App description last updated: 30 October 2026. This policy describes Blizn for macOS, iOS, iPadOS and the first Apple Watch version for watchOS 10 and later. Processing when you visit blizn.de is explained separately in the website privacy policy. The app is currently available through TestFlight; public App Store distribution is being prepared. The internal TestFlight version includes a Watch app; widgets are not yet included.
Controller and contact details
Martin Bergmann, trading as Wallet-X, sole proprietorship, Alte Brauerei 8, 46509 Xanten, Germany.
Email: info@wallet-x.de. Telephone: +49 2801 9879472. You can also send privacy enquiries to this address.
Mail accounts and messages
Gmail accounts signed in through Google use the Gmail API. Other appropriately configured accounts use IMAP and SMTP. Mac, iPhone and iPad connect directly to the respective provider. The optional Watch connection routes are described under “Apple Watch and optional connection routes”. These connections process your account identifier, email address, sign-in credentials and the messages, senders, recipients, folder information and attachments required for the action concerned. The services also receive your IP address and technical connection data. Recipients receive the messages you send.
Wallet-X does not operate an additional mail server and does not obtain its own access to your mailbox through these connections. Processing by your mail provider is governed by its contract and privacy information. Server actions such as sending, moving or deleting change your actual mailbox.
To the extent that Wallet-X processes personal data to provide the mail functions you request, the legal basis is Article 6(1)(b) GDPR. Receiving and sending do not work without the necessary account details and server connections. The other local functions and sample data can be used without a connected mail account.
For Gmail, you can sign in directly with Google. Microsoft sign-in for Outlook/Microsoft 365 has been prepared but is not yet enabled in the current beta build. The following description of Microsoft sign-in concerns its future activation. For this purpose, Blizn sends your account address, app identifier and required mail permissions to the respective sign-in service. Blizn receives authorisation to access and send mail, along with renewable access credentials; the app stores these tokens in the local keychain of the respective device. They are not transferred through Blizn’s iCloud function or password synchronisation. You must sign in separately on other Mac, iPhone and iPad devices. A separate exception is the explicitly configured transfer of Gmail access from an iPhone to its paired Watch, as explained below. In the prepared version from build 96 onwards, the new iCloud account sync contains neither the local OAuth credential reference nor the internal OAuth user identifier or tenant ID. Your account address, provider and server settings can still be synchronised after activation. The account configuration can contain the public provider identity and a reference to local credentials. Removing an account on this device also removes its local OAuth credentials. You can additionally revoke the provider’s authorisation in its account settings.
Google access for Gmail
For a Gmail account connected through Google, Blizn uses the permissions openid, email address and https://www.googleapis.com/auth/gmail.modify. The sign-in information associates Google’s authorisation with your configured mailbox. Blizn uses the Gmail API to read and send messages, change flags and folder assignments, and move messages to or restore them from the trash. The scope does not permit immediate permanent deletion that bypasses the trash. Once you separately enable it, the draft versions described below are also stored and retrieved through this access. Blizn processes the data for the mail functions you select. Removing an account in Blizn does not delete messages at Gmail.
You can revoke the authorisation in your Google account under third-party connections. This prevents further authorised access; it does not automatically delete local data already downloaded or data you have shared with other services. The information below applies to deleting local data. Optional AI assistance is available only for eligible content from accounts with other providers.
Blizn’s use of information obtained through Google Workspace permissions follows the Google Workspace API User Data Policy, including its Limited Use restrictions. Wallet-X does not sell this information, use it for advertising or use it to train general-purpose AI models. Disclosure and human access are restricted to the purposes permitted by those rules.
AI assistance is blocked for Gmail accounts and for reply drafts and forwards created from them in Blizn. This covers direct requests to OpenAI or Anthropic, ChatGPT sign-in and the copy-to-ChatGPT-or-Claude route. The restriction remains in place when you change the sender account and reopen a saved draft. AI also remains blocked for older quotations whose source cannot be reliably identified. Do not manually insert Gmail content into an AI request for another provider either.
