In short
What we collect
| Data | Why | Legal basis |
|---|---|---|
| Wallet address | Identifies your account and lets you sign in | Performance of our agreement with you |
| Account creation time, last sign-in time, number of sign-ins | Security and account history | Legitimate interest (security) |
| Card order: full name, name on card, email, phone, delivery address | To have your card issued by our card programme provider and delivered, and to contact you about your order | Performance of our agreement with you |
| Card waitlist email (only if you joined before ordering opened) | To tell you once that the card can be ordered | Consent (you can withdraw it at any time) |
| Temporary sign-in challenges | To verify your signature. Deleted within minutes | Legitimate interest (security) |
| Server logs (IP address, user agent, time) | Keeping the service running and preventing abuse. Held by our hosting provider | Legitimate interest (security) |
Card orders
When you order a card, we share your order details with Rain (Signify Holdings, Inc.), which runs our card programme, and with its licensed issuing partner. They need the details to issue the card and may verify your identity as the law requires. We also share your name and address with the carrier that delivers the card. Rain and the issuer process your data under their own privacy notices, which you receive with the card. Rain is based in the United States, and such transfers rely on safeguards such as the EU Standard Contractual Clauses. We don’t collect card numbers or PINs: those are handled by the issuer only.
What we don’t collect
We never ask for or receive your seed phrase or private keys. Unless you order a card, we don’t collect your name or address. We don’t collect ID documents, bank details, card numbers or PINs. We don’t use analytics, advertising pixels or cross-site trackers.
Public blockchain data
Deposits, spends and withdrawals are transactions on Solana, a public blockchain. Anyone can see them, and they can’t be deleted by us or anyone else. Balances in the app are read directly from the chain through a Solana RPC provider (mainnet.helius-rpc.com), which, like any web service, can see the IP address your browser uses to connect to it.
How we use it
To run your account, to keep the service secure, and to get your card issued and delivered if you order one. We don’t sell or rent personal data, and we don’t use it for profiling or automated decisions about you.
Cookies & storage
We set one strictly necessary cookie, session, which keeps you signed in for up to 7 days. It is http-only and can’t be read by other sites. Your browser also stores which wallet you last used and a few interface preferences in local storage on your own device. Because these are strictly necessary, no consent banner is required.
Service providers
We use a hosting provider for the website and a database provider for account records. They process data only on our instructions. Card orders are shared with Rain, its issuing partner and the delivery carrier, as described under Card orders. If data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.
Requests from authorities
We never sell, rent or trade personal data, and we don’t share it with advertisers or data brokers. We disclose personal data to a public authority only when we are legally obliged to, for example under a court order or another binding legal request. We check that each request is valid, disclose only what it strictly requires, and tell the people affected whenever the law allows us to.
Rain and its issuing partner are regulated. They have their own legal duties, for example to verify identity and report suspicious activity under anti-money-laundering law, which are described in their privacy notices.
Retention
Account records are kept until you delete your account. Card order details are kept while your order or card is active, and after that only as long as the law requires. A cancelled order’s details are deleted when you delete your account. Waitlist emails collected before ordering opened are deleted once you’ve been notified. Sign-in challenges expire after 10 minutes and are purged.
Your rights
You can access, correct, export or delete your data. Most of it is visible and removable on your account page. For anything else, reach us via X account announced soon. You can also object to processing, withdraw consent, and lodge a complaint with your data protection authority (in Sweden, IMY).
Contact
Questions about your data: X account announced soon.