THE BLOCK — PRIVACY POLICY

Draft 3 — Beta / Early Access

Effective Date: September 23, 2026 Last Updated: September 23, 2026 Platform: on-the-block.com Contact: support@on-the-block.com

This Privacy Policy explains how The Block (“The Block,” “Platform,” “we,” “us,” or “our”) collects, uses, stores, discloses, and protects information when you access or use on-the-block.com and related features and services.

This Privacy Policy should be read together with The Block Terms of Service and Transaction & Trading Rules.

By creating an account or using The Block, you acknowledge the data practices described in this Privacy Policy.

1. Our Privacy Approach

The Block is a sports-card collection, community, discovery, and peer-to-peer transaction platform.

Our current practices include:

• We do not sell your personal information.
• We do not rent personal information to data brokers or advertisers.
• We do not currently use third-party advertising pixels or cross-site advertising trackers.
• We distinguish between information intended to appear publicly and information maintained privately.
• Private card cost information is not displayed publicly.
• Shipping addresses and payment handles are not displayed publicly and are disclosed to a transaction counterparty only as necessary for an agreed transaction.
• H&H communications are not public.

The live technical audit confirmed that there are currently no advertising networks, marketing pixels, or cross-site tracking beacons embedded in the Platform.

2. Operator and Future Business Entity

The Block is currently operated during a pre-incorporation and early-access period.

If The Block later operates through a limited liability company, corporation, or other business entity, information associated with the Platform may be transferred to and maintained by that successor operator as permitted by applicable law and the Terms of Service.

Information may also be transferred in connection with a merger, acquisition, financing, restructuring, sale of assets, or similar business transaction, subject to applicable law.

3. Information We Collect

A. Account and Authentication Information

When you create an account, we currently collect:

• email address;
• password submitted through our authentication infrastructure;
• and username.

The Block currently uses Lovable Cloud's managed Supabase authentication infrastructure.

Passwords are handled by the authentication provider rather than stored in The Block's ordinary application database tables. The verified architecture also maintains authentication sessions through signed session tokens.

B. Profile Information

Depending upon what you choose to provide, your profile may contain:

• username;
• display name;
• biography;
• avatar;
• general location;
• favorite sport;
• Whatnot link;
• eBay link;
• Instagram link;
• website link;
• show information;
• Vouch count;
• and account timestamps.

Information entered into fields designed for public profile display should be considered public.

Do not place sensitive information in public profile fields.

4. Card and Shelf Information

When you add a card, The Block may collect:

• front/back photographs;
• player;
• sport;
• year;
• manufacturer;
• set;
• card number;
• parallel or variation;
• serial number;
• team;
• grading company;
• grade;
• condition information;
• notes;
• availability status;
• asking price;
• and other card information.

Depending on card status and Platform functionality, this information may appear on The Shelf, The Shop, The Show, profiles, or other public discovery areas.

Current card photographs and catalog information are publicly viewable where required for public Shelf and discovery functionality.

5. Private Card Cost Information

The Block allows users to maintain private card-cost information.

This may include acquisition or total cost.

Private card-cost information is not publicly displayed and is currently restricted to the applicable owner through database access controls.

A public asking price is separate from private cost information.

6. Card Photographs and File Storage

Card photographs and avatars are stored using managed cloud-storage infrastructure.

Images intended for public Platform features may be accessible to users and visitors as necessary to display those features.

Upload, modification, and deletion permissions are controlled based on the applicable user account.

Users should not upload sensitive personal information as card photographs or avatars.

7. AI-Assisted Card Intake

When you use AI-assisted card recognition, front and back card images, when supplied, may be transmitted to third-party AI infrastructure for processing.

The current system uses Lovable AI Gateway and OpenAI.

AI may suggest:

• player;
• sport;
• year;
• manufacturer;
• set;
• card number;
• parallel;
• serial number;
• team;
• grading company;
• grade;
• autograph status;
• notes;
• and related attributes.

The Block currently does not store raw AI request/response payloads in its application database. Card fields that a user reviews and saves may become part of the stored card record.

Third-party AI processing may also be subject to the applicable provider's privacy practices.

8. H&H Transaction Information

When you use The H&H, The Block may collect and retain information including:

• transaction participants;
• cards involved;
• offers;
• counteroffers;
• cash amounts;
• transaction status;
• messages;
• Handshake confirmations;
• timestamps;
• shipping information;
• carrier information;
• tracking numbers;
• receipt confirmations;
• cancellation information;
• problem reports;
• and dispute notes.

These categories are currently part of the live H&H architecture.

9. Private H&H Communications

H&H messages are not publicly available.

Current database access controls restrict messages to participating users.

Authorized Platform systems or personnel may nevertheless access relevant information when reasonably necessary to:

• operate the Platform;
• provide support;
• investigate reports;
• prevent fraud or abuse;
• enforce Platform rules;
• secure the Platform;
• or comply with law.

“Private” does not mean communications are end-to-end encrypted or inaccessible to The Block under all circumstances.

