Privacy Policy

• Account: email address, username, display name, and a securely hashed password (we never store your password in plain text).
• Profile: optional bio, avatar, preferred language, and QR theme.
• Phone number (optional): if you choose to verify your phone for a Trust Score boost or turn on SMS two-factor sign-in, we store your number and verification status. Verification codes are delivered by Twilio; we never share your number with other users.
• Wallets: public blockchain addresses you choose to link, proven via a signature. We never receive or store your private keys or seed phrase, and we cannot move your funds.
• Payments: when you buy BLOQ+ / BLOQ Pro, join a paid BLOQ, buy a ticket, boost or sticker pack, Stripe processes the payment. We receive the transaction outcome, amount, and a payment reference — never your full card number.
• AI Assistant: questions you type to the BLOQ Assistant, and its answers, are stored to keep the thread across your devices. You can wipe this history at any time from the Assistant screen.
• Support & feedback: messages and any attachments you send us.

• Direct messages, Circles and BLOQs are protected with E2E Quantum Encryption ("Cipher Lock"). Message content is encrypted on your device and stored only as ciphertext — we cannot read it.
• Metadata strictly required to deliver messages (such as sender, recipient, and timestamps) is processed to route conversations.
• Safety review: if someone in a conversation reports a message, or AI Scam Shield flags it, our safety team may view that message and the surrounding context (a few hours either side) in spaces that are not Cipher Lock–encrypted, such as channels and public BLOQs. Cipher Lock content is never readable by us, even in a report. Every such access requires an open report or flag, step-up authentication by the reviewer, and is written to an audit log.

• Calls and Rooms are carried by Stream (getstream.io) over encrypted transport (DTLS-SRTP). Live audio and video are relayed in real time and are not recorded by us unless a host starts a Room recording — recordings show a visible indicator to everyone present.
• Room recordings are stored in Cloudflare R2 and follow the retention rules below. Call logs (who, when, how long) are kept for your call history and for abuse prevention.

• Usage & device data: app version, device type, coarse activity needed for reliability, security, and abuse prevention.
• IP address & approximate location: used for security (new-device alerts, fraud checks, sign-in history) and to shape features like language defaults. We do not track precise GPS location.
• Trust signals: events used to compute your BLOQ Score and to power AI Scam Shield (e.g., flagged links, report outcomes).

• To provide and secure the service, authenticate you, and sync your chats and Circles.
• To detect fraud, scams, spam, and abuse (AI Scam Shield) and to enforce our Terms.
• To compute your BLOQ Score and Trust Passport.
• To send transactional emails (e.g., verification, security, receipts) and, if you opt in, product updates.
• To provide optional AI features you invoke, such as translation, chat summaries, smart replies, and the BLOQ Assistant.

• Translation, summaries, smart replies, and the BLOQ Assistant are powered by OpenAI models. Only the text you explicitly submit (or ask to translate) is sent, for the duration of the request. Message text used for smart replies or summaries is processed in memory and is not stored by us.
• AI Assistant history is stored by us so the thread follows you across devices; delete it any time with the trash icon on the Assistant screen ("Clear conversation"). Per our provider agreements, your text is not used to train their models.
• AI outputs can be wrong. Never treat them as financial, legal, or security advice.

• We share limited data with vetted providers only to run features you use:
• • Stripe — payment processing for subscriptions, paid BLOQ memberships, tickets, boosts, sticker packs, and creator payouts (we never store full card numbers).
• • Twilio — SMS delivery for optional phone verification and two-factor sign-in codes.
• • Resend — delivery of transactional emails.
• • Stream (getstream.io) — real-time voice, video, and Rooms.
• • Cloudflare — R2 storage of Room recordings and media; Turnstile bot protection on sign-up and sensitive actions.
• • OpenAI — text you submit for translation, summaries, smart replies, or the Assistant, processed transiently.
• • Alchemy — reading public blockchain data (token / NFT holdings) to verify token-gated access.
• • WalletConnect / Reown — the wallet-linking handshake between BLOQ Talk and your wallet app (e.g., Qastle).
• • Giphy — GIF search inside chats (your search terms are sent to Giphy).
• • CoinGecko — public token price data shown in the wallet.
• • IP geolocation services (ip-api / ipwho.is) — mapping an IP to a country/city for security review; no precise location.
• These providers process data under their own terms and only as needed to deliver the feature.

• Linking a wallet reads public, on-chain information (such as token/NFT holdings) to verify access to token-gated Circles.
• Blockchain transactions are public and permanent by nature and are outside our control. We are non-custodial and never hold your assets.

• We do not sell your personal information.
• We may disclose information to comply with law, respond to lawful requests, protect users, or enforce our Terms.
• If we undergo a business transfer, information may be transferred subject to this policy.

• We keep account information while your account is active. Encrypted message content persists only as long as needed to deliver and sync it, subject to your settings.
• Free-tier Room recordings are retained for a limited window (currently 7 days); BLOQ Pro extends retention. You can delete recordings you control.
• AI Assistant history is kept until you clear it or delete your account. Phone verification events and sign-in history are kept for a rolling 30 days for security review.

• You can edit your profile, unlink wallets, turn SMS two-factor sign-in off, clear AI Assistant history, and delete recordings at any time.
• You can delete your account from Profile → Delete account, or request deletion by contacting us.
• Depending on where you live, you may have rights to access, correct, export, or delete your data.

We use E2E Quantum Encryption for messages, hashed passwords, admin multi-factor authentication, rate limiting, and continuous security testing. No system is perfectly secure, but we work hard to protect your data.

BLOQ Talk is not directed to children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect data from children.

• Your information may be processed in countries other than yours. We take steps to protect it consistent with this policy.
• We may update this policy; we will revise the effective date above and, for material changes, notify you in-app.

Questions or requests: support@bloqtalk.app. Postal: Krown Technologies Inc., 300 Washington Street, Monroe, LA 71201, USA.