COOLBLOX Privacy Policy

How we collect, use, and protect your information.

I. The Information We Collect

At COOLBLOX, the only personally identifiable information we collect is a valid e-mail address, IP-address and useragent for sessions. We do not share this information with anybody else. Your e-mail address and the IP addresses in our logs are stored encrypted at rest (see Section VI), and private messages are encrypted too (see Section IV).

II. How We Use the Information

We use visitors' personal information only for our internal purposes of enabling visitors to log in to our site, to reset passwords, or to inform users of upcoming events and special announcements. We will not use or transfer personally identifiable information in ways that are materially different from the ones described above without also providing parental notification of such practices and obtaining consent for any materially different uses.

III. Cookies

COOLBLOX uses a software technology called "cookies." Cookies are small text files that we place in visitors' computer browsers to store their preferences. Cookies themselves do not contain any personally identifiable information.

IV. How Your Messages Are Encrypted

Every private message is encrypted before it is stored. By default a message is encrypted with our own application key, which means it is unreadable in a database dump but still readable by us — this is "encryption at rest", not end-to-end encryption, and it behaves like a normal inbox. End-to-end encryption is OFF by default. It is an optional feature you can turn on yourself from Settings → Danger zone by setting an inbox passphrase. When you do, your browser generates an encryption keypair and messages are sealed so that only you — and the people you message who have also turned it on — can read them. We cannot read end-to-end encrypted messages. Your passphrase and private key never leave your device; we only keep your public key and a copy of your private key that is locked with your passphrase and that we cannot open. You can disable it again later (keeping your keys) or reset it entirely from the same screen. Enabling end-to-end encryption is potentially dangerous and is not recommended for most users. Because we genuinely cannot read or recover your encrypted messages, we also cannot help you if something goes wrong inside them: if you are scammed, tricked into revealing your password, or harassed in an encrypted conversation, we cannot read that conversation to act on it or recover what was said. If you forget your passphrase and lose your recovery codes, those messages are gone forever. Only turn it on if you understand and accept that you are trading away our ability to help you. Quirks to be aware of: end-to-end encryption only applies between two people who have both enabled it; messages involving someone who hasn't (or whose encryption is disabled), and site-wide broadcasts, are encrypted at rest with our key but are not end-to-end encrypted. If you forget your passphrase you can recover access with a one-time recovery code (shown once when you enable encryption); if you lose both your passphrase and every recovery code, those messages are unrecoverable by design. Because the encryption runs in your browser using code we deliver, end-to-end encryption protects against database exposure and passive access — not against a compromised server build.

V. How Moderation Works

Messages that are not end-to-end encrypted (the default) are encrypted at rest with our key, so our staff can read and moderate them directly when needed — just like a normal inbox. We cannot read your end-to-end encrypted messages. The only way a moderator can read one is if you — the recipient — choose to report it. Reporting re-encrypts just that single message to the moderation key and discloses it for review; no standing key lets us open any other message, and nothing is readable before a report. This is why encryption can leave you without help if you are scammed in an encrypted chat and do not report it. Reported messages are cryptographically bound to their original sender ("message franking"), so a report is provably the genuine content that was sent. The moderation private key is held by moderators out of band and is never stored on our servers.

VI. How We Store Your Email, IPs and Logs

Your e-mail address is stored encrypted with our application key. To let you log in and to enforce one account per address, we also keep a one-way keyed fingerprint (hash) of it — that fingerprint cannot be reversed back into your address. IP addresses and other sensitive values written to our logs are likewise encrypted at rest and are only decrypted for legitimate administrative review inside the admin panel.

VII. Contact Us

If you have any questions, comments, or concerns regarding our privacy policy and/or practices, please contact us at the following discord server: https://discord.gg/coolblox