Privacy Policy
BlinkyAI Private Limited ("BlinkyAI", "we", "us") is the data controller for the personal data described in this policy. Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the data fiduciary. We are a company incorporated in India, CIN U62011UP2026PTC251859. Our registered office is
B203, Pushp Court, Muir Road, Civil Lines, Prayagraj, Uttar Pradesh 211001, India. Write to [email protected] about anything on this page.This policy has two parts:
- Part A — the website and the waitlist. This applies if you visit theblinkyai.com or join the early-access list.
- Part B — the BlinkyAI app at app.blinkyai.app, on the web, iPhone and Android. This applies once you create an account.
Part A — The website and the waitlist
A1. What we collect when you join the waitlist
| Field | Source | Why |
|---|---|---|
| Email address | You, required | To contact you about early access |
| Name | You, optional | To address you properly |
| Role (from a fixed list) | You | To understand who is interested |
| Which tools you use (from a fixed list) | You | To prioritise which integrations to build first |
| A salted, keyed hash of your IP address | Your browser's connection | Rate limiting, to stop the form being abused |
| The version of the consent wording you agreed to | Recorded automatically | So we can prove what you actually agreed to |
| A referral code, a status flag, and created/updated timestamps | Generated by us | Running the waitlist |
| Whether you have confirmed your email address, and when | Recorded when you tap the link in our confirmation email | So we only write to addresses whose owners asked us to |
| A one-time confirmation code, stored only as a hash, with its expiry | Generated by us | To check the confirmation link; it works once, for 7 days, and is erased when used |
We do not store your IP address. It is passed through an HMAC-SHA-256 with a secret key held only on the server and never written to the database in raw form. We keep the hash, not the address, and the hash is of no use to anyone without that key.
A2. Why we are allowed to hold it
Your consent, which you gave by ticking the box on the form. Under the DPDP Act that is consent under section 6; under the EU/UK GDPR it is Article 6(1)(a). The one exception is the hashed IP address, which we process to prevent abuse of the form — a legitimate interest, and the reason we hash it rather than store it.
You can withdraw consent at any time, by writing to [email protected]. Withdrawing is as easy as giving it was: one email, and we delete the record.
A3. Where it is stored and for how long
Waitlist entries are held in Google Cloud Firestore in the asia-south1 (Mumbai) region, and the website itself runs on Google Cloud Run in the same region. Your waitlist data does not leave India in the ordinary course of running the waitlist.
90 days, and it deletes itself. Every waitlist record carries an expiry timestamp 90 days after it was last updated, and a Firestore time-to-live policy deletes it automatically when that time passes. If you re-submit the form, the clock restarts.
Rate-limiting records — the hashed IP and a counter — expire on the same automatic basis, within hours rather than days.
A4. Who else sees it
Our sub-processors for the website and waitlist are:
| Sub-processor | What they do | Where |
|---|---|---|
| Google Cloud Platform (Google Cloud India Private Limited / Google LLC) | Hosting (Cloud Run) and the waitlist database (Firestore) | asia-south1, Mumbai, India |
| Zoho Corporation Private Limited (ZeptoMail) | Sends the waitlist confirmation email | India |
That is the complete list for the website and waitlist. When you join, we send one email asking you to confirm your address. It is sent through ZeptoMail, run by Zoho Corporation, from its India data centre. The only other email the waitlist sends is the one telling you your place has opened. We do not send marketing email.
We do not sell your personal data, and we do not share it for advertising. We would disclose it if a law or a court in a jurisdiction that binds us required it, and we would tell you unless we were legally forbidden from doing so.
A5. Cookies, analytics and tracking
The website sets no cookies and runs no analytics, advertising or tracking scripts of any kind. If you join the waitlist, your browser's local storage keeps a small note that you have already joined, so the form does not ask you again — that note stays in your browser and is never sent to us. Clearing your site data removes it.
The interactive demo on the home page runs entirely in your browser on fictional sample data. It is not connected to any real mailbox or account, and nothing you do in it is sent anywhere.
A6. Your rights
You can ask us to give you a copy of what we hold about you, correct it, or delete it, and you can withdraw your consent. Email [email protected] from the address you signed up with and we will act on it within 30 days. There is no charge.
Under the DPDP Act you may also nominate another person to exercise these rights on your behalf, and you have the right to complain to the Data Protection Board of India. Under the GDPR you may complain to your local supervisory authority. We would rather you came to us first.
