Privacy Policy

1. Who we are

BlockWay Link Limited (博睿鏈科有限公司) (“Blockway”, “we”, “us”) is a technology company incorporated in Hong Kong. This Privacy Policy explains how we collect, use, store and protect personal data when you visit our website (www.blockway.io), contact us, or use our products and services.

We handle personal data in accordance with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”) and, where applicable, other data-protection laws.

2. Data we collect

We collect only what we need to operate the website and respond to you:

• Contact information you provide voluntarily — such as your name, email address, company, and the content of your message when you use our contact form or email us.
• Technical information collected automatically — such as IP address, browser type, device information, pages visited and time of visit, gathered through server logs and content-delivery infrastructure.
• Business information shared in the course of an engagement — such as requirements, documents and records exchanged under a service agreement, handled per that agreement.

3. How we use your data

We use personal data to:

• Respond to enquiries and provide requested information about our products and services.
• Operate, maintain and secure our website and infrastructure.
• Perform contracts with clients and partners, including support and billing.
• Comply with legal and regulatory obligations.

4. Enterprise deployments and model services

Our AI products — including the Agens Pilot model, the Argus screen agent, and the Claway AI workforce — are designed for private deployment on customer-owned hardware. In such deployments, data processed by the models remains within the customer's environment and under the customer's control; Blockway does not receive or retain that data unless expressly agreed in a service contract.

Where a specific product or engagement involves different data flows, those are governed by the applicable service agreement, which prevails over this general policy for that engagement.

5. Improving our AI model

This section applies to Blockway's hosted services, such as Codeway. It does not apply to private deployments on customer-owned hardware, which are covered in section 4 — in those, we do not receive your conversations at all.

Your sessions are stored on our servers so that you can return to them, in the same way any chat product keeps your history. That history holds the full exchange, including any images and tool activity, and is kept until you delete it or delete your account.

Separately from your history, we keep a copy of individual exchanges that you rate with a thumbs-up or thumbs-down, in order to improve Agens, the AI model behind the product. Exchanges you do not rate are not taken. This copy is held in a store separate from the systems that run the product.

Before an exchange is placed in that store, the message you sent and the answer you received are de-identified:

• Email addresses, telephone numbers, runs of seven or more digits, and credential-shaped strings such as API keys, access tokens and private-key blocks are replaced with placeholders.
• Images, tool activity and the model's internal reasoning are dropped entirely and never reach that store.
• Conversations in which a connected app was used (section 8) are never kept for model improvement, including any exchange in them that you rated.
• If you add a written note alongside your rating, that note is stored as you typed it. Please do not include personal details in it.
• This removal is automated and pattern-based. It targets the identifiers listed above and does not detect names, addresses or other details written in ordinary prose, so it reduces rather than eliminates the chance that an exchange can be linked to you.

6. Your choice over model improvement

Model improvement is on by default. You can turn it off at any time in Settings, under “Help improve the model”.

When you turn it off, the exchanges kept from your conversations for model improvement are deleted and no new ones are taken. Deleting your account does the same. Two limits apply: exchanges already assembled into a training dataset remain in that dataset, and content already used to train a model cannot be withdrawn from that model.

We do not currently apply a fixed retention period to these records. They are held until you turn model improvement off or delete your account.

7. The Blockway AI app

This section covers the Blockway AI app for iPhone, iPad and Android. The app is another way into the same hosted service, so sections 5 and 6 apply to it as well.

Account. To use the app you create an account with your email address and a password, or sign in with Apple or Google. From Apple or Google we receive your email address, a stable account identifier and, if you choose to share it, your name. We never receive your Apple or Google password.

What you send. Your questions, and any photos and documents you attach, are sent to our servers so the AI model can answer them, and are stored in your history as described in section 5. When you tap the speaker icon, the answer's text is sent to our servers to produce the spoken audio.

Voice input. When you speak instead of typing, the recording is sent to our servers and turned into text by Blockway's own speech recognition. With the microphone button, the text comes back for you to check before you send it; in voice mode it is sent as your message. The recording is used only to produce that text: it is not added to your history and is not used to improve our models.

