For parents and caregivers
AI safety: how Blocks works
Facts about AI Magic, saved builds, Duri audio and usage measurement in Blocks.
Checked against our code: October 22, 2026
Who receives Magic text?
When Magic asks AI to build something new, the text goes through our server to SiliconFlow, our AI service provider. The code defaults to Qwen/Qwen2.5-32B-Instruct; the deployed model can be changed through configuration. When Magic uses a matching built-in model, it builds that model and does not send the text. Asking AI to refine a build can still send the text. Our Magic code does not write the typed text to our database. An adult should enter fictional objects only, without names, addresses, schools or other personal details.
What happens before text is sent?
The server rejects empty input, text longer than 200 characters, and matches in a Chinese/English keyword filter for violence, adult content and some requests for personal details. This is a keyword check, not a guarantee about every possible input. Accepted text is sent as entered: the filter does not automatically remove names or addresses.
Where are saved builds and child accounts?
The Blocks saved-build shelf stores builds in this browser on this device, using local storage. Saving to that shelf does not upload a build to a server or sync it to another device. Blocks does not create a child account. Blocks also has a ☁️ Cloud save button. If an adult account is signed in on this device, it saves the build and a picture of the 3D scene to our database (Supabase) under that adult account. Without a signed-in account, the server rejects the save.
Does Duri talk with or remember my child?
In Blocks, Duri plays prerecorded audio selected for actions in the game. Duri does not chat with or personally remember a child. The game does keep playback state during a visit, and stores a flag in this browser to remember that the introduction has played.
Do child pages load analytics?
When website analytics is enabled in production, pages built for children do not load Google Analytics. That covers every page on our child-page list, including Blocks, Draw, Memory, Camp, Creative Studio, Games and the Blocks parent page. If you move from an adult page into a child page within the site, the page reloads once so the analytics script is not carried over. The shared site layout does not load Clarity. Child pages, including Blocks, can still send first-party usage events to our own server, tagged with a random device ID kept in this browser; excluding Google Analytics does not mean there is no usage measurement.
How are the 3 daily Magic generations counted?
Free requests from the same public IP address share 3 successful AI generations per UTC day, so devices on the same network can share the allowance. The daily counter uses a salted hash of that address, with the date, feature and count in Supabase. Each row also has a database timestamp. The counter writes these fields, not the entered text. If the database is unavailable, an in-memory counter is used. Members and legacy Pro accounts are not counted by IP address; a site-wide daily cap still applies to everyone. Our code does not automatically delete these daily counter rows, so they stay in Supabase until we remove them. The in-memory fallback keeps only the current and previous UTC day and is cleared when the server instance restarts. Old days are cleaned up the next time this fallback is used.
Does request throttling also use the network address?
A separate short-term throttle uses the unhashed IP address and browser user-agent in server memory, with a limit of 10 requests per 60 seconds. Expired entries are removed when another rate-limit check runs; the 60-second window is not a timed deletion guarantee.
Contact us
Parents can email questions about these data flows or requests to review or delete personal information to:
support@kidsaitools.com