Public Google approval has not yet been completed. The new Gmail sign-in is currently being tested only with approved test accounts. Permission to test does not constitute production approval.
Instructions on revoking access, signing in again and removing local data are available under Managing Gmail access and stored data.
Apple Watch and optional connection routes
The first Watch version displays incoming mail, message text and attachment names, and lets you send short replies after a preview and an explicit send confirmation. Attachments cannot yet be opened there; composing new messages, push services and complications are not yet included. The Watch app does not offer AI writing assistance. The Watch connection does not authorise Gmail content for AI processing either.
For the route through your paired iPhone, you separately allow Watch access on the iPhone. The Watch receives a limited copy of incoming mail, including text, address details and attachment names. Confirmed replies are processed through the iPhone and its existing outbox; Blizn must be active on the iPhone for actual sending. A waiting status is not a send confirmation.
For “Gmail direct”, you separately authorise the account on the iPhone and explicitly set up access on the Watch. Blizn then transfers the Gmail credentials, including the access and refresh tokens, to the Watch over the paired-device connection. The Watch stores them in its own non-synchronising keychain and renews access directly with Google. Retrieval and replies use the Gmail API directly. This transfer does not use Blizn’s iCloud sync.
For supported IMAP/SMTP accounts, you can choose to operate your own separate HTTPS mail service. The Watch sends it account identifiers, message identifiers, read actions and confirmed reply text. The service retrieves messages from the mail provider, sends replies and processes message content, senders, recipients and attachment names in doing so. The required provider credentials are configured separately on the server; Blizn does not automatically transfer the iPhone’s mail passwords there. The service address and access key are stored on the iPhone and explicitly transferred to the Watch. Among other things, the service can persist action status and OAuth state. Its operation, storage locations, server logs and retention also depend on the configuration of that service and its operator. Wallet-X does not provide a centrally operated mail service in this version.
The Watch stores a limited local copy of received messages, along with reply drafts and send status. Fully downloaded text can remain available offline. The connection routes have separate stores. Removing an account on the iPhone does not delete every Watch copy or fully remove independent access that has already been set up. Additionally remove Gmail or mail-service access in the Watch settings. Removing this access leaves stored text on the Watch. If you operate your own mail service, its credentials and stored data must also be managed separately. Revoking Google access does not remove text that has already been stored.
Searching your messages
Search can be restricted to mail already stored on this device. With connected accounts, further messages or search results can be downloaded from the mail provider and checked locally for matches. When searching connected IMAP mailboxes, Blizn sends the necessary search criteria to your mail provider. “Only saved emails” restricts search to existing messages; only those messages are available offline as well. Attachment names are searchable; the contents of attachment files are not searched.
Data on your device
The app stores downloaded message content and attachments, account settings and local organisation such as tags, search history, templates, signatures and reminders in your device’s app data area. Blizn uses the operating system’s encryption and protection features. From version 0.40.0 (98), the Mac app checks the actual data volume in use before reading and writing its mail data. The mail store, recovery copies, downloaded attachments, temporary previews and local sync state require encrypted storage locations. Blizn also checks the destination volume when saving received attachments on a Mac. If encryption cannot be confirmed, the access concerned is stopped; existing data is not deleted and system settings are not changed. You may need to enable FileVault and reopen Blizn. Older test versions did not yet enforce this Mac check. On iOS and iPadOS, the app uses the operating system’s file protection until the first unlock after a restart. Blizn does not provide its own additional file encryption.
The app stores passwords, API keys and sign-in tokens in the system keychain. Blizn’s keychain entries are local by default. For mail and app passwords, you can separately enable the iCloud Keychain synchronisation described below. AI credentials and browser sign-ins are not included. Credentials are used to sign in to the selected service. Wallet-X does not receive them through a backend of its own.