10. Shipping Addresses

The Block may store shipping information including:

• full name;
• street address;
• unit information;
• city;
• state/region;
• postal code;
• telephone number;
• and delivery instructions.

Shipping addresses are not publicly displayed.

Under the current H&H system, an applicable address is disclosed to the transaction counterparty after both users confirm the Handshake when that information is necessary to fulfill the transaction.

Users may not use another user's shipping information for unrelated purposes.

11. Peer-to-Peer Payment Information

The Block currently permits users to provide payment handles for peer-to-peer transactions.

These may include identifiers associated with:

• Venmo;
• PayPal;
• Cash App;
• Zelle;
• or Apple Pay.

A payment handle may contain personal information such as an email address or telephone number.

Payment handles are not publicly displayed and may be disclosed to the applicable transaction counterparty when necessary for an agreed transaction.

The Block currently stores no credit-card numbers, debit-card numbers, CVVs, expiration dates, or bank-account numbers.

Stripe is not currently integrated.

If subscriptions, Stripe payments, auctions, or other payment functionality are introduced, this Privacy Policy may be updated to reflect those practices.

12. Vouches and Reputation Information

The Block maintains information about qualifying completed transactions for Vouch and reputation functionality.

Vouch counts and applicable levels may be publicly displayed.

Vouches are transaction-history indicators and are not guarantees, certifications, background checks, endorsements, or promises regarding future conduct.

13. Card History and Provenance

The Block may maintain card-history information concerning completed Platform transactions.

This information supports the Platform's one-card/one-record architecture.

Platform history does not independently establish legal title, authenticity, physical possession, or provenance outside The Block.

Private cost information is not transferred to another user merely because the digital card record changes owners.

14. The Chase, Follows and Engagement Data

The Block may collect information about:

• cards placed in The Chase;
• follows;
• followers;
• card views;
• and related engagement.

The Chase is currently private to the user.

Follow relationships and certain social information may be publicly visible depending on Platform functionality.

The Block currently uses deduplicated card-view information to reduce artificial view manipulation.

15. Support and Report Information

When you contact support or report a card, user, or transaction problem, The Block may collect information such as:

• account information;
• email address;
• message;
• report reason;
• notes;
• photographs;
• screenshots;
• transaction information;
• attachments;
• and information you voluntarily provide.

This information may be retained as reasonably necessary to investigate the issue, protect users, prevent abuse, maintain records, enforce rules, or comply with law.

16. Technical Information

The Block's infrastructure may automatically process ordinary technical information necessary to operate and secure the Platform, including:

• IP address;
• browser information;
• device information;
• user agent;
• timestamps;
• session information;
• authentication tokens;
• and request information.

Authentication sessions currently use browser local storage.

17. How We Use Information

The Block may use information to:

• create and maintain accounts;
• authenticate users;
• operate The Shelf, Shop, Show, Chase, and H&H;
• process card uploads;
• provide AI card recognition;
• display public profiles and cards;
• maintain private records;
• facilitate negotiations;
• facilitate Handshakes;
• provide counterparties with required fulfillment information;
• maintain transaction histories;
• operate Vouches;
• send account and transaction notifications;
• provide support;
• investigate reports;
• detect and prevent fraud;
• secure the Platform;
• enforce agreements and rules;
• diagnose technical issues;
• improve Platform functionality;
• comply with legal obligations;
• respond to lawful requests;
• and protect users and the Platform.

18. Public Information

Information intended for public display may include:

• username;
• display name;
• avatar;
• biography;
• general location you provide;
• favorite sport;
• external links;
• show announcements;
• Vouch count and level;
• followers/following where displayed;
• public card records;
• card photographs;
• descriptions;
• grading information;
• serial information;
• availability;
• asking price;
• view counts;
• and applicable card-history information.

Because this information is public, others may view, copy, save, screenshot, or share it outside The Block.

19. Information Not Publicly Displayed

Information not intended for general public display currently includes:

• account email address;
• authentication credentials;
• private card costs;
• shipping addresses;
• payment handles;
• H&H communications;
• transaction tracking information;
• private dispute notes;
• report information;
• and The Chase.

Certain information may be disclosed to a transaction counterparty as described above.

Authorized Platform personnel and service providers may process information when necessary to operate and protect the Platform.

20. Service Providers

The Block currently relies upon third-party providers including:

Lovable Cloud / managed Supabase infrastructure — hosting, authentication, database functionality and file storage.

Lovable AI Gateway / OpenAI — AI-assisted card-image recognition.

Lovable Email Service — transactional communications such as offer and trade notifications.

Google Fonts — website typography; ordinary request information such as IP address and browser user-agent information may be transmitted when fonts are requested.

The technical audit identified these services and the information categories involved.

Providers and infrastructure may change as the Platform develops.

21. Transactional Email

The Block may send operational and transactional communications to your registered email address.

Current examples include:

• account confirmation;
• offer notifications;
• trade notifications;
• and deal alerts.

Transactional messages may include information necessary to identify the relevant activity, such as another user's username, card title or thumbnail, offer information, a message or note, and a link to the transaction.

