Privacy Policy
This policy explains what personal data degen.zone (we, us) collects when you use the degen.zone website, application, API and embeds (the Interface), why, on what legal basis, who processes it, how long it is kept, and the rights you have. It is written for the EU General Data Protection Regulation (GDPR) and applies to everyone who uses the Interface.
- Version
- 2026-10-17
- Effective
- 2026-10-17
1. What this covers
degen.zone is the controller of the personal data described here. This policy covers the Interface only. It does not cover the public blockchains you transact on, your wallet software, the third-party protocols and launchpads your transactions call, or social platforms you may link - each has its own policy (section 12).
The Interface is non-custodial and has no accounts in the traditional sense: there is no email sign-up, no password and no identity verification. Your wallet address is your identifier. We aim to collect as little as the Interface needs to work and to be defensible.
2. What we collect
| Category | Source | What exactly |
|---|---|---|
| Wallet addresses | You, on connect / sign-in | The public address of each wallet you connect (EVM and/or Solana); which one signed in; the referral code that brought you, if any. |
| On-chain activity | Public blockchains | Launches, trades, liquidity actions, claims, holdings and fee accruals tied to wallet addresses, indexed from public networks so we can show tokens, charts, holders, rankings, PnL, referral attribution and creator earnings. |
| Profile data (optional) | You | A username, avatar image and bio if you set them; tokens you watchlist; notification state. Token metadata you upload as a creator (name, ticker, image, description, links). |
| Terms acceptance | You, on first connect | The wallet address, the accepted version (currently 2026-10-17), the time, a one-way hash of your IP address (salted, never the raw address) and a truncated browser identifier - our evidence that this wallet accepted these documents. |
| Request metadata | Your browser / device, automatically | IP address, request headers (user agent, referrer, language), timestamps, requested URLs and response codes, held transiently by our servers and edge provider for rate limiting, abuse prevention, debugging and security. |
| Social account links (optional) | X / Telegram, with your consent | When you link an account: the provider’s stable numeric account id, the handle and display name at the time (cached), an avatar URL, and the wallet signature proving you control the linked wallet. Access tokens are used once to read who you are and are not stored. For Telegram raid groups: the group id you bind. |
| Support and correspondence | You | What you send us on our public channels. |
We do not collect your name, postal address, date of birth, government identifiers, payment-card details or bank details, and we do not run identity verification. We do not read your private keys - no software of ours ever sees them.
3. Why we use it
- To provide the Interface - show tokens, charts, holders, your holdings and PnL, creator earnings and referral attribution; build the transactions you sign; keep a signed-in session; deliver notifications you opted into.
- To run the fee, reward and referral mechanics - attribute referral earnings, sign claim vouchers for the amounts the on-chain data shows you are owed, distribute holder rewards and creator-fee splits as configured on-chain.
- To record your acceptance of our Terms and enforce its eligibility rules.
- To keep the Interface secure and available - rate limiting, abuse and bot detection, debugging incidents.
- To moderate - act on reports, hide infringing or impersonating content, block wallets that breach the Terms.
- To comply with law - respond to lawful requests, meet record-keeping obligations, defend claims.
- To understand usage in aggregate - counts and totals derived from our own logs and on-chain data (for example launches per day). We do not run third-party analytics or advertising trackers and we do not build advertising profiles.
4. Legal bases (GDPR Article 6)
| Processing | Legal basis |
|---|---|
| Providing the Interface to a connected wallet, keeping a session, showing your holdings and earnings, building transactions | Performance of a contract (the Terms of Use), Art. 6(1)(b) |
| Recording Terms acceptance (address, version, time, hashed IP, user agent) | Legitimate interest in evidencing agreement and enforcing eligibility, Art. 6(1)(f); and legal obligation where applicable, Art. 6(1)(c) |
| Rate limiting, abuse prevention, security logging | Legitimate interest in a secure and lawful service, Art. 6(1)(f) |
| Indexing public blockchain data and displaying it against wallet addresses | Legitimate interest in providing a market interface over data that is already public, Art. 6(1)(f) |
| Optional profile, watchlist and notification settings | Performance of a contract, Art. 6(1)(b) |
| Linking an X or Telegram account | Consent, Art. 6(1)(a) - withdrawable by unlinking |
| Non-essential local storage (theme, currency, search history, referral code) | Consent, Art. 6(1)(a), given by using the feature; see section 6 |
| Responding to legal requests, defending claims | Legal obligation, Art. 6(1)(c); legitimate interest, Art. 6(1)(f) |
Where we rely on legitimate interest we have balanced it against your rights and expectations; you can ask for details of that assessment, and you can object (section 11).
5. Public blockchain data
Every transaction you sign is written to a public blockchain by the network, not by us, and is public, permanent and outside our control. It can be read by anyone, forever, and linked to your wallet address by anyone. We index this public data to show it in the Interface, but we cannot delete, correct or hide it on the chain itself. Your rights under section 11 apply to the copies we hold, not to the ledger.
A wallet address is pseudonymous. If you connect it to information about yourself - for example by linking an X account, setting a username, or publishing the address elsewhere - it may become personal data that identifies you. Please consider this before linking.
