# Privacy Policy

**Effective Date:** April 27, 2026
**Last Updated:** April 27, 2026

## Our Stance

Vaultfire's mission includes "privacy over surveillance" and "humanity over everything." This policy reflects that. We collect as little as possible, share even less, and design the Service to be useful without identifying you.

We are the opposite of KYC. We don't ask for your name, government ID, address, date of birth, or any "Know Your Customer" identity documents.

### Base V3 capped-pilot privacy notice

For the proposed V3 Base pilot, “privacy-preserving” means **data minimization
and use of reviewed commitments/references**. It does not mean zero data,
invisible or private transactions, anonymity, or that belief text is never
stored by every system involved. Base transactions, calldata, events, wallet
addresses, and any published commitment are public and durable; a hash can be
linkable and is not automatically anonymous.

The V3 pilot is not active. Its partner acceptance, counsel review, Base
Sepolia rehearsal, mainnet approval, and x402 settlement evidence are
unpopulated fail-closed gates. Solana and cross-chain value flows are outside
the V3 pilot scope.

## What We Collect

### Information you provide directly

- **Wallet address.** When you connect a wallet, we see the public address. This is necessary to interact with the smart contracts.
- **Email address (optional).** Only if you contact us, opt into updates, or use a feature that explicitly asks for it. We do not require email to use the protocol.
- **Content you submit.** Anything you publish through the Service (agent metadata, dispute claims, profile fields).

### Information collected automatically

- **Server logs.** Standard web server logs may record IP address, user agent, request path, timestamp, and response code. We use these for security, debugging, and rate-limiting. Logs are retained for a limited period (typically 30 days) and are not used to build user profiles.
- **Local browser storage.** We may use `localStorage` or `sessionStorage` to remember preferences (e.g., selected chain, theme). This data stays on your device.
- **Cookies.** We use only essential cookies required for the Service to function (e.g., session state). We do **not** use advertising cookies, third-party analytics cookies, or cross-site tracking. We do not sell or share data with ad networks.

### Information from public blockchains

Public blockchains are public ledgers. In particular, Base transactions
involving a wallet address—including any future V3 bond post, dispute filing,
or registration—are publicly visible and durable. We do not control this; it
is an inherent property of public blockchains.

We may **read** public on-chain data and display it on the Service (your bond count, dispute history, agent registrations, etc.). This is the same data anyone can read from a block explorer.

### What we do NOT collect

- ❌ Government-issued identification
- ❌ Social Security numbers or tax IDs
- ❌ Date of birth, full legal name, or home address (unless you voluntarily provide it for support)
- ❌ Biometrics
- ❌ Browsing history outside the Service
- ❌ Behavioral profiles for advertising

## How We Use Information

We use information only to:

- Operate, maintain, and improve the Service
- Respond to your inquiries and provide support
- Detect, prevent, and address security incidents, fraud, and abuse
- Comply with legal obligations (e.g., responding to valid legal process)
- Enforce our [Terms of Service](/terms)

We do not sell your personal information. We do not use your data to train AI models without explicit consent. We do not share your data with advertisers.

## Sharing of Information

We share information only with:

- **Service providers** who help us operate the Service (hosting, RPC providers, email delivery if you contact us). These providers are bound by confidentiality and data-protection obligations.
- **Public blockchains** — your on-chain interactions are inherently public.
- **Legal authorities** if required by valid legal process and only to the minimum extent required.

We do not share, sell, rent, or trade your personal information for marketing purposes. Period.

## Data Retention

- **Server logs:** ~30 days
- **Email correspondence:** Retained as long as needed to provide support, then deleted on request
- **On-chain data:** Permanent — we cannot delete data from public blockchains
- **Off-chain account data (if any):** Retained as long as your account is active; deletable on request (subject to legal-hold exceptions)

## Your Rights

Depending on where you live, you may have rights under data protection laws including:

### California (CCPA / CPRA)

If you are a California resident, you have the right to:

- Know what personal information we collect, use, and share
- Request deletion of personal information we hold about you
- Opt out of "sale" or "sharing" of personal information (we do not sell or share for cross-context behavioral advertising)
- Correct inaccurate personal information
- Limit the use of sensitive personal information
- Be free from discrimination for exercising your rights

To exercise these rights, contact **ghostkey316@proton.me**. We will verify your request via email reply and respond within 45 days.

### European Economic Area / United Kingdom (GDPR / UK GDPR)

If you are in the EEA or UK, you have the right to:

- Access your personal data
- Rectify inaccurate data
- Erase your personal data ("right to be forgotten") — subject to legal exceptions and the immutable nature of public blockchains
- Restrict processing
- Object to processing
- Data portability
- Withdraw consent at any time
- Lodge a complaint with your supervisory authority

The legal bases on which we process personal data are: (a) performance of a contract (operating the Service), (b) legitimate interests (security, fraud prevention, service improvement), and (c) consent (where applicable, e.g., optional email signup).

To exercise GDPR rights, contact **ghostkey316@proton.me**.

### Note on blockchain data

Public blockchain transactions cannot be deleted, modified, or made non-public. We will honor deletion requests for any **off-chain** personal data we hold, but we cannot remove data from a public blockchain. Please consider this carefully before any on-chain action.

## Children

The Service is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

## International Transfers

If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the U.S. We rely on appropriate safeguards (such as Standard Contractual Clauses where required) for international transfers from the EEA/UK.

## Security

We use reasonable technical and organizational measures to protect personal information. No system is perfectly secure. You are responsible for keeping your wallet credentials safe — we cannot recover lost keys or reverse on-chain transactions.

## Third-Party Links

The Service may link to third-party websites and services. This Privacy Policy does not apply to them. Review their privacy policies before using them.

## Do Not Track

We do not currently respond to Do Not Track ("DNT") browser signals because there is no industry-standard interpretation. Our default behavior already aligns with what most users expect from DNT — minimal tracking, no cross-site profiling, no advertising data sharing.

## Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the most recent revision. For material changes, we will provide notice via the Service or our official channels.

## Contact

For privacy questions or to exercise your rights:

**Email:** ghostkey316@proton.me
**Subject line suggestion:** "Privacy Request — [your request]"

We aim to respond within 30 days for general inquiries and within applicable legal timeframes for formal requests.