Grievance Officer: Rahul Kapri —
[email protected]
BlinkyAI Private Limited, B203, Pushp Court, Muir Road, Civil Lines, Prayagraj, Uttar Pradesh 211001, India
A7. Children
BlinkyAI is a tool for working professionals. The website and waitlist are not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a child has submitted their details, write to us and we will delete the record.
Part B — The BlinkyAI app
BlinkyAI is a chief of staff. It reads the accounts you connect, works out what is waiting on you, drafts replies and plans your day. To do that it has to read your messages, calendars and tasks. Nothing is sent to anyone in your name until you approve it. This part says what the app reads, what it keeps, who else is involved, and for how long.
B1. Why we may process your data
We process your data to provide the service you signed up for. Under the GDPR that is performance of a contract (Article 6(1)(b)). Under the DPDP Act it is your consent (section 6).
When you first sign in, the app asks you three questions. You can change the last two at any time in Settings → Privacy and account:
- Mail and chats. BlinkyAI reads your mail, Slack and WhatsApp to work, so this is required to use it. To stop it, disconnect a source or delete your account.
- AI (optional, off until you turn it on). Whether text may be sent to an AI provider (B4).
- Health (optional, off until you turn it on). Whether Apple Health or Health Connect data may be stored and used. Health data is special-category data under the GDPR, so we use it only with your explicit consent (Article 9(2)(a)).
If an account has not answered, the app treats every switch as off. We keep a record of your answers, with the date and the version of the wording you saw.
We keep security records, such as sign-in events, under our legitimate interest in keeping the service and your account safe.
Your messages contain other people's personal data, such as senders and people in your chats. We process it only to carry out your instructions: sorting your messages and drafting your replies. We never contact those people except with a message you approve.
B2. What the app collects
| What | Details |
|---|---|
| Your account | Email address, password (stored only as an scrypt hash), the name you give us, your time zone, locale and language, when you confirmed you are 18 or older, sign-up and last sign-in times, and your plan. |
| Sign-up confirmation | A 6-digit code, stored only as a keyed hash, with the pending email and password hash. The code works for 15 minutes. |
| Connection keys | The access tokens for each service you connect, app passwords for any other mailbox you add, and your own AI keys if you add any. All are encrypted (B10). |
| For your recent inbox messages we read the sender, subject, date and the short preview the mail service provides. To suggest follow-ups we read the recipient, subject and date of recent mail you sent. We read a whole message only when you open it in BlinkyAI or, if you turn on order tracking, emails that look like order confirmations. Attachments are fetched from your mail service when you open them and are not saved. We keep Desk cards built from mail (sender, subject, preview and a draft reply), how you treat each sender, and, with order tracking on, the order details. | |
| Slack | Messages that mention you and your direct messages. We keep the Desk cards built from them, with up to the last 10 messages of that conversation. |
| The text of your most recent 400 messages, sent and received, in individual and group chats, each up to 1,000 characters, with the chat's name and, for one-to-one chats, the phone number. For photos, voice notes and documents we keep only that a message arrived (sender, chat and time), not its content. We record missed calls. Desk cards keep up to the last 10 messages of the chat they are about. See also B16. | |
| Calendars (Google, Outlook, Zoho) | Events are read when they are needed: title, time, place, attendees and organiser. Whole calendars are not copied. An event's title is kept with any Desk card, brief or Ledger entry it appears in. BlinkyAI adds an event or focus block only when you ask. |
| iPhone calendar (optional) | If you turn it on in the iPhone app, it uploads events from the past 30 days and the next 30 days: title, time, place, calendar name and attendee names. They are replaced at every sync. |
| Tasks | Tasks you create in BlinkyAI. Todoist tasks are read when needed, not copied. |
| Health (phone app only, optional) | Sleep, heart-rate variability, resting heart rate, minutes in each heart-rate zone, steps, active energy, exercise and stand time, and bed and wake times, from Apple Health or Health Connect, plus your daily how-do-you-feel check-in. Your date of birth stays on the phone; the phone uses it only to work out heart-rate zones. The app only reads health data. It never writes to Apple Health or Health Connect. |
| Ask (chat with BlinkyAI) | Your messages, BlinkyAI's replies and images you attach. For files you attach, we extract the text to answer you and keep only the file name. |
| Ledger | A receipt for each action BlinkyAI takes for you, including the text of messages you approved. |
| Planning history | Task and meeting titles, times and why plans changed, used to learn how your days actually run. |
| AI results | Your latest brief, coaching notes and sorting answers, kept so the app opens quickly. |
| Voice brief | The audio file of your spoken brief. |
| App records | Preferences, sender rules, focus sessions, habits, notes, follow-ups and daily counts. |
| Weather and news (optional) | The location you set for the weather (latitude and longitude), and the news topics you choose. |
| Devices | Your push-notification token, platform and device name, and a key that lets home-screen widgets show your data. |
| AI usage | For each AI request: time, provider, feature, approximate length, and whether it worked. Never the content. Used for your daily AI allowance and to run the service. |
| Security log | Sign-ins (successful and failed), connections and disconnections, data exports, deletions, password resets and admin actions, with account IDs. Email addresses are stored only as a keyed fingerprint, never as text. Each entry is fingerprinted and linked to the one before, so changes can be detected. |
| Server logs | Technical events and errors, with account IDs. Email addresses and phone numbers in log text are masked. Our web access log does not record IP addresses. |
The app does not read your phone's address book, track your location in the background, record from your microphone, or read your photos, except images you choose to attach in Ask. The WhatsApp contact names come from WhatsApp itself (B16). The app has no advertising ID and no analytics or advertising tools.
