BlockBuddy

BlockBuddy — Privacy Policy

Effective date: 2026-05-22 Last updated: 2026-05-22

BlockBuddy is an educational app that teaches you about cryptocurrency in plain English. This policy explains what data we collect, why, and what your rights are. It is written to be honest and short — not full of legalese.

Who runs BlockBuddy

BlockBuddy is operated by Rizgar, based in Sweden. You can reach us at nozadt15@gmail.com.

What we collect

Only the data the app actually needs to work. We do not sell your data, and we do not use it for advertising or tracking.

Data	Why we collect it	Where it goes
Email address	To create and sign you into your account.	Stored by Firebase Authentication (Google Cloud).
Name	Optional. If you use Sign in with Apple and choose to share your name, we use it to personalize the app.	Stored by Firebase Authentication.
User ID	An anonymous identifier (a random string) we use to keep your progress tied to your account.	Stored by Firebase Authentication and Firestore.
App usage events	Things like “completed a lesson”, “started a quiz”, “used AI Explain”. Used to understand which features people use and improve them.	Sent to Firebase Analytics only if you turn analytics on. Analytics is off by default, so in the current version no usage events are collected.
Learning progress	Your XP, streak, completed lessons, badges, and skill graph.	Stored in your private Firestore document.
Text you submit to “Explain this”	To produce a plain-English explanation of a wallet message.	Sent to our backend and to an AI provider — see “How ‘Explain this’ works” below.

We do not collect:

• GPS or precise location. (Our providers do see your IP address, which implies an approximate region — this is inherent to using the internet and is used for rate limiting and abuse prevention.)
• Contacts, microphone, or camera
• Your photo library. The screenshot scanner reads text on your device; the image itself is never uploaded or stored.
• Financial account information
• Cryptocurrency wallet addresses, balances, or transactions collected from a wallet (BlockBuddy is educational only — it is not a wallet and never connects to one). Note that if you paste a message containing an address, that text is processed as described below.

Crash reporting is described in the app’s settings but is not active in the current version — no crash data is collected.

How “Explain this” works

This is the one feature that sends your text off the device, so we want to be precise about it.

When you paste text — or scan a screenshot — into the AI Explain tool:

1. If you scan a screenshot, the image never leaves your device. Text is extracted on-device using Apple’s Vision framework, and only that extracted text continues.
2. The text is sent to our backend (a Cloudflare Worker). It is not sent with your account identifier — your BlockBuddy account is not attached to the text.
3. Our backend forwards the text to a third-party AI provider — OpenAI, or Anthropic if OpenAI is unavailable — which generates the explanation.
4. The generated explanation is cached on our backend for about one hour, keyed on the text itself, so that an identical request does not need to be re-processed.
5. To count your daily free explanations and prevent abuse, our backend keeps a small counter keyed on a short, one-way hash derived from your network connection (not your account). It is kept for roughly two days and then expires.

Please do not paste your recovery phrase, seed words, or private keys. No legitimate service — including BlockBuddy — ever needs them.

If our backend is unavailable or you are offline, the app falls back to a small built-in explainer that runs entirely on your device and transmits nothing.

Who else sees this data

We use these service providers — listed here so you know exactly where your data goes:

• Firebase / Google Cloud (USA) — authentication, database, push notifications, App Check, and analytics (only if you enable it).
• Cloudflare Workers (global edge) — runs the “Explain this” backend.
• OpenAI (USA) — generates AI explanations of the text you submit to “Explain this”.
• Anthropic (USA) — generates AI explanations when OpenAI is unavailable.
• Apple (USA) — Sign in with Apple, push notifications via APNs.

OpenAI and Anthropic process submitted text under their API terms and may retain it for a limited period for abuse monitoring. Transfers to these US-based providers rely on Standard Contractual Clauses and their published data-processing terms.

These providers process data only to deliver their services to us. We do not share your data with advertisers, data brokers, or third parties for their own purposes.

Tracking

We do not track you across other apps or websites. The app does not use the App Tracking Transparency framework, because there is no tracking to ask permission for. (NSPrivacyTracking = false in our App Store privacy manifest.)

Children

BlockBuddy is designed for adults learning about crypto, and the “Explain this” feature is built on third-party AI services whose terms require users to be at least 13 (and, for some providers, 18). BlockBuddy is not directed at children, and we do not knowingly collect personal data from children under 13. If you believe a child has provided data through the app, contact us at nozadt15@gmail.com and we will delete it.

Your rights

Wherever you live, you can:

• See your data — contact us and we will export the data we hold about you.
• Correct your data — email us if anything is wrong.
• Delete your account and all data — use Profile → Delete my account & data inside the app. This permanently removes your Firebase Authentication record and your Firestore data. The action is irreversible.
• Withdraw consent — uninstall the app at any time; data already collected can be deleted on request.

Residents of the EU/EEA, the UK, and California have additional rights under GDPR and CCPA, including the right to file a complaint with your data-protection authority.

Security

• Network traffic uses TLS.
• Authentication and Firestore documents are gated by per-user security rules — you can only read your own data.
• Sensitive credentials (auth tokens) are stored in the iOS Keychain.

No system is perfectly secure, but we take reasonable steps to protect your data.

Data retention

• Active accounts: kept while you use the app.
• Inactive accounts: kept until you delete them.
• Analytics events: if you enable analytics, retained per Firebase Analytics defaults (typically 14 months) then aggregated/deleted. Analytics is off by default.
• “Explain this” text: we do not store it in any database of ours. The generated explanation is cached on our backend for about one hour, and your daily usage counter expires after roughly two days. The AI provider that generates the explanation (OpenAI or Anthropic) may retain the submitted text for a limited period for abuse monitoring, under their own terms.

Changes to this policy

If we change this policy in a meaningful way, we will update the “Effective date” at the top and surface a notice in the app where reasonable. Continued use after a change means you accept the updated policy.

Contact

Questions, data requests, deletion confirmations: nozadt15@gmail.com.