StealthProtocolPrivacy Policy
Draft under legal review, version v0.3-minuta. Items marked ⟦…⟧ are still pending.
Open in the app1. Who is responsible
Data controller: ⟦TO FILL: name, address, country⟧. Privacy contact: contact@stealthprotocol.ch. ⟦EU representative, if required (Art. 27 GDPR): TO FILL⟧.
2. The principle
We collect as little as possible. There is no sign-up, no account, no required email and no KYC. We do not use tracking cookies, advertising pixels or visitor analytics tools.
3. What is processed, by whom and why
| Data | Who processes it | Purpose | Legal basis ⟦confirm⟧ | Retention |
|---|---|---|---|---|
| IP address, date and time, requested page, browser (technical access logs) | Our hosting provider (Vercel Inc., USA) and network/DNS provider (Cloudflare, Inc., USA) | Serving the site, security and abuse prevention | Legitimate interest (Art. 6(1)(f) GDPR) | Up to ⟦30⟧ days, under a uniform policy |
| Approximate country, derived from the IP | Cloudflare | Blocking restricted jurisdictions | Legal obligation / legitimate interest ⟦confirm⟧ | Not stored by us ⟦confirm⟧ |
| Connected wallet address | Your browser; the sanctions-screening source ⟦TO DEFINE⟧; the RPC provider | Sanctions screening; reading balances; building transactions | Legal obligation (sanctions) / performing the service you request | Not stored on our servers |
| Preferences (language, last wallet type, intro seen, terms acceptance) and a cache of public market data | Only your browser (localStorage) | Remembering your choices | ⟦Strictly necessary / consent — confirm⟧ | Until you clear it in your browser settings |
| Stealth delivery signature and keys | Only your browser's memory | Generating and finding your stealth addresses | Performing the service you request | Erased when you close the page; never sent to us or stored |
| Messages you send (email, reports, support) | Us | Replying | Legitimate interest / performance | ⟦TO DEFINE⟧ |
4. Third parties your browser contacts directly
To work, your browser talks directly to third-party services, which see your IP address and the technical requests. Those records are not ours and follow each provider's own policy:
- public RPC providers for the Base network ⟦final list⟧: they see your IP and the addresses whose balances are queried. When you use stealth delivery, this includes the list of your stealth addresses if they are queried together. To reduce this risk, use a VPN or Tor;
- your wallet (MetaMask, Coinbase Wallet, etc.);
- only if you turn on "Load token images": the IPFS and Arweave image gateways (Filebase, Pinata and arweave.net), which receive your IP address when each image is downloaded. Off (the default), no third-party image is downloaded.
The site's fonts are served by the site itself: no third-party font service receives your IP address.
5. The blockchain is public
Transactions on the Base network, including addresses, amounts, times, tokens created and purchases with stealth delivery, are public and permanent. We do not hold them and cannot delete or change them. Stealth delivery reduces the link between your addresses but does not remove it (see Terms, clause 9).
6. Sharing and requests from authorities
We do not sell data or share it for advertising. We share it only with the providers listed above, acting as ⟦processors⟧, and with authorities under a valid legal order, always through legal counsel and limited to what we actually hold. Access logs are deleted under the uniform retention policy. We do not delete records selectively after receiving a request.
7. International transfers
Vercel and Cloudflare are in the USA. Transfers rely on ⟦the EU-U.S. Data Privacy Framework / standard contractual clauses — confirm⟧.
8. Your rights
If the GDPR applies to you, you have the rights of access, rectification, erasure, restriction, objection and portability, and the right to complain to a supervisory authority (in Italy, the Garante per la protezione dei dati personali). Because we have no accounts or identification, we may need your IP address and the approximate time to locate a log record. We cannot delete data from the blockchain.
9. Security
We do not store private keys, signatures or account data. The site uses a strict Content Security Policy and loads no third-party scripts ⟦check⟧.
10. Minors
The Interface is not intended for anyone under ⟦18⟧.
11. Changes
The version and date are shown in the footer, and every change is logged.