B3. Services you connect
You choose which services to connect. BlinkyAI then acts for you inside them:
| Service | What BlinkyAI can do there |
|---|---|
| Google (Gmail, Google Calendar) | Read your mail, mark a message read, send replies you approve, and read and change calendar events. See B14. |
| Microsoft (Outlook and Microsoft 365 mail and calendar) | Through Microsoft Graph: read your mail, mark a message read, send replies you approve, and read and change calendar events. Permissions asked: Mail.ReadWrite, Mail.Send, Calendars.ReadWrite, User.Read, plus offline access and your email address. |
| Zoho (Mail and Calendar) | Read your mail, mark a message read, send replies you approve, and read and change calendar events. |
| Other mailboxes (app password) | Read your mail and send replies you approve, over IMAP and SMTP. |
| Slack | Read messages that mention you and your direct messages, look up names, and post replies you approve. |
| Todoist | Read your tasks and, when you ask or turn on automatic task changes, create, complete and reschedule them. |
| Receive your messages as a linked device and send replies you approve. See B16. | |
| Apple Health / Health Connect | Read the health data listed in B2. See B15. |
These companies are not our processors. You connect them, and their own terms and privacy policies cover what they do. This policy covers what BlinkyAI does with the data it reads from them. You can disconnect any of them in Settings, or withdraw access in that service's own settings.
B4. How BlinkyAI uses AI
AI is optional and off until you turn it on. When it is on and a feature needs it, we send the text that feature needs, and only that, to an AI provider, and show you the result.
| Feature | What is sent to the AI provider |
|---|---|
| Sorting what needs you | Sender, subject and the first 200 characters of each message |
| Draft replies on the Desk | Up to the last 10 messages of that conversation, each up to 400 characters |
| Drafts and rewrites you ask for | The conversation you are replying to and your instructions |
| Morning and evening brief | Your agenda titles and times, what is waiting on you, and, if Health is on, your recovery, sleep and heart-rate variability |
| Coaching and planning notes | Task and meeting names and times, and your recovery score if Health is on |
| Ask | Your question, the last 12 messages of the chat, up to 40 open tasks and 20 upcoming events, up to 8 matching emails, Slack and WhatsApp messages (140 characters each), and any file text (up to 8,000 characters) or image you attach |
| Command bar | Up to 200 characters of what you type |
| News (optional) | Headlines for the topics you chose |
| Order tracking (optional) | The sender, subject and first 1,200 characters of an order email |
| Automatic task changes (optional) | Task names, to explain why tasks moved |
| Spoken brief | The text of your brief, turned into audio |
Some of this runs in the background without you asking. For example, the Desk prepares draft replies in advance so they are ready when you look.
Masking before anything leaves. Before any AI request leaves our server, card numbers, one-time codes, PAN and Aadhaar numbers are masked. In background work, phone numbers are masked too, keeping only their last digits. Text written by other people is passed to the AI as data, with an instruction never to follow it.
Our AI providers. Groq, Inc. (USA) is our main provider for text and makes the spoken brief. OpenAI, L.L.C. (USA) is the backup, and reads images you attach. Both act on our instructions, on paid business terms that do not allow them to train their models on what we send. We have switched on Groq's zero-data-retention setting, so Groq does not keep what we send. OpenAI keeps API requests for up to 30 days to detect abuse, then deletes them. BlinkyAI does not train any AI model on your data.