Without enabling the iCloud function, your configuration is not transferred to other devices through this iCloud sync. A separately configured Watch connection is independent of it. Operating system backups and data at mail or calendar providers depend on your settings. Local data remains stored until you remove it through the available app or system functions. Removing the app does not necessarily delete keychain entries, backups or data at other providers.
When you remove an account on this device, the app removes its active account and message entries, associated attachment cache and local credentials. Earlier local recovery points for the mail store are replaced with the cleaned current state; the old migration state and local storage objects no longer needed are removed. Other accounts and their current messages are retained. If a keychain or file-system error prevents complete removal, Blizn displays a notice, records the outstanding cleanup across restarts and offers a retry under Settings → Accounts.
This cleanup does not remove operating system backups, file-system snapshots, previously exported files or copies at other services. The deletion and retention options of the respective system or provider also apply to those copies.
Optional iCloud synchronisation
Under “iCloud & Devices”, you can synchronise your configuration between Mac, iPhone and iPad using the same Apple Account. Apple’s CloudKit stores account settings, including server names, usernames and email addresses, account colours and default signatures, signatures with embedded images, templates, tags, local and smart folders, and general display and reading settings in your private iCloud database. Apple provides the storage and transfer; Wallet-X does not operate its own server for this purpose. The function is initially switched off.
Message content, mail attachments, drafts, search history, AI credentials, font size, message zoom, retrieval intervals and an account’s local paused status are not synchronised through this function. The app synchronises your configuration during active use; changes remain queued locally when there is no connection. In the private CloudKit area, small entries use encrypted data fields and larger entries use assets stored in encrypted form. Apple’s protections also depend on your iCloud settings.
Mail and app passwords can be stored and synchronised through a separate iCloud Keychain switch. Apple describes this service as end-to-end encrypted. “Passwords & Keychain” must be enabled on your devices. Credentials already in use remain available for local sign-in. Further information is available from Apple on iCloud and privacy and Apple on iCloud Keychain security.
Switching the function off stops sync on that device; it does not delete existing local or iCloud data. Other enabled devices can continue to synchronise. Deleted entries are synchronised using a deletion marker. Up to 50 previous entry versions remain in the local recovery history. “Remove from all devices” removes the account from the shared configuration and pauses it on connected devices; local mail, keychain entries and messages at the mail provider are retained. Resetting the iCloud connection removes the local sync state and local recovery history, but no data in iCloud. When you change your Apple Account, Blizn pauses sync until you explicitly reset the connection or use the previous account again.
Templates, signatures, sender rules and search folders you create may contain email addresses, server folders, search terms or message text that you have inserted or selected. If you synchronise this configuration, these details are also sent to Apple. Excluding automatic mail-store synchronisation does not remove content you deliberately added to the configuration.
Optional draft sync through your mailbox
Draft sync is initially switched off and is enabled separately for each account on each device under Settings → Accounts. Before you switch it on, a confirmation dialogue explains that existing local drafts for the account will also be sent to the mail provider. Use this function only if you want those contents stored at your mail provider.
Once enabled, Blizn sends complete draft versions created in Blizn directly to the mail provider, including To, CC and BCC fields, subject, text and HTML, signatures, copied original text, attachments and the technical details needed for further editing. Recipient details that are not yet ready for sending and text not yet sent may therefore already be stored at the provider. The full editor state is preserved in a dedicated Blizn data attachment in the server version; further editing of this state takes place in Blizn. Third-party drafts created in webmail are not automatically imported. Access tokens and passwords are not part of these draft data. Sync uses the Gmail API for Google and the provider’s drafts area for supported IMAP accounts. It sends no message content to Apple’s CloudKit or a Wallet-X server.
To avoid unintended overwriting, Blizn stores new versions separately and retains earlier versions at the provider. Concurrent changes can result in several versions to choose from. Older versions can remain visible as additional drafts in webmail or other mail apps and use mailbox storage space. Storage is also subject to the terms and storage limits of your existing mail account. Blizn does not engage an additional service for this purpose; any costs under your existing provider contract remain unaffected.
