Privacy

Last updated: 2026-07-22 · Policy version 2026-07-22. This policy is provided by Canyon Data Insights (10318 Viretta Ln, Los Angeles, California 90077), the data controller for your account and the processor of the mail we filter on your behalf.

Blockjay reads your email so it can sort it. That is sensitive, so we try to be plain about what we do with it. The short version: we read message content to classify it, we encrypt it everywhere it rests, no Blockjay employee has a product path to read your mail, and you can export or delete everything at any time.

The honest limit: this is not end-to-end encryption

A cloud spam filter has to be able to read a message to decide whether it is spam, and it has to do that around the clock, even when you are offline. That means Blockjay must be able to decrypt your mail on its own. So we cannot, and do not, offer end-to-end or zero-knowledge encryption, and we will never claim to. What we offer instead is no standing or casual access: encrypted at rest, plaintext only briefly in memory during classification, and every key use logged.

What we collect

• Account data — your name, email address, and password hash; or, if you sign in with Google or Microsoft, the identity they return.
• Mailbox connection data — the address, protocol (IMAP/POP3) or OAuth grant, and (for password mailboxes) the credential, which is envelope-encrypted and never logged.
• Message data — for each message we classify: metadata (sender, subject, time), the classification, a score and reason, and the message body. Bodies are stored encrypted in object storage; the database holds only a pointer.
• Operational telemetry — counts and timings used for metering and reports. These never contain message content.

What is shared with AI

Most mail is decided by deterministic checks (your allow/block rules, sender authentication, and the Rspamd engine with your personal Bayesian training). Only the small, genuinely uncertain middle band is escalated to AI — first to our own self-hosted Blockjay model, with Anthropic's models as a fallback. When that happens:

• We send the minimum needed — the sender, a summary of the headers, and a short body excerpt — not your full mailbox and not your whole message where an excerpt will do.
• The excerpt is treated strictly as data, never instructions (prompt-injection safety).
• Our own Blockjay model is self-hosted, so that content stays within Blockjay's boundary. When the Anthropic fallback is used, it runs under a zero-retention, no-training arrangement, so your content is not retained by the provider or used to train models.
• You can opt out of AI escalation entirely (the ai_escalation consent). With it off, Blockjay falls back to Rspamd-only classification for your mail.

Consent and your choices

You control each of these independently in your account preferences:

• Service processing — required to run the filter. Withdrawing it pauses scanning and effectively closes the account.
• AI escalation — send the uncertain band to our AI (self-hosted, Anthropic fallback). Decline → Rspamd-only.
• Product emails — marketing. Off by default, double opt-in.
• Reports — weekly/monthly summaries. On by default, opt out anytime.
• Analytics cookies — off by default; the cookie banner default-denies non-essential cookies.

Every change is recorded as a dated consent receipt.

Your rights

You can export your data (a portable archive of your personal data) and erase it. Erasure cascade-deletes your records, purges stored message bodies, and destroys your per-user encryption key, so any residual ciphertext is unrecoverable (crypto-shredding). You can also rectify your profile and adjust the consents above at any time. To exercise a right, use the controls in your account or contact [email protected].

Retention

We never automatically delete your valid mail — it stays until you delete it. Quarantined spam is automatically deleted 60 days after we catch it, along with the copy we stored; until then you can restore it or delete it sooner, and we email you about a week before anything is deleted so you can rescue a false positive. Your valid mail also leaves Blockjay when you delete or empty it yourself, or when you exercise your right to erasure.

Where your data lives and who else touches it

We operate EU-first and region-configurable. A short list of sub-processors (including Anthropic, Stripe, and Cloudflare) helps us run the service; see the sub-processors page and the data processing addendum. International transfers rely on Standard Contractual Clauses.

Contact

Questions or requests: [email protected]. If you are in the EU/UK and are unhappy with our response, you may lodge a complaint with your local supervisory authority. Our data protection contact is [email protected].