BLOKSPrivacy Policy
What we collect, why we collect it, who touches it, how long we keep it, and how you get it back or get it wiped. Plain language, no fine-print games.
LAST UPDATED: OCTOBER 6, 2026
1. Introduction
Bloks ("Bloks," "we," "us," or "our") operates the Bloks focus and productivity application and website at trybloks.com (the "Service"). This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over your data.
Bloks is a focus app: you run timed focus sessions ("Bloks"), earn ranks and streaks, and can receive accountability check-ins by push notification and WhatsApp. Delivering those features requires us to process certain personal data, described below.
The data controller responsible for your personal data is the operator of Bloks, reachable at the contact details in Section 12.
If you do not agree with this policy, please do not use the Service.
2. Information We Collect
2.1 INFORMATION YOU PROVIDE DIRECTLY
| Data | When we collect it | Why |
|---|---|---|
| Email address | Account registration / login | Authenticate you, secure your account, send service and (with consent) product emails |
| Name / callsign | Registration, profile setup | Personalize the app and your accountability messages |
| Password | Registration | Secure your account. Passwords are hashed by our authentication provider; we never see them in plain text |
| Phone number (WhatsApp) | When you link WhatsApp (Trooper plan only) by sending a one-time code from your phone | To recognise your messages, run the commands you send, let the Sergeant reply, and send the reminders you opt into. The app only ever shows its last 4 digits |
| WhatsApp messages | When you message the Bloks number on WhatsApp | To run your commands (e.g. start a focus session, log a habit) and let the AI coach reply. See the WhatsApp note in Section 2.3 |
| Onboarding & preference data | Basic Training onboarding and settings | Your goals, focus objectives, and the accountability intensity level you choose, so we can tailor the experience |
| Focus & gamification data | As you use the app | The Bloks you run, their objectives/labels, timestamps, completions, streaks, XP, ranks, and missions |
| Push notification token | When you enable push notifications | To deliver push notifications to your device |
| Support / contact messages | When you contact us | To respond to and resolve your request |
| Payment & billing information | If/when you purchase a paid plan | Processed by Paddle, which acts as the Merchant of Record for our sales. We do not collect or store your card number |
2.2 INFORMATION COLLECTED AUTOMATICALLY
- Device & technical data — IP address, browser type, operating system, device identifiers, language, and time zone.
- Usage data — pages/screens viewed, features used, actions taken, session duration, and referring URLs.
- Diagnostic data — crash reports, error logs, and performance data.
- Cookies and similar technologies — see Section 2.4.
2.3 INFORMATION SHARED WITH THIRD PARTIES
To run Bloks we rely on the service providers below. Each processes only the data needed for its function, under a data processing agreement.
| Provider | Function | Data involved |
|---|---|---|
| Supabase | Hosting, database, authentication | Account data, profile, focus/gamification data |
| Paddle (Merchant of Record) | Payment processing, billing, sales tax/VAT, fraud prevention | Billing details and payment information (card numbers are handled by Paddle — Bloks never sees them) |
| OpenAI | Generating accountability & drill-sergeant messages, judging Boss unlock requests, and the WhatsApp coach | Your name/callsign, goals, focus objectives and progress context. For the WhatsApp coach: the message you sent, the last few messages of the conversation, today's schedule (block names and times), habit names, and your level, XP and streak |
| Meta Platforms (WhatsApp Business Platform) | Receiving your WhatsApp messages and delivering replies, reminders and help-line contact cards | Your phone number, the messages you send to Bloks, and the messages we send you |
| Google Analytics | Product & traffic analytics | Usage and device data |
| PostHog | Product analytics | Usage events, device data |
| Sentry | Error & crash monitoring | Diagnostic data, which may include limited request context |
| Other service providers | Infrastructure, email delivery, CDN and similar operational needs | As reasonably required to operate the Service |
Push notifications are delivered by us directly to your device through your browser or operating system's native push service; we do not use a third-party push vendor.
AI note. To generate personalized accountability messages, we send relevant context (such as your callsign, goals, and progress) to OpenAI. Under OpenAI's API data-usage policy, data sent to the OpenAI API is not used to train or improve OpenAI's models unless you explicitly opt in. OpenAI retains API inputs and outputs for up to 30 days for abuse and misuse monitoring, after which they are deleted — unless longer retention is required by law or is reasonably necessary to protect its services. We send the model only the data needed to compose your message.
WhatsApp note. WhatsApp is available on the Trooper plan. You link your number yourself by sending a one-time code from your phone, and you can unlink it any time in Settings or by texting UNLINK. Commands you send (like NEXT or FOCUS) are handled by our own code. Other messages go to the AI coach (OpenAI), which sees only the context listed above, never your email address or phone number. The coach can only suggest an action; nothing runs until you reply YES.
If you're in trouble. If a message suggests you may be in danger, the Sergeant replies even if your number isn't linked or your plan has lapsed, and gives you emergency and crisis-line numbers for your country, chosen from your phone number's country code. These replies are never counted against your plan. Bloks does not contact anyone on your behalf and does not pass these conversations to emergency services or anyone else. Anything you tell the coach about your health or safety is used only to reply to you and is kept no longer than the rest of the conversation (Section 5).
Paddle note. Paddle acts as the Merchant of Record, meaning Paddle is the seller for your purchase and an independent data controller for payment, tax, and fraud-prevention purposes. Paddle's handling of your payment data is governed by Paddle's own privacy policy.
2.4 COOKIES AND SIMILAR TECHNOLOGIES
| Cookie type | Purpose | Examples | Duration |
|---|---|---|---|
| Essential | Login sessions, security, core functionality | Supabase auth/session tokens | Session / until logout |
| Analytics | Understand usage and improve the app | Google Analytics, PostHog | Up to 24 months |
| Preference | Remember settings (e.g. theme, intensity) | Local storage | Until cleared |
| Marketing | None currently | — | — |
We do not currently use advertising or cross-site tracking cookies. If that changes, we will update this policy and our consent banner.
