What stays on your machine
- Conversations and transcripts. Stored in
~/.blokson your computer. Never sent to us. - API keys and secrets. Stored in a file only your user account can read, with file permissions to match. Never sent to us, and never echoed back to any interface once saved; even the settings screen only ever says whether a key exists.
- Agent memory and working files. Plain files on your disk, readable, editable and deletable by you.
- Voice. Calls are recognized on the device you speak into; replies are synthesized through the voice vendor you configured, with your key.
Deleting ~/.bloks removes everything Bloks knows. That is the design, not a limitation.
What reaches third parties, at your direction
- AI providers. When an agent takes a turn, the message and relevant context go to the provider you configured, using your credentials, directly. Their privacy policies govern that data. We are not in that path and cannot read it.
- Connected services. Apps you connect, whether through connector cards, your own MCP servers, or an API key you saved, are used by your agents under the access you granted, and those services’ policies apply.
What reaches us
- The waitlist email, if you give one. One address and a timestamp, stored so we can tell you when Bloks Cloud launches, used for nothing else, never shared or sold. Email privacy@bloks.dev and it is deleted.
- Ordinary server logs. This site is served by Cloudflare, which processes IP addresses and request metadata to deliver pages, as every host does. We run no analytics and set no tracking cookies; the waitlist form is the only thing on this site that transmits anything, and only when you submit it.
- Relay traffic, when you use it. Pairing your phone on your own network never touches us. If you use the relay to reach your Mac across the internet, the relay forwards traffic between your devices and keeps only the operational logs needed to run it. It exists to deliver bytes, not to read them.
- Payments, later. When paid tiers launch, billing will run through a payment processor. They handle the card; we see subscription status, never card numbers. This page will name the processor before that ships.
What we do not do
- No analytics or tracking scripts, on this site or in the app.
- No advertising, no data brokers, no sale of personal data, ever.
- No account required to download or use the desktop app.
- No telemetry in the desktop app that sends your content anywhere.
Retention
Data on your machine is yours and follows your own retention, which is to say: it stays until you delete it. The waitlist email stays until Bloks Cloud launches or you ask for deletion, whichever comes first. Host and relay logs rotate on the short schedules typical of operations, measured in days and weeks, not years.
Security
The config file that holds keys is created with owner‑only permissions. The webhook receiver and the pairing system use long random tokens, compared in constant time, revocable individually. The harness answers only your own origin. Security reports go to security@bloks.dev and are read the same day.
Your rights
Depending on where you live, including under the GDPR and the CCPA, you may have the right to access, correct, delete, export or restrict the personal data we hold about you, and to complain to your local authority. Since the only personal data we typically hold is a waitlist email, exercising these rights is usually one message to privacy@bloks.dev, answered within thirty days. We do not discriminate against anyone for exercising them.
Children
Bloks is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has given us data, write to us and it will be removed.
Changes
If a future feature changes what reaches us, this page will say so before the feature ships, with an updated date at the top. A privacy policy that changes quietly is not one.