Who sees what, and what the AI can’t do.
Last updated 17 October 2026
The short version. Blocky never holds your money or your keys, and nothing moves until you approve it with your fingerprint or face. The AI proposes; you decide. Your chat lives on your phone. Everything onchain is public, as with any crypto wallet.
Your money
Blocky is non-custodial. Your wallet is created on your phone through Privy, our wallet provider. Privy secures the key, and neither Blocky’s server nor its AI ever has it. You can export your private key at any time (Account → Export private key) and take your wallet to another app.
- Every move needs you. Blocky prepares a payment, your phone shows you exactly what it does, and nothing happens until you confirm with your fingerprint or face.
- No server-side signing. There is no key on our server that can move your money. Spending limits are checked by our server before a card is shown. They aren’t yet enforced by your wallet onchain.
- What the card shows is what gets signed. Fixed, ordinary code builds the payment behind a card from live prices and chain data, and our server checks it byte for byte before your phone will sign it. The AI never writes a transaction.
Who sees what
| Who | What they see, and why |
|---|---|
| Blocky’s server | Your wallet address, username, the payments you make and the records listed below, so it can build cards, check limits and keep your history. |
| Anthropic (Claude) | Each message you send the assistant, your last 20 or so chat messages, and what its tools look up to answer you: balances, contacts, activity, saved notes. See Anthropic’s terms. |
| Privy | Your email (or Google, Apple or passkey sign-in) and your wallet, to sign you in and secure your key. |
| Price, route and network services | Your wallet address and the amounts involved, never your name or email: Circle, Across, Gas.zip, Uniswap, CoinGecko, DefiLlama and others, for quotes, transfers, prices and balances. |
| Expo, and Google or Apple | Only if you turn notifications on: the text of each notification, like “@sam sent you $20.00”, and a token for your phone, to deliver it. |
| Other Blocky users | Your @username, and your wallet address when you pay them or request money from them. |
| Everyone | Everything on the blockchain: your address, balances and transactions. That’s how public blockchains work. |
Blocky has no ads, no analytics trackers and no data brokers, and doesn’t sell data.
What’s stored where
On your phone: your chat with Blocky (“reset chat” deletes it) and your light or dark mode setting.
On Blocky’s server:
- Account: your sign-in ID from Privy, your wallet address and @username. Your email isn’t stored here; Privy holds it.
- Settings: spending limits, the tokens Blocky may spend, and the addresses you’ve paid before.
- Payments: every card Blocky proposed (amounts, recipient, fees and the assistant’s one-line description), whether you approved it, and the transaction hash.
- Your people: contacts you saved, people you blocked, and payment requests with their notes.
- Notes: short notes the assistant saved to remember how you like things done. Ask Blocky what it remembers, and tell it to forget any of them.
- Money features: pots and auto-save rules, budgets, price alerts, notifications (and a token for each phone that gets them, removed when you sign out there), tokens you bought by address, and balance snapshots for your portfolio chart.
- Activity: money in and out of your wallet on Arc, read from the public blockchain for your history.
Not stored anywhere by Blocky: the text of your chat messages, your private key, or a password (you sign in with a code or passkey). Server logs record what each AI reply cost, not what you said.
What the AI can and can’t do
It can
- Read your balances, activity, contacts, pots, requests, budgets and settings to answer questions.
- Propose a payment as a card for you to review: send, buy, sell or move money.
- Organise things that don’t move money: contacts, pots, budgets, alerts, requests.
- Lower your spending limits when you ask.
- Look up prices and search the web for news.
- Save short notes about you, and forget them when asked.
It can’t
- Sign, send or approve anything. Every payment waits for your fingerprint.
- Spend past your limits, or raise them.
- Use an address you didn’t give it. A raw address must be one you typed or pasted yourself. Otherwise it must be a saved contact, an @username or an ENS name you typed. Addresses from web pages, past transfers or its own memory are refused, and saving a contact follows the same rule.
- Act on a web search. A reply that searched the web can’t propose a payment, because web pages are written by strangers.
- Change what a card does. It says what you want; fixed code works out how.
Address safety
Most crypto scams don’t break anything. They get you to send money to the wrong address. Besides only accepting addresses that came from you, Blocky watches for address poisoning. Scammers create an address that starts and ends like one you know, then send you a tiny amount so the fake sits in your history, waiting to be copied.
When a payment goes to an address that matches the start and end of a contact, someone you’ve paid, or your own wallet, but isn’t it, Blocky stops you with a red warning. The card shows both addresses in full, with every character that differs underlined in red. A red warning always means the full review and your fingerprint, whatever your limits.
New recipients, contracts, unverified tokens, tokens that may be hard to sell, big price impact and money set aside in pots all get their own warnings too.
Anthropic’s terms
Blocky’s assistant is Claude, made by Anthropic, used through Anthropic’s commercial API. Under Anthropic’s Commercial Terms, Anthropic doesn’t train its models on what’s sent through the API by default. Anthropic keeps API data for a limited time for safety and abuse monitoring; the details are in its Privacy Center. Anthropic never receives your email or your keys.
Not done yet
- Spending limits are enforced by our server, not yet by your wallet onchain.
To delete your account and everything our server holds about you, see blocky.page/delete-account.
Questions or a problem? Email [email protected]. The formal Privacy policy and Terms of use cover the app and this site.