Your own AI key. Under Settings → AI, in "Advanced — use your own AI key", you can add a key from Anthropic, OpenAI, Google Gemini, Groq, OpenRouter or Mistral. BlinkyAI then sends the same content to the provider you chose instead of ours, with two exceptions: the spoken brief uses our voice provider (Groq) unless your key is from Groq, and an image goes to our provider if yours cannot read images. You choose that provider, and your agreement with them governs what they do with the content. Some providers' free tiers train on submitted content by default. Check their terms before you add a key.
Turning AI off. With AI off, no content goes to any AI provider. The Desk offers simple suggested replies instead of AI drafts, the brief is plain text, and the spoken brief uses your device's own voice.
AI is labelled. Text written by AI is marked in the app: "Written by AI" on the brief, an "AI draft" tag on a reply until you edit it, and labels on Ask answers.
AI can be wrong. A draft may misread a message or state something untrue. That is why nothing is sent without your approval.
B5. What BlinkyAI does on your behalf
Nothing is sent without your approval. BlinkyAI never sends an email, Slack message or WhatsApp message unless you tap to approve it. This is true on every plan.
Every action you approve on the Desk is recorded in the Ledger. Most actions wait a few minutes before they happen, so you can undo them. You can change these waits with the autonomy settings. A message you write yourself on the Comms screen is sent when you press Send, like any mail app.
BlinkyAI changes things without a tap only in these cases:
- When you open an email or mark it done in BlinkyAI, it is marked as read in your mailbox. BlinkyAI never deletes your mail.
- "File as noise" only records your preference about that sender. It does not move or delete mail.
- If you turn on automatic task changes (off by default), BlinkyAI creates, completes and reschedules tasks in your Todoist. New tasks may contain an email's subject and sender, the start of a Slack message, or a WhatsApp chat name.
B6. Notifications
Push notifications travel through Google Firebase Cloud Messaging and, on iPhone, Apple Push Notification service. They can include what needs you: a sender's or contact's name, an email subject, a task or meeting title, and, if Health is on, health figures such as your recovery score. You can switch off notification types and set quiet hours in the app, or turn notifications off in your phone's settings.
B7. Who else sees your data
Our processors. These companies process data for us, only to provide the service:
| Company | What they do for us | Data involved | Where |
|---|---|---|---|
| Google Cloud (Google Cloud India Private Limited; Google LLC) | Hosting the app and website, databases, backups, a copy of the encryption key, uptime checks | Everything in B2 (backups are copies) | Mumbai, India |
| Groq, Inc. | Main AI provider for text, and the spoken brief | What B4 lists | USA |
| OpenAI, L.L.C. | Backup AI provider, and reading images you attach | What B4 lists | USA |
| Google Firebase Cloud Messaging (Google LLC); Apple Push Notification service (Apple Inc.) | Delivering push notifications | Device token and notification text (B6) | Worldwide |
| Functional Software, Inc. (Sentry) | Error reports from our server, so we can fix faults | Account ID and technical error details. Email addresses, phone numbers and IP addresses are removed first | USA |
| Zoho Corporation Private Limited (ZeptoMail) | Sending account emails from [email protected]: sign-up codes, password resets, deletion confirmations and service notices | Your email address and the email's content | India |
| OpenMeteo GmbH (Open-Meteo) | Weather on your home-screen widgets, if you set a location | The latitude and longitude you set, sent from our server without your name or email | Switzerland |
| Google LLC (Google News) | Headlines for the topics you choose, if you turn news on | Your topics, sent as a search from our server without your name or email | Worldwide |
If you add your own AI key, the provider you chose also receives what B4 lists. That provider works under your agreement with it, not ours.
Our staff. Only named BlinkyAI staff have admin access. Staff open an account's data only to help you when you ask, to investigate abuse or a security problem, or when the law requires it. Admin actions in the app, such as exporting an account, resetting a password, changing a plan or viewing the people list, are recorded in the security log. A small number of our engineers can reach the servers to maintain them.
Other disclosures. We disclose data when a law or court that binds us requires it, and we tell you unless we are forbidden to. If BlinkyAI is merged or sold, your data would move to the new owner under this policy, and we would tell you first.
We do not sell your data, show you ads, or share your data for advertising.
B8. Where your data is stored and when it leaves India
BlinkyAI stores your data in India, on Google Cloud servers in Mumbai (asia-south1), for users in every country. Our backups are kept in the same region.
