a buyer if the business is sold, under this policy.
Block Hero uses Shopify's own consent tool. Click sessions, the cart attributes, the session events and the checkout pixel all run only when Shopify reports that the shopper has allowed analytics. This includes impression and click counts. If the shopper declines or withdraws consent, nothing more is sent.
Block Hero does not sell or share data for cross-context advertising, so a "do not sell or share" choice has nothing to switch off in Block Hero.
Shoppers should contact the store they shopped with. Shopify passes shoppers' access and deletion requests, and a store's deletion request after uninstall, on to us.
When Shopify passes on a shopper's deletion request, we automatically delete the order records and click session events linked to the orders named in the request. When Shopify passes on a shopper's request for their data, we send the store owner what we hold within 30 days. When a store uninstalls, Shopify sends us a deletion request 48 hours later, and we delete the store's data automatically, as described in section 8.
Merchants can ask us at accounts@blockhero.io for a copy of their data, a correction, or deletion, and we respond within 30 days. Our Data Processing Addendum for merchants is part of our terms of service.
Analytics events are stored in the United States. Our hosting provider (Gadget) stores data in the United States and Canada; its own providers, including Google Cloud, are in the United States. Our providers' data processing agreements cover international transfers with the EU Standard Contractual Clauses and the UK and Swiss equivalents. When personal information is sent to the United States from Australia, the EU, the UK or Switzerland, we rely on these safeguards and take reasonable steps so it is handled in line with the privacy laws of the place it came from.
Depending on where you live, you may have the right to see, correct, delete or move your data, or to object to how it is used. Merchants can contact us directly. Shoppers should contact the store, which can pass the request to us through Shopify. You can also complain to your local privacy regulator. This policy is governed by the laws of the State of Delaware, United States. In the EU, you can complain to the data protection authority where you live; in the UK, to the Information Commissioner's Office (ICO); in Australia, to the Office of the Australian Information Commissioner (OAIC).
Block Hero is a tool for businesses. It does not knowingly collect information about children.
We will update the date at the top when this policy changes, and tell merchants in the app or by email about any significant change.
Three Two Studio LLC (doing business as Block Hero), 9510 Timberline Drive, Indianapolis, Indiana 46256, United States. Email: accounts@blockhero.io.
## Related