Sync takes place while the app is actively used. Without a connection, changes remain stored locally and are synchronised later. The outbox containing scheduled messages or messages with uncertain delivery is not transferred to other devices as a sending instruction. Switching sync off stops further sync on this device but does not delete versions already stored at the provider. Removing a local account does not remove those server copies either. If needed, manage and delete saved versions separately in your mail account. The Gmail AI restriction remains in place for identifiable Gmail content, including drafts derived from it.
To the extent that Wallet-X is responsible for this processing, it takes place at your express request to provide cross-device editing, on the basis of Article 6(1)(b) GDPR. You can leave the function off without changing the other mail functions.
HTML mail and external images
External images in received HTML messages are blocked by default. You can allow them for an individual message or enable automatic loading in the settings. Loading connects your device to the respective image server. That server receives, among other things, your IP address, retrieval time and requested address. Individual image addresses can let the sender identify that a message has been opened. External links open in the browser only after you select them.
The web view uses no persistent website data store; JavaScript in received messages is disabled. Blizn itself contains no advertising or analytics SDKs and uses no advertising identifier. This does not exclude processing by external content or services you allow.
Optional AI writing assistance
AI assistance is switched off by default and is blocked for Gmail content as described above. For eligible content from other accounts, the following applies: if you enable the function and approve text for editing, Blizn sends the approved text and your instruction directly to the selected OpenAI or Anthropic service. The text may contain names, email addresses, message content and other information you select. The service also receives the details needed for authentication and technical connection data. ChatGPT sign-in also exchanges the account information needed for sign-in and permission checks.
To the extent that Wallet-X is responsible, voluntary transfer to AI writing assistance is based on your consent under Article 6(1)(a) GDPR. You can prevent further transfers at any time by disabling the function. Withdrawal applies to the future; it does not automatically delete data already processed at the provider. Mail functions can be used without AI.
Wallet-X does not operate its own AI proxy. OpenAI requests currently set store: false. This is not a promise that the provider stores no security or connection logs. Retention periods, possible use of inputs and deletion options depend on the service, type of access and your settings there. Information is available from OpenAI and Anthropic.
In external mode, Blizn copies the text you approve to the system clipboard. You paste and submit it to the external service yourself. Cross-device clipboard use depends on your system settings. Only transmit content that you are authorised to process. Your approval does not replace any legal basis required for processing other people’s personal data.
Calendar, files and notifications
When you use email links, Siri or Shortcuts with Blizn, the app uses the recipients, subject and text fields, account names or search terms you supply for the chosen action. New messages open for review and are not sent automatically. These actions do not return stored message content or search results to Siri. Use of Apple’s system functions is also governed by Apple’s privacy information and your system settings. Local processing serves the action you request under Article 6(1)(b) GDPR, to the extent that Wallet-X is responsible.
Read receipts are temporarily disabled: Blizn does not request new receipts or send receipt replies. Previously saved drafts, decisions, receipt data and paused outbox entries remain on the device. Historical receipts can still be displayed; the absence of a receipt does not prove that a message is unread. Blizn uses no tracking pixels and no feedback server of its own.
Blizn uses the system calendar function for an event you explicitly confirm. Including message text in the event is optional. If your calendar synchronises, these details may reach your calendar provider. The native calendar interface may use operating-system-controlled contact access to select attendees. Blizn does not copy a contact list into a marketing database.
Selected files are processed as attachments, signature images or for export. Sending transfers attachments to your mail service and intended recipients. Local reminders can display notifications after your system permission; their visibility on the lock screen depends on your settings. You can manage calendar and notification permissions in the system settings. This processing serves the functions you request under Article 6(1)(b) GDPR, to the extent that Wallet-X is responsible.
Trial period and one-time purchase
A free 14-day trial followed by a one-time purchase is planned for the public version. The trial is activated as a free, non-consumable in-app purchase through Apple. Permanent unlocking is a separate, non-consumable in-app purchase. There is no Blizn subscription and no automatic charge after the trial period. Without a purchase, app functions remain locked after expiry; saved accounts and data are not deleted. Technical integration has been prepared for the beta and must be validated in Apple’s test environment before public release.