Some processing happens outside India: AI requests (Groq and OpenAI, USA, or the provider of your own key), error reports (Sentry, USA), push notifications (Google and Apple, worldwide), weather (Open-Meteo, Switzerland) and news (Google). The DPDP Act allows transfers outside India except to countries the Government of India restricts. None of these countries is restricted.
If you use BlinkyAI from the European Economic Area, the United Kingdom or Switzerland, your data is transferred to India and to the providers above. We make these transfers because they are necessary to provide the service you asked for (GDPR Article 49(1)(b)). We choose providers whose terms bind them to protect the data and use it only to serve us.
B9. How long we keep it
| Data | Kept |
|---|---|
| Your account and app records | Until you delete your account |
| Pending sign-up (code, email, password hash) | About an hour |
| Connection keys | Until you disconnect that service or delete your account |
| Cached mail details (Desk cards from mail, sent-mail follow-up details) | 30 days after the last activity on them |
| Desk cards from Slack and WhatsApp | 90 days after you decide them |
| WhatsApp messages | Your most recent 400. Everything WhatsApp-related goes when you unlink WhatsApp |
| Order details (order tracking) | Until you delete them or your account |
| Ask chats | 90 days by default. You can choose a different period, or keep them |
| Health daily history and check-ins | 90 days |
| Recovery, strain and sleep scores | 120 days |
| AI results (brief, coaching notes, sorting answers) | 14 days |
| Voice brief audio | 7 days |
| Ledger receipts | Your most recent 400 actions |
| Planning history and AI usage records | Until you delete your account |
| Device registrations | Until you sign out on that device or delete your account |
| Security log | 12 months |
| Server logs | Rotated by size, normally about 30 days. Web access log: 30 days, without IP addresses |
| Database backups | 14 days on our server, and 30 days in Google Cloud Storage in Mumbai, then deleted automatically |
| Waitlist (Part A) | 90 days after the last update |
An automatic job enforces these periods every hour and every night.
- Disconnecting a service deletes its key at once, with the messages and cards we cached from that service. We also ask Google, Slack, Zoho and Todoist to cancel BlinkyAI's access. Microsoft offers no way for us to do this, so remove BlinkyAI at account.live.com/consent/Manage (personal accounts) or myapps.microsoft.com (work accounts).
- Turning Health off stops new health uploads and stops any use of your health data. History already stored stays until it reaches the periods above, or until you delete your account.
- Deleting your account deletes everything in B2 at once, except backups. The security log keeps a record that the account was deleted, with a keyed fingerprint of the email address, not the address itself. Deleted data leaves our backups within 30 days.
B10. How we protect it
- All traffic between your devices and BlinkyAI is encrypted in transit (TLS).
- Connection keys, app passwords and your own AI keys are encrypted with AES-256-GCM before they are stored. The encryption key is a software key held in the server's configuration, outside the database, with a copy in Google Secret Manager in Mumbai.
- Passwords are stored only as scrypt hashes, which cannot be turned back into your password.
- The rest of your data (messages, cards, health figures) is protected by Google Cloud's disk encryption and our access controls. The app does not encrypt it separately.
- Sign-in uses a cookie that scripts on the page cannot read. After 10 wrong passwords an account is locked for 15 minutes. "Sign out everywhere" and a password change end every session.
- If you use Face ID or fingerprint sign-in, your password is kept in your phone's secure keychain behind that check.
- WhatsApp link keys are held on our server in Mumbai and deleted when you unlink.
No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires, including the Data Protection Board of India.
B11. Your choices and rights
In the app:
- Settings → Privacy and account: turn AI and Health on or off.
- Connections: disconnect any service. You can also withdraw access in that service's own settings.
- Export: "Export my data" downloads your data as a file.
- Delete your account: in Settings, or at app.blinkyai.app/delete-account, which works without signing in: we email a link to the account's address, and the deletion happens when you confirm. Deletion cannot be undone.
Your rights. Under the DPDP Act you can ask for a summary of the data we hold and who we shared it with. You can ask us to correct, complete or erase it, withdraw consent, and nominate someone to act for you. Under the GDPR you also have the rights to restrict or object to processing and to data portability. Write to [email protected] from your account's email address. We reply within 30 days, at no charge.
Grievance Officer: Rahul Kapri —
[email protected]
BlinkyAI Private Limited, B203, Pushp Court, Muir Road, Civil Lines, Prayagraj, Uttar Pradesh 211001, India
If you are not satisfied with our answer, you can complain to the Data Protection Board of India. In the EEA or the UK, you can complain to your local data protection authority.