3. How We Use Your Information
- Provide the Service — run your focus sessions, track streaks/ranks/XP, and deliver missions.
- Send accountability messages — push and WhatsApp check-ins at the intensity you set.
- Generate personalized messages — via our AI provider (see 2.3).
- Run WhatsApp commands and the coach — for Troopers who link WhatsApp.
- Point you to emergency help — if a message suggests you may be in danger, we reply with help-line numbers for your country.
- Authenticate and secure — protect accounts and prevent fraud and abuse.
- Process payments — for paid plans, via our payment processor.
- Communicate with you — service notices, and (with consent) product updates.
- Improve the Service — analyze usage and diagnose errors.
- Comply with legal obligations — tax, accounting, and lawful requests.
LEGAL BASIS FOR PROCESSING (GDPR)
| Purpose | Legal basis |
|---|---|
| Providing the Service and your account | Contractual necessity |
| WhatsApp / push accountability messages | Consent (you opt in and set intensity) |
| AI-generated message personalization | Contractual necessity / Consent |
| WhatsApp commands and the AI coach | Contractual necessity (Trooper feature you choose to link) |
| Health or safety information you choose to share with the coach, and help-line replies | Your explicit consent by sending it (GDPR Art. 9(2)(a)); vital interests where someone may be in danger (Art. 6(1)(d), 9(2)(c)) |
| Payment processing | Contractual necessity; Legal obligation (records) |
| Analytics and product improvement | Legitimate interest (or Consent where required by ePrivacy) |
| Security and fraud prevention | Legitimate interest; Legal obligation |
| Marketing emails | Consent |
4. How We Share Your Information
We share personal data only as described here.
- Service providers — the providers listed in Section 2.3. Most act as processors on our instructions; Paddle acts as Merchant of Record and independent controller for payments.
- Legal requirements — where required by law, subpoena, court order, or valid government request.
- Business transfers — in a merger, acquisition, or sale of assets, your data may transfer to the successor entity, subject to this policy.
- With your direction — where you ask us to share (e.g. enabling an integration).
We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA.
5. Data Retention
| Data type | Retention period | Reason |
|---|---|---|
| Account & profile data | For the life of your account; deleted within 30 days of account closure | Service provision |
| Focus / gamification data | For the life of your account; deleted with your account | Core functionality |
| WhatsApp link & phone number | Until you unlink (in Settings or by texting UNLINK) or delete your account | Running the WhatsApp features you linked |
| WhatsApp link codes | 10 minutes, stored only as a one-way hash | Proving the number is yours |
| WhatsApp coach conversation | 7 days, and at most your 20 latest messages; deleted at once when you unlink | Context for the coach's next reply |
| WhatsApp message IDs (no content) | 30 days | Ignoring duplicate deliveries |
| WhatsApp monthly message count | 13 months | Applying your plan's monthly allowance |
| Message logs | 12 months | Support, abuse prevention |
| Payment / transaction records | 7 years | Legal/tax obligations |
| Analytics data | Google Analytics: 14 months. PostHog: per plan (1 year free, up to 7 years paid) | Product improvement |
| Error / diagnostic logs | 90 days | Security and debugging |
| Backups | Deleted on a rolling 30-day cycle | Disaster recovery |
6. Data Security
We use appropriate technical and organizational measures to protect your data, including:
- Encryption in transit (HTTPS/TLS)
- Encryption at rest for stored data
- Access controls and authentication
- Hashing of passwords (we never store plain-text passwords)
- Regular review of security practices
Payment information is processed by Paddle under PCI-DSS standards; we do not collect or store your card number. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
7. Your Rights Under GDPR (EEA/UK Residents)
You have the right to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict processing; data portability; object to processing based on legitimate interests; withdraw consent at any time (including push and marketing messages; on WhatsApp, text STOP to pause reminders or UNLINK to disconnect your number); and lodge a complaint with your local Data Protection Authority.
To exercise these rights, contact us at privacy@trybloks.com or through our contact page. We respond within 30 days.
8. Your Rights Under CCPA/CPRA (California Residents)
You have the right to: know what personal information we collect and how it is used; delete your personal information; correct inaccurate information; opt out of sale/sharing (note: we do not sell or share as defined by the CCPA); limit use of sensitive personal information; and non-discrimination for exercising your rights.
CATEGORIES COLLECTED (PAST 12 MONTHS)
- Identifiers — name, email, phone number, IP address, account/device identifiers
- Customer records — billing details (via payment processor)
- Commercial information — subscription/plan data
- Internet or network activity — usage, analytics, and interaction data
- Geolocation — approximate location derived from IP
- Other — content you create (focus objectives, messages) and preferences
- Sensitive information you volunteer — health or safety details you choose to tell the WhatsApp coach, used only to reply to you
To exercise these rights, contact us at privacy@trybloks.com.
9. Children's Privacy
The Service is not intended for children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us data, contact privacy@trybloks.com and we will delete it.
10. International Data Transfers
Your data may be processed in countries other than your own, including the United States, where several of our providers (Supabase, OpenAI, Google, Meta) operate, and other countries where Paddle operates. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs), applicable adequacy decisions, and Data Processing Agreements with our providers.
11. Changes to This Privacy Policy
We may update this policy from time to time. We will post the updated version here, revise the "Last Updated" date, and, for material changes, notify you by email or in-app. Continued use after changes take effect constitutes acceptance.
12. Contact Information
- Email: privacy@trybloks.com
- Or send a transmission from our contact page.
EEA/UK users may also complain to their local Data Protection Authority.