Blocksmith Privacy Policy

Introduction

Blocksmith is a Chrome extension built by Notable Growth ("we," "our," or "us") that lets you browse and edit Braze Email Templates, Content Blocks, and Catalogs from a side panel next to the page you're working on. This policy explains what data Blocksmith accesses, where it goes, and what it never does. Blocksmith is an independent tool and is not affiliated with, endorsed by, or supported by Braze, Inc.

What Blocksmith Stores On Your Device

Blocksmith uses the Chrome "storage" permission to keep the following locally, on your device only:

• The organizations and workspaces you configure (names and Braze REST endpoints).
• Your Braze API keys, encrypted at rest with AES-256-GCM. The encryption key is derived from a passphrase you choose (PBKDF2); the passphrase itself is never stored.
• A short-lived local cache of fetched Templates, Content Blocks, and Catalogs, so switching between resources doesn't refetch every time.

Unlocking the vault decrypts keys into chrome.storage.session only, which Chrome clears automatically when the browser session ends. Nothing in this storage is synced to a Google account or sent anywhere by Blocksmith itself.

How Blocksmith Talks To Braze

You supply your own scoped Braze REST API key per workspace. Blocksmith never asks for your Braze login. Reads (listing and viewing Templates, Content Blocks, and Catalogs) always go straight from the extension's background service worker to Braze; no Notable Growth server sees them.

A small number of write calls are rejected by Braze when they look browser-originated. For those specific calls only, Blocksmith relays the request through a Cloudflare Worker proxy we operate so the request presents as server-originated. That proxy keeps no database and never logs or stores the API key, the Braze path being called, or the request or response body. It only accepts requests for the small allowlist of Braze endpoints the extension itself is restricted to, and it is locked to Blocksmith's own extension origin.

The proxy runs on Cloudflare's standard Workers observability, which records metadata about each invocation, such as timestamp, status code, execution time, and client IP, in our Cloudflare dashboard for a limited retention window. This platform-level logging does not include the API key, path, or body described above.

What Blocksmith Does Not Do

To be direct about the limits of what we collect, Blocksmith does not:

• Collect analytics, telemetry, or usage data.
• Send your Braze API key, organization or workspace names, or fetched source to any server other than Braze itself (and, only for the specific write calls described above, our proxy).
• Render fetched Braze source as executable HTML or execute Liquid. Source is always displayed as inert text.
• Request or store your Braze account login.

Contact Us

If you have questions about this Privacy Policy or how Blocksmith handles data, please contact us.