BLOCKSTACK AI · TRUST CENTER
Trust, Security & Privacy
Security is a first-class product feature at BlockStack AI. This page is maintained by the app owner to answer common security and privacy questions — it is not an independent audit or certification.
Our security principles
Student Safety First
Under-18 learners require verified guardian or teacher consent before their profile is activated. Consent state is held server-side and cannot be self-flipped by the student's browser.
Data Minimization
We collect only what powers your learning: name, email, module progress, workspace layout, and optional bio. No health data. No payment card data (Stripe handles billing).
Transparent Operations
This page is maintained by Rhys Robinson, founder of BlockStack AI. Every claim below reflects a control that exists in the shipped application today.
Controls in place today
Authenticated Access
Email/password and Google sign-in through Lovable Cloud. Every server request re-verifies the session token; expired or invalid tokens are rejected before any data is read.
Row-Level Security (RLS)
Every user-facing database table has RLS enabled with explicit policies. A learner can only ever see their own profile, progress, and workspace rows.
Role Separation
Roles (student, teacher, admin) live in a dedicated user_roles table and are checked through a SECURITY DEFINER function. Roles cannot be escalated from the client.
Two-Party Guardian Consent
For learners aged 11–18, our edge functions email a guardian or teacher, verify the token, and only then mark the account active. The student device never writes the consent flag.
Encryption In Transit
HTTPS end-to-end across the app, API, and database. Service-role keys and AI gateway keys live only in the server runtime — never shipped to the browser.
Operational Health
A /api/health endpoint verifies backend connectivity and static asset delivery for uptime monitoring.
Data we collect & why
| Field | Purpose | Retention |
|---|---|---|
| Name & email | Sign-in, certificate issuance | Until account deletion |
| Age & guardian email (minors) | Consent verification | Until account deletion |
| Module progress | Resume lessons, award ranks | Until account deletion |
| Workspace layout | Restore your sandbox | Until account deletion |
| Optional bio & social links | Community profile | Editable / removable anytime |
Sub-processors
- Lovable Cloud (Supabase) — Hosting, database, authentication, edge functions
- Google — Optional single sign-on (only if the learner chooses it)
- HeyGen — Lesson video hosting — no learner PII is sent
- Stripe — Billing, only when Payment Connect is enabled — card data never touches our servers
Compliance roadmap
We do not claim certifications we don't hold. The list below reflects our current posture and the frameworks we are working toward.
Shared responsibility
Lovable Cloud provides
Managed database, authentication, edge runtime, TLS, backups, and platform hardening.
BlockStack AI owns
RLS policies, consent flows, role separation, product features, and this trust page.
Schools & guardians own
Approving minor accounts, keeping classroom codes private, and offboarding students.
Report a vulnerability
Found something we should fix? Email hello@blockstackai.com.au with the subject "Security report". We acknowledge within 3 business days.
Acquirer & diligence pack
For acquisition, investor, or district-procurement review, request our security & privacy packet at hello@blockstackai.com.au.