B12. Cookies and storage on your device
| Name | What it is for | How long |
|---|---|---|
blinky_session cookie | Keeps you signed in. Scripts cannot read it, and it is sent only over HTTPS | 30 days, or until you sign out |
| Widget key (phone keychain) | Lets home-screen widgets show your data | 1 year, or until you sign out on that phone |
| Local storage | Your theme, the email you last signed in with, recent commands, timer state, sign-in preferences and similar settings. It stays on your device | Until you clear it |
The app uses no analytics, advertising or tracking cookies, and loads no third-party scripts.
B13. Age
BlinkyAI is for people aged 18 and over. You confirm your age when you sign up. We do not knowingly collect data from anyone under 18. If you believe a child has an account, write to [email protected] and we will delete it.
B14. Google user data
If you connect Google, BlinkyAI asks Google for these permissions and uses them only for the features named here. Gmail and Google Calendar are connected separately.
| Permission | What BlinkyAI does with it |
|---|---|
Read, compose and modify your Gmail messages (gmail.modify) | Shows your recent mail in Comms and on the Desk, sorts it into decisions, reads order emails if you turn order tracking on, and marks a message as read when you open it or mark it done. BlinkyAI never deletes your mail. |
Send email on your behalf (gmail.send) | Sends a reply only after you approve it. |
See and edit events on your calendars (calendar.events) | Shows your meetings, prepares meeting notes, and adds a focus block or event when you ask. |
Your email address and sign-in (userinfo.email, openid) | Tells you which Google account is connected. |
What we keep. Mail is read from Google when needed and is not copied into our database. We keep the sender, subject and preview on Desk cards built from it, and recipient and subject details of recent sent mail for follow-ups, for 30 days after the last activity. They are deleted at once when you disconnect that account or delete your BlinkyAI account. Calendar events are read when needed. An event's title is kept only with a Desk card, brief or Ledger entry it appears in.
How it is used and shared.
- Google user data is used only to provide the user-facing features described in this policy.
- It is never sold, never used for advertising, and never used to build or train generalised AI models, by BlinkyAI or by our AI providers.
- People at BlinkyAI do not read it, except with your permission for a specific message, when needed for security or abuse investigation, or when the law requires it.
- When AI is on, the parts of your Google data a feature needs (B4) go to our AI providers, Groq and OpenAI, only to produce what you see in the app. If you add your own AI key, they go to the provider you chose, at your direction.
- Google data also appears in your own push notifications (B6) and, if you turn on automatic task changes, in task names in your Todoist (B5).
Turning it off. Disconnect Google in Settings: BlinkyAI deletes the data cached from that account and asks Google to cancel its access. You can also remove access at myaccount.google.com/permissions.
BlinkyAI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
B15. Apple Health and Health Connect
Health data is used only to plan your day and show your recovery, and only when you allow it on your phone and turn Health on in Settings → Privacy and account. With Health off, the server refuses health uploads. We do not use health data for advertising or marketing, and we never sell it. It is shared only as needed for those features: with our AI providers when AI is also on, and with the push services when a notification mentions your recovery. Health data is read only while the app is open. The app never writes to Apple Health or Health Connect.
B16. WhatsApp
WhatsApp is connected by linking BlinkyAI as a device on your phone, the way WhatsApp Web works. It is not an official WhatsApp Business integration. You link either by scanning a QR code, which is drawn in your own browser, or by typing your phone number and entering a pairing code in WhatsApp. No other company receives the QR code or the pairing code.
The link's security keys, your WhatsApp number and the contact names WhatsApp shares with linked devices are held on our server in Mumbai so the connection stays open. They are deleted when you unlink, from BlinkyAI or from WhatsApp → Settings → Linked devices on your phone. Unlinking also deletes the WhatsApp messages and cards BlinkyAI kept. We can switch WhatsApp off for everyone; while it is off, nothing new from WhatsApp is stored. Terms section 6 explains the risks of this kind of connection.
Changes to this policy
When we change this policy we update the version and date at the top. If a change affects how we use data you have already given us, we tell you in the app or by email before it takes effect. Where a change needs your consent, we ask for it.
Contact
Privacy questions and requests: [email protected]. Everything else: [email protected]. Post: BlinkyAI Private Limited, B203, Pushp Court, Muir Road, Civil Lines, Prayagraj, Uttar Pradesh 211001, India.