Apple handles purchase processing and the Apple Account and payment data required for it under its own terms. Through StoreKit, Blizn receives signed purchase confirmations needed to check the unlock, particularly the product identifier, original purchase time and any revocation status. Blizn checks this information locally and does not transfer it to a Wallet-X licence server. To provide a reliable price preview, Blizn also considers the installation environment signed by Apple and the current store region. In test environments or where price information cannot be reliably matched, only Apple’s purchase dialogue shows the current one-time purchase price. This additional check does not unlock the app or read payment details. Credit-card or bank details are not entered in Blizn. Restoring a purchase may require sign-in or confirmation with Apple.
The app also stores the last observed time locally in its settings so that setting the device clock back does not extend an already expired trial. This entry is not a purchase entitlement; unlocking requires a verified Apple purchase confirmation. Article 6(1)(b) GDPR applies to the purchase and unlocking functions you request, to the extent that Wallet-X processes personal data for them. Further information about Apple’s processing is available under App Store and privacy.
TestFlight and error reports
The beta is distributed through Apple’s TestFlight. Apple automatically collects crash and usage information and makes it available to the development team. This includes, for example, app and operating-system versions, device type, installations, sessions and crash logs; depending on the invitation type, it may also include your name and email address. This automatic collection cannot be declined within TestFlight.
If you voluntarily send feedback, the development team also receives your comments and, where applicable, screenshots. Remove confidential message content and credentials beforehand. Wallet-X uses this information to fix errors and improve Blizn on the basis of Article 6(1)(f) GDPR. The legitimate interest is a reliable and secure app. Wallet-X does not use the data for advertising or disclose it to third parties.
Wallet-X retains its own copies only for as long as necessary to handle and track the error concerned, then deletes or anonymises them unless a statutory retention obligation applies. According to Apple’s information, it retains beta feedback for one year; crash and usage information may be retained there until the issue is resolved. Apple’s processing and management options are explained under TestFlight and privacy.
Contact and support
If you contact Wallet-X by email, your address, the information in your message and any voluntary attachments are processed to handle your enquiry. The support mailbox info@wallet-x.de is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. Within Wallet-X, only Martin Bergmann has access to support messages. IONOS provides their technical transmission and storage. Access to your mailbox or complete message content is not required for a general support enquiry.
The legal basis is Article 6(1)(b) GDPR for enquiries about app use, and otherwise Article 6(1)(f) GDPR for handling incoming requests. Where statutory retention obligations apply, Article 6(1)(c) GDPR is the legal basis. Ordinary support enquiries, including their attachments, are generally deleted six months after final handling. Where a statutory retention obligation applies, or particular documents are still required to establish, exercise or defend legal claims, only the documents needed for those purposes are kept for the necessary period. The six-month period concerns support enquiries stored by Wallet-X; Apple’s own periods apply to storage at Apple.
Processing outside the European Economic Area
Your chosen mail, calendar and AI services, as well as Apple, may also process data outside the EEA. The countries, companies and safeguards involved depend on the service and your account. Its privacy information and contractual documents apply. Transfers for which Wallet-X itself is responsible must meet the requirements of Articles 44 et seq. GDPR, for example through an applicable adequacy decision or appropriate safeguards such as standard contractual clauses. You can request information about recipients and safeguards concerning Wallet-X using the contact details above.
Your rights
Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. You can object to processing based on legitimate interests on grounds relating to your particular situation. You can withdraw any consent at any time with effect for the future.
You can complain to a data protection supervisory authority, in particular where you live or where you suspect an infringement has occurred. The authority responsible for Wallet-X’s registered location is the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information. For data stored at other services, also use their contact and deletion options.
Wallet-X does not use the beta and support data it receives for automated decisions with legal or similarly significant effects and does not create such profiles from it. Changes to the data flows described here will be reflected in this policy before they are introduced.