Privacy Policy
Draft, pending legal review. Items in brackets are still to be completed.
This policy explains what personal data we handle for the Verity private testnet, including its apps, wallet software, APIs and community spaces (the "Testnet"), why we handle it and what choices you have. The controller is [LEGAL ENTITY NAME], of [REGISTERED ADDRESS] ("we", "us").
- We don't sell personal data.
- Anything you do on-chain is public and can't be erased.
- Links between wallets and Discord accounts stay off chain, with restricted access, and are deleted when you unlink or on 2027-03-31 at the latest.
Contents
1. What we collect
Wallet addresses
The addresses you connect to an app, use with a faucet or link to the points ledger by signing a message. That signature costs nothing and moves nothing.
On-chain activity
Your transactions and balances on the Testnet, which are public. Our indexers and apps read them, and the points ledger records qualifying actions per product for wallets you have linked.
Invite and access details
Your invite or access code when you sign in. For personal invites we store only a hash of the code, a random person ID, and the dates it was issued, used and last seen. Referrals record who invited whom.
Application answers
If you apply through our Discord, your answers (what you plan to do, how you describe yourself, your Solana experience, how you heard about us and any GitHub or website you give) are shown to staff in a staff-only Discord channel. Our logs hold your Discord ID and the outcome, not your answers.
X and Discord accounts, if linked
Your Discord ID, if you link it to the points ledger. If you link X, Discord tells us your verified X connection, and we store your X account ID, username, an account age derived from that ID and the date you linked. We don't ask for your X or Discord password. A display name appears on leaderboards only if you choose to set one; otherwise they show a shortened wallet address.
Community spaces
Messages, usernames and moderation actions in our Discord and Telegram spaces, and any bug reports you post there.
IP address and device data in logs
Your IP address, and browser and device information your browser sends, reach our servers and service providers when you use the Testnet. Some server logs record the IP address directly, for example sign-in attempts at our access gate.
Gateway telemetry
Our RPC gateway records each request: time, a salted SHA-256 hash of your IP address cut to 16 hex characters, the method, status, timing, sizes, requesting site and any API key ID. Raw rows are kept for 7 days. After that only per-minute totals remain, and those don't contain the IP hash. A salted hash is harder to link to you than the address itself, but we still treat it as personal data.
Points review data
A salted hash of the IP address you use with the points ledger, per day, to spot many accounts on one network. It only queues a case for human review.
First-party telemetry
Where we turn it on, some of our own products send a fixed list of usage events, such as a quote, a submission or a search, with a browser session ID that is hashed again on arrival and a few bounded numbers. These events contain no wallet addresses and no free-form properties.
We don't ask for your legal name, identity documents or payment details to use the Testnet. Please don't send them to us.
2. Why we use it
- To run the Testnet: process requests and transactions, show balances and activity, and keep the service working. This is needed to provide what you asked for.
- To control access: review applications, check invites, sign you in and revoke access. This is our legitimate interest in keeping the test private, and is needed to provide it.
- To protect the Testnet: rate limiting, abuse and sybil review, security and investigating problems. This is our legitimate interest.
- To run points, credits and roles: score activity, show leaderboards and grant roles. Linking accounts is your choice, and you can undo it.
- To improve the products: find bugs and understand which features get used, using telemetry. This is our legitimate interest.
- To meet legal duties: sanctions and access limits, and responding to lawful requests.
We don't use your data for automated decisions with legal or similarly significant effects. Sybil flags go to a person.
3. How long we keep it
| Data | Kept for |
|---|---|
| On-chain data | Public and permanent; we can't erase it |
| Wallet-to-Discord links | Until you unlink, and no later than 2027-03-31 |
| X connection held by our access bot | While the private testnet runs, or until you ask us to delete it |
| Points ledger (scores, linked wallets, referrals) | While the testnet programme runs; unlinking a wallet stops it counting, and corrections are recorded as new entries |
| Salted IP hash for points review | 30 days |
| Gateway raw request rows | 7 days |
| Gateway per-minute totals (no IP hash) | Kept, as they don't identify anyone |
| First-party telemetry | 90 days, and at most 250,000 rows by default |
| Server logs | About 7 days |
| Applications on Discord | Until staff remove them or you ask us to; Discord holds its own copy under its policies |
| Sign-in cookie and pass | Up to 7 days, or until you clear them |
Service providers keep their own logs under their own policies. We may keep data longer where the law requires it or where we need it to deal with a security incident or legal claim.