Reading answers aloud. We count how many minutes of spoken audio your account uses each month, to apply your plan's allowance.

Memory. If memory is on, the assistant keeps short notes about you, such as your preferences, and uses them in later conversations. You can see, edit and delete them, or turn memory off, in Settings › Memory. Notes are stored with your account, are never used to improve our models, and are deleted with your account.

Scheduled tasks and the daily brief. If you ask the assistant to do something at a set time, we store the request and its results with your account. The daily brief reads public weather and news from the Hong Kong Observatory, RTHK and news.gov.hk; those sources receive nothing about you.

Notifications. If you allow notifications, we store a token from Apple that lets us notify your device when a task finishes or a brief is ready. We remove it when you sign out or turn notifications off.

Sharing to the app and Siri. Text, links, photos and files you share to Blockway AI, and requests you make through Siri or Shortcuts, are handled like anything else you send: they reach our servers only when they are sent.

Subscriptions. Plans are sold through the App Store and Google Play, which handle payment. We never see your card or bank details. We receive what the store reports about your subscription, such as the product, its transaction identifiers, its start and renewal dates and whether it is active, refunded or cancelled, so that we can give your account the plan you paid for. These records are deleted with your account; the App Store and Google Play keep their own payment records.

Invitations. If you join through a friend's invitation link, we record that the two accounts are linked so that both can receive the bonus allowance.

No advertising or tracking. The app shows no advertising, contains no third-party analytics or advertising code, and does not track you across other companies' apps or websites.

Deleting your account. You can delete your account at any time in the app, under Settings › Delete account, or on the web. Deletion removes your account, your conversations and files, and the records kept for model improvement (with the limits described in section 6). If you signed in with Apple, we also ask Apple to revoke the app's access. Deleting your account does not cancel a subscription bought through the App Store or Google Play; cancel it in your store account settings to stop further charges.

8. Connected apps and Google user data

You can connect accounts such as Google (Gmail, Google Calendar, Google Drive, Google Sheets and Google Docs), Microsoft and Shopify, so that the assistant can act for you. A connection is made only when you sign in to that service and approve the permissions it shows you. You can remove a connection at any time under Connections, which deletes the access tokens we hold for it.

What we access and why. We read or change data in a connected account only to do what you ask, in a conversation or in a task you set up, such as finding an email, adding a calendar event or creating a spreadsheet. For Google Sheets and Google Docs we use Google's drive.file permission, which covers only files created with Blockway.

Processed by our own AI models. Data from connected accounts is processed by Blockway's own AI models (Agens), which run on servers that Blockway operates. It is not sent to any third-party AI provider, and no model provider receives it.

Never used to train AI models. Data from connected accounts is never used to develop, train or improve any artificial-intelligence or machine-learning model, whether ours or anyone else's. Conversations in which a connected app was used are excluded from model improvement entirely (sections 5 and 6).

Google API Services. Blockway's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. We do not sell this data, do not use it for advertising, and do not allow people to read it except with your permission (for example, when you report a message), for security purposes, or where required by law.

9. Cookies and analytics

Our website may use strictly necessary cookies and privacy-respecting analytics to understand aggregate site usage. We do not sell personal data, and we do not use your data for third-party advertising.

10. Sharing and transfers

We do not sell or rent personal data. We share personal data only with service providers who help us operate the website and our business (such as cloud hosting and email providers), under obligations of confidentiality; with professional advisers where necessary; or where required by law. Some providers may store data outside Hong Kong; where they do, we take reasonable steps to ensure a comparable level of protection.

11. Retention and security

We keep personal data only as long as needed for the purposes above or as required by law, then delete or anonymise it. We apply reasonable technical and organisational measures — including access controls, encryption in transit, and audit logging — to protect personal data against unauthorised access, loss or misuse.

12. Your rights

Under the PDPO you may request access to, and correction of, your personal data held by us. You may also ask us to stop using your data for direct marketing (we do not conduct direct marketing by default). To exercise these rights, contact us at the address below; we will respond within the time limits prescribed by law.

13. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page shows when it was last revised. Material changes will be posted on this page.

14. Contact us

For any privacy questions or requests, contact BlockWay Link Limited at info@blockway.io.