Privacy Policy

> **Draft for legal review.** Replace every `[bracketed]` item and have a lawyer check it against the privacy laws that apply to you and your users (for example the GDPR if you have users in the EU or UK). This policy explains what personal data **[Company legal name]** ("Zaryn", "we") processes when you use zaryn.xyz, its API and the `zev` tool connected to it, why, and your rights. The data controller is [Company legal name], [address]; contact [privacy email]. ## What we collect | Data | Where it comes from | Why | |---|---|---| | Username, display name, bio, website, avatar | You | Your public profile | | Email address, confirmed with a one-time code | You, or your organization's single sign-on | One account per person, account recovery, notices you asked for, receipts | | IP address and network you signed up from | Your sign-up | Preventing automated and mass sign-ups — kept 90 days | | Devices and AI agents you approved (their name, the IP they asked from, the access you granted) | Your approvals | Showing you what can act for you, and letting you revoke it | | Public keys of your devices and the zev CLI | Your devices | Signing you in without passwords | | Repositories, packages, images, issues, comments, messages | You | Providing the Service (see the Terms) | | Pages you open on the website, with your IP address, the country and network it is in (and whether that network is a VPN, Tor, proxy or datacenter), the site that sent you, campaign tags in the link, your language, browser, operating system, screen size and time zone, how long a page was visible, and an id for the browser tab that lives only in its memory (no cookie, nothing stored on your device) | Your visits | Counting visitors, seeing where they come from, and spotting automated or abusive traffic — kept 90 days, then only daily totals per country remain | | IP address, user agent, request logs | Your requests | Security, rate limiting, abuse prevention, debugging — kept [30] days | | Audit log of security-relevant actions | The Service | Security and your organization's audit trail — kept up to 365 days | | Payment records: invoice amounts, network, transaction id, paying wallet address | Public blockchains when you pay | Crediting payments, receipts, accounting and legal obligations — kept as long as tax law requires | | Abuse reports, including an optional email | Reporters | Handling the report | We do **not** sell personal data, show ads, or use your private content to train machine-learning models. ## Legal bases Performing our contract with you (running your account and content); our legitimate interests (security, preventing abuse, improving the Service); legal obligations (tax, accounting, lawful requests); and your consent where we ask for it. ## Sharing We share data only with providers that help us run the Service, under contracts that protect it — [hosting provider, location], [offsite backup provider, location], [email provider], [blockchain RPC providers, who see the payment lookups we make] — and when the law requires. Public content and public blockchain transactions are visible to everyone by their nature. ## Where data is stored Our servers are in **[country]**. When data leaves your country, we rely on [adequacy decisions / standard contractual clauses]. ## How long we keep it Account data while your account exists; after deletion, backups age out within [30] days. Logs [30] days. Payment records for [7–10] years as tax law requires. Content you made public or published to IPFS may persist in copies others made. ## Security Encrypted connections (HTTPS), key-based sign-in, least-privilege services, encrypted offsite backups, and an audit log. Report vulnerabilities to [security email]. ## Your rights Depending on where you live, you may access, correct, export or delete your data, object to or restrict processing, and complain to your data-protection authority. Most of this you can do yourself in Settings; for the rest, write to [privacy email]. We answer within 30 days. ## Cookies and local storage The web app keeps your sign-in and preferences in your browser's storage. We use no advertising or third-party tracking cookies. ## Children Zaryn is not for children under 13, or under the age of digital consent where you live if that is higher (13 to 16 in the EU). If we learn that an account belongs to someone younger, we delete it and its data. A parent or guardian who thinks this has happened can write to [privacy email]. ## Changes We will announce material changes at least 30 days before they apply. *Last updated: [date]*