The current system uses Lovable's email functionality for outbound transaction notifications and Zoho Mail for the Platform support mailbox.

22. Cookies, Local Storage and Tracking

The Block currently uses browser storage and related technologies necessary for authentication and application operation.

The current Platform does not use third-party advertising cookies, advertising networks, Meta Pixel, Google Analytics, TikTok Pixel, Hotjar, Microsoft Clarity, or similar marketing/cross-site tracking technologies.

If these practices materially change, this Policy will be updated and any legally required notice or consent mechanism will be provided.

23. How We Disclose Information

Information may be disclosed:

With other users: where necessary to provide public functionality or fulfill a confirmed transaction.

With service providers: where necessary to host, process, secure, support, communicate, or operate Platform functionality.

For safety and enforcement: where reasonably necessary to investigate fraud, abuse, security incidents, or violations.

For legal reasons: where disclosure is required or permitted by law, court order, subpoena, legal process, or lawful governmental request.

In business transactions: in connection with formation of a successor entity, financing, merger, acquisition, restructuring, sale of assets, bankruptcy, or similar transaction, subject to law.

At your direction or with your consent.

24. We Do Not Sell Personal Information

The Block does not currently sell personal information.

The Block does not currently operate an advertising network or disclose personal information to third-party advertisers for cross-context behavioral advertising.

If these practices materially change, this Policy will be updated and legally required rights, notices, and choices will be provided.

25. Security

The Block uses technical and organizational safeguards designed to protect information.

The verified architecture currently has Row Level Security enabled across all 18 public database tables, including specific restrictions protecting sensitive information.

No website, database, transmission method, storage system, or security measure can be guaranteed completely secure.

Users are responsible for protecting their account credentials.

26. Data Retention

The Block retains information for as long as reasonably necessary for purposes such as:

• account operation;
• Platform functionality;
• transaction history;
• card history;
• fraud prevention;
• security;
• abuse prevention;
• disputes;
• enforcement;
• legal compliance;
• and protection of legal rights.

Different information may be retained for different periods.

The current Platform does not apply one universal automatic expiration period to all records.

27. Account Deletion

Users may initiate account deletion through available account settings.

Deletion may be blocked while an active transaction remains unfinished.

When account deletion is successfully completed, The Block's current system is designed to remove applicable account/profile information, cards, private cost information, shipping addresses, payment handles, authentication records, and associated card photographs.

Certain historical records relating to previously completed transactions may remain for purposes including:

• transaction-history integrity;
• fraud prevention;
• counterparty protection;
• dispute documentation;
• enforcement;
• legal compliance;
• and protection of legal rights.

Where appropriate, identifying profile information may be removed or disconnected from retained historical records.

Deleting an account does not necessarily require deletion of every record associated with prior Platform activity where retention is permitted or required.

28. Third-Party Links and Services

The Block may contain links to independent third-party services, including:

• payment services;
• carriers;
• grading companies;
• marketplaces;
• Whatnot;
• eBay;
• Instagram;
• carrier tracking sites;
• and other external services.

The Block does not control independent third-party privacy practices.

Their own terms and privacy policies apply.

29. Children and Minors

The Block's transaction-capable service is intended for adults legally capable of entering the transactions available through the Platform.

The Block does not knowingly permit children under 13 to create accounts or knowingly collect personal information from children under 13.

The Terms of Service currently require users to be at least 18 years old and legally capable of entering an agreement to create a transaction-capable account or participate in transactions.

If The Block learns that personal information from a child was collected in violation of applicable law, appropriate steps may be taken to delete the information and restrict or terminate the associated account.

30. Your Privacy Rights

Depending upon your location and applicable law, you may have rights concerning personal information maintained about you.

These may include rights to request:

• access;
• correction;
• deletion;
• a copy of certain information;
• information concerning certain processing or disclosures;
• or other rights provided by law.

Rights may be subject to legal exceptions.

The Block may retain certain information where permitted or required for transaction history, fraud prevention, security, legal compliance, disputes, or legal claims.

Identity verification may be required before processing certain requests.

Requests may be submitted to:

[support@on-the-block.com](mailto:support@on-the-block.com)

31. Communication Choices

Some communications are necessary for account or transaction operation.

Users may not be able to opt out of essential communications while continuing to use the related feature.

If optional marketing communications are introduced, applicable legally required choices will be provided.

32. Changes to This Privacy Policy

The Block may update this Privacy Policy as the Platform, technology, service providers, or legal requirements change.

The “Last Updated” date identifies the current version.

Material changes may be communicated through an in-Platform notice, email, account notification, or another reasonable method.

Where applicable law requires consent, required consent will be obtained.

33. Relationship to Other Policies

This Privacy Policy should be read together with:

• The Block Terms of Service;
• The Block Transaction & Trading Rules;
• and any supplemental terms applicable to a specific future feature.

Future auctions, payment processing, integrated shipping, or other materially different services may require additional disclosures or updated terms.

34. Contact

For privacy questions or requests:

The Block Website: on-the-block.com Email: support@on-the-block.com