4. Wallet-to-social links
A link between your wallet and your Discord account is not put on chain. It lives in its own off-chain database, with access restricted to the service that needs it and to authorised operators, and no API exposes it. If you unlink, the link is deleted immediately. A daily job deletes every remaining link once its deletion date arrives, and that date is 2027-03-31. Leaderboards don't show a wallet next to a Discord handle unless you choose that.
5. On-chain data can't be erased
Blockchain data is public and is copied by nodes, data availability stores, explorers and anyone else who reads it, and part of it settles on Solana devnet. We can't delete or change it, even if you ask, and rights to erasure can't be applied to it in practice. A wallet address may also become linked to you if you publish it or connect it to an identity yourself. Don't put personal data on chain.
6. Who else receives data
These providers process data so that the Testnet can work, or because you use them directly. Each has its own privacy policy.
- Cloudflare: DNS, website hosting, file storage and traffic protection. It sees IP addresses and request data.
- Server hosting providers: the machines that run our apps, gateway and databases.
- Discord: our server, applications, bots and account linking.
- X: account verification, which reaches us through your Discord connection, and anything you post there.
- Telegram: our channel and group. Moderation and other bots run by third parties can read messages in the group.
- RPC providers: Solana RPC services used to read and settle to Solana devnet. They receive network requests from our servers. If your wallet or tools connect to one directly, it also sees your IP address.
- Google: sign-in for our operators to internal tools only. Testers' data isn't sent to Google for this.
We may also share data if the law requires it, to protect people or the Testnet, with professional advisers, or with a legal entity that takes over the Testnet, under this policy.
7. No sale of data
We don't sell personal data, and we don't share it with others for their advertising.
8. Cookies and browser storage
We use what is needed for access, not advertising. Our access gate sets one signed session cookie on its own address, HttpOnly and Secure, and each gated app stores a signed pass in your browser's local storage so that you stay signed in. Apps may also store settings in your browser. This site sets no cookies and loads no third-party scripts.
9. Your rights
Depending on where you live, you may have the right to:
- get a copy of your personal data and information about how we use it;
- correct inaccurate data;
- have data deleted, or its use restricted;
- object to uses based on our legitimate interests;
- receive your data in a portable form;
- withdraw consent where we rely on it, for example by unlinking an account;
- complain to your local data protection authority.
To use these rights, write to [PRIVACY CONTACT]. We may ask you to prove the account or wallet is yours, for example by signing a message. We never need your recovery phrase or private key. We can't erase on-chain data, and we may keep what the law requires. You can unlink a wallet or your Discord account yourself where the points feature offers it, and exercising your rights may end your access where the data is needed to provide it.
10. International transfers
Our main servers are in Canada, and our providers operate in other countries, including the United States. Your data may be handled outside your own country, where privacy laws may differ. Where the law requires it, we rely on suitable safeguards such as standard contractual clauses or adequacy decisions [TRANSFER MECHANISM TO CONFIRM].
11. Security
We restrict access to personal data, keep sensitive files readable only by the services that need them, store access codes and client addresses in hashed form where described above, and use encrypted connections to our public services. No system is fully secure, and this is an experimental network, so please don't give us anything you wouldn't want at risk.
12. Age limit
The Testnet is for people aged 18 or over. We don't knowingly collect data from anyone younger. If you believe we have, contact us and we will delete it, apart from on-chain data, which can't be erased.
13. Changes to this policy
We may update this policy as the Testnet changes. We will publish the new version here and update the effective date, and give additional notice of material changes where reasonably possible.
14. Contact
Privacy questions and requests: [PRIVACY CONTACT]. General contact: [CONTACT EMAIL]. [EU/UK REPRESENTATIVE, IF REQUIRED]