Privacy policy
Last updated 17 October 2026
The short version. Blocky never holds your money or your keys. To run the app we keep your sign-in ID, your wallet address and the things you set up in Blocky, like contacts, pots and limits. Your chat stays on your phone: messages go to our AI provider to get an answer, and our server doesn't save them. Everything on a blockchain is public, as with any wallet. We don't sell data, show ads or use trackers. You can delete your account in the app at any time.
This policy covers the Blocky app and this website, including the waitlist. For a plain-language tour of who sees what and what Blocky's AI can and can't do, see Privacy & safety.
Who we are
Blocky is run by Oliver Matula, Czech Republic, who is the data controller for the personal data described here. Contact: [email protected].
What the app collects
- Your account: the sign-in ID from Privy, our wallet provider, your wallet address, and the @username you choose. Your email (or Google, Apple or passkey sign-in) is held by Privy, not by Blocky's server.
- Your settings: spending limits, the tokens Blocky may spend, and the addresses you've paid before.
- Your payments: every payment card Blocky proposed (amounts, recipient, fees and a one-line description), whether you approved it, and the transaction it became.
- Your people: contacts you saved, people you blocked, and payment requests with their notes.
- Notes: short notes the assistant saves to remember how you like things done. You can ask Blocky what it remembers and tell it to forget any of them.
- Money features: pots and auto-save rules, budgets, price alerts, notifications, tokens you bought by address, and balance snapshots for your portfolio chart.
- Activity: money in and out of your wallet on Arc, read from the public blockchain to show your history and tell you when you're paid.
- Notifications on your phone: if you turn them on, a push token for each phone, so notifications reach it. It's removed when you sign out on that phone.
- Technical data: like any server, ours sees your IP address and the time of each request. We keep request counts in memory to stop abuse, and our hosting provider keeps short-lived technical logs. If the app breaks, it sends us the error, where it happened and the app version, with nothing that identifies you, so we can fix it.
What the app doesn't collect
Blocky never has your private key or a password; you sign in with a code, Google, Apple or a passkey. Our server doesn't save the text of your chat with Blocky: it lives on your phone, and recent messages are passed to our AI provider to get an answer. We don't use analytics, advertising IDs, trackers or data brokers, and we don't read your phone's contacts, photos or location.
The blockchain is public
Payments in Blocky are made on public blockchains. Your wallet address, its balances and every transaction are visible to anyone and cannot be changed or deleted by us or anyone else. They aren't linked to your name or email on the blockchain itself, but someone who knows your address can see its history. Keep that in mind when sharing your address or @username.
What the website and waitlist collect
If you join the waitlist we store your email address, which form you used, and when you signed up, so we can invite you. To stop fake signups, the server keeps the IP address of each attempt in memory for up to an hour, never in a database. The website sets no cookies and has no analytics. The key export page (blocky.page/export) loads Privy so you can export your key securely; Privy stores a sign-in session in your browser while you use it.
Why, and on what legal basis
- To provide the app you asked for: building and checking payments, keeping your history, contacts, pots and limits, and answering you in the chat. Legal basis: performing our contract with you (Article 6(1)(b) GDPR).
- To keep Blocky safe: rate limits, abuse prevention, and warning you about look-alike or risky addresses. Legal basis: our legitimate interest in a safe service (Article 6(1)(f)).
- The waitlist: to tell you when Blocky opens to you. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time.
Blocky's assistant suggests payments; it never makes decisions about you with legal or similarly significant effects. Every payment waits for your own approval.
Who else handles it
We use these providers, each only for its job:
- Privy (Privy Inc., a Stripe company, USA): sign-in and the secure wallet. Sees your sign-in details and wallet.
- Anthropic (USA): the AI behind Blocky's assistant. Receives your message, your recent chat, and what the assistant looks up to answer (balances, contacts, activity, notes). Under Anthropic's commercial terms it does not train its models on this data by default.
- Railway (USA): hosts Blocky's server, database and this website.
- Blockchain, price and routing services such as Circle, Across, Gas.zip, Uniswap, CoinGecko, DefiLlama and our blockchain network providers: they receive wallet addresses and amounts, never your name or email, to fetch prices and balances and to prepare and route payments.
- Expo (650 Industries, USA), Google (Firebase Cloud Messaging) and Apple (Push Notification service), only if you turn notifications on: they deliver notifications to your phone, so they receive each notification’s text, like “@sam sent you $20.00”, and a token for your phone.
- Google (Gmail): for emails you send us and waitlist invites.
Some of these providers process data outside the European Economic Area. Where they do, the transfer is protected by the safeguards GDPR requires, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. We never sell personal data or share it with advertisers.
How long we keep it
App data is kept while you have an account. When you delete your account (Account → Delete account, or blocky.page/delete-account), everything Blocky's server holds about you is deleted from our database straight away, and your Privy sign-in is deleted too. Your chat stays on your phone until you delete it there or remove the app. Waitlist emails are deleted after your invite unless you become a user, and never kept more than 24 months. Records on the blockchain can't be deleted by anyone.
Your rights
Under the GDPR you can ask us to tell you what we hold and give you a copy (access and portability), correct it, delete it, or limit or object to how we use it, and you can withdraw consent at any time. Most of this you can do in the app; for the rest, email [email protected]. It's free, and we'll answer within one month. You can also complain to a data protection authority; in the Czech Republic that is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), uoou.gov.cz.
Security
Your key is secured by Privy and never reaches Blocky's server. Connections are encrypted, access to our systems is limited, and every payment needs your fingerprint or face on your own phone. No system is perfectly secure; if a breach affecting your data happens, we'll tell you and the authority as the law requires.
Age
Blocky is for people aged 18 and over.
Changes
If we change this policy we'll update the date at the top, and tell you in the app or by email before a change that affects how we use your data takes effect.
Contact
For anything about your data, email [email protected]. See also the Terms of use.
Data controller: Oliver Matula, Czech Republic.