7. Who processes data for us
We use a small number of service providers who process data on our behalf under data-processing agreements, and a number of third-party networks and APIs that your browser or our servers call to make the Interface work:
| Provider | Role | Data |
|---|---|---|
| Vercel Inc. | Hosts and serves the web application | Request metadata for every page load (IP, headers, URLs); short-lived edge logs. |
| Hetzner Online GmbH | Hosts our API, database, indexers and backups (EU data centres) | Everything in section 2 that we store: addresses, indexed activity, profiles, Terms acceptances, social links, request logs. |
| Cloudflare, Inc. | Edge network in front of our API (DDoS protection, TLS) | Request metadata in transit; passes the client IP to our API for rate limiting. |
| RPC providers | Read from and broadcast to blockchains (for example QuickNode, public RPC endpoints of Robinhood Chain, Arc, Base and Solana) | Your browser sends them the transactions you sign and the addresses it queries, with your IP address, directly. |
| Reown (WalletConnect) | Wallet connection modal, embedded email / social wallets, WalletConnect relay | Wallet connection metadata; for embedded wallets, the email or social login you choose to use with Reown under Reown’s own policy. Analytics are disabled in our configuration. |
| LI.FI, Jupiter | Bridge / swap aggregation (LI.FI) and Solana swap routing (Jupiter) | Your browser sends them the route request, including your wallet address and amounts, directly when you use those features. |
| X Corp., Telegram | Identity providers for optional account linking; Telegram bot for raid groups | Only when you start a link: the provider tells us your account id, handle, display name and avatar. Our Telegram bot receives messages in groups it is added to. |
| Price and market data APIs | Server-side reference prices (for example CoinGecko, Coinbase) and Chainlink feeds | No personal data; our servers fetch prices, not your browser. |
9. International transfers
Our own servers and database are in the European Union. Some processors (Vercel, Cloudflare, Reown, and the operators of some RPC endpoints and APIs) are established in or process data in the United States or elsewhere outside the EEA. Where that happens we rely on the European Commission's Standard Contractual Clauses, on an adequacy decision (including the EU-US Data Privacy Framework for certified recipients), or on another safeguard permitted by Chapter V GDPR. Blockchain networks are global by nature; a transaction you broadcast is replicated worldwide by the network, not transferred by us.
10. How long we keep it
| Data | Retention |
|---|---|
| Terms acceptance records | For as long as the wallet could plausibly bring or face a claim about the Terms: at least the statutory limitation period after the last activity of that wallet, then deleted or anonymised. |
| Wallet addresses, profiles, watchlists, social links | While the wallet keeps using the Interface. Unlinking a social account deletes the link at once; the account record itself is deleted when no wallet references it. |
| Indexed on-chain activity | Indefinitely, as a historical market record derived from public data. It can be re-derived from the chain at any time. |
| Signed-in session | Tokens expire after 7 days; a session is dropped when you disconnect or switch wallets. |
| Request and security logs (incl. IP addresses) | Rotated within a short period - typically days, at most 30 days - unless needed for an ongoing security investigation. |
| Backups | Encrypted database backups are taken every few hours and rotated on a rolling schedule; deleted data leaves backups as they age out. |
| Correspondence | For as long as needed to handle the matter and any follow-up. |
11. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you, and receive a copy;
- rectify inaccurate data (you can edit your own profile at any time);
- erase data where there is no longer a legal ground to keep it - note that we cannot erase anything from a public blockchain, and that we may keep Terms acceptance records and security logs where we have an overriding legitimate interest or legal obligation;
- restrict processing, or object to processing based on legitimate interest;
- portability - receive the data you provided in a machine-readable form;
- withdraw consent at any time where processing is based on consent (for example by unlinking a social account or clearing local storage), without affecting processing that happened before;
- lodge a complaint with the data-protection supervisory authority of the EU member state where you live or work.
To exercise any of them, write to team@degen.zone and say which right you are exercising and which wallet address it concerns.
Because your identifier is a wallet address, when you exercise a right we will ask you to prove control of it by signing a message; we cannot act on a request about an address you cannot sign for. We answer within one month, extendable by two more months for complex requests. We do not make decisions about you by automated means that have legal or similarly significant effects.
12. Third-party wallets and services
Your wallet (for example Phantom, MetaMask, Rabby or Backpack), any embedded wallet you create through Reown, the blockchains you transact on, the protocols and launchpads your transactions call (Uniswap, Meteora, Raydium, PancakeSwap, pump.fun, PONS, LI.FI, Jupiter and others), block explorers we link to, and the social platforms you may link are all operated by third parties under their own privacy policies. We encourage you to read them. We are not responsible for their practices.
13. Children
The Interface is for adults. We do not knowingly collect data from anyone under 18 (or the age of majority where they live), and the Terms require every user to confirm they are at least 18. If we learn that a minor has used the Interface, we will delete the data we hold and block the wallet.
14. Security
We protect data with measures appropriate to its sensitivity: TLS on every connection, strict transport security, access controls and separate keys per role on our servers, encrypted backups, rate limiting, hashing of IP addresses in acceptance records, and no storage of provider access tokens. The most sensitive thing in this system - your private key - never reaches us at all. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the authority as the GDPR requires.
15. Changes to this policy
We may update this policy. Each version carries a version date at the top of the page (currently 2026-10-17). A material change is published here and every wallet is asked to accept the new version the next time it connects, together with the Terms of Use; immaterial changes may be made without a new acceptance.
16. How to reach us
For anything about this policy, or to exercise one of the rights in section 11, email team@degen.zone. It reaches the people who operate the Interface. We are not required to appoint a data protection officer and have not appointed one, so there is no separate DPO address: this one is it.
It helps to include the wallet address your request concerns - it is the only identifier we hold - and to expect a request to sign a message with it before we act.