Privacy Policy

DeFi Sentinel operates defisentinel.org and is the controller of the personal information described here. Our infrastructure is located in the United States and Singapore. For any privacy question or request, email [email protected] with "Privacy" in the subject line.

We collect only what a feature you actually use requires. Nothing in the table below is collected until you take the action in the middle column.

• Private keys, seed phrases or recovery phrases. We cannot access your funds and will never ask for these.
• Identity documents, government IDs or KYC records. We do not run identity verification.
• Card numbers or bank details. All payment is on-chain in USDC; no card processor is involved and we store no payment credential.
• Your name, postal address or phone number — unless you volunteer them in a message to us.
• Special-category data (health, biometrics, political or religious views). Do not send us any.

We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.

Membership payments, badge mints and any other on-chain action are recorded on a public blockchain by the network itself, not by us. This has consequences we cannot change:

• Anyone can see those transactions, and they are permanent. We cannot edit, hide or delete them, and neither can you.
• A wallet address is pseudonymous, not anonymous. If your address is linked to your identity anywhere — an exchange withdrawal, an ENS name, a public post — that link may extend to activity you performed here.
• Deleting your account with us removes our off-chain records. It does not and cannot remove anything from the blockchain.

Consider using a separate address if you want your activity on the Service kept apart from your main holdings.

We use a small number of cookies and browser-storage entries. Most are strictly necessary — the site cannot work without them and they are not used for tracking. Analytics is the only non-essential category, and it is off until you allow it.

You can change or withdraw your analytics choice at any time from the "Cookie settings" link in the site footer, and you can clear everything above through your browser's site-data settings. Clearing them signs you out and resets your preferences, but does not affect your membership, which lives on-chain.

We use Google Analytics to count page views and understand which research people find useful. It loads only after you accept analytics cookies in our banner, and only once you interact with the page.

• We do not send Google your wallet address, email or any other identifier of yours.
• Google receives your IP address as part of serving the request and uses it to derive an approximate location; we do not see raw IP addresses in our analytics reports.
• If you decline, no Google Analytics script is loaded and no analytics cookie is set.
• You can also block it independently with Google's opt-out browser add-on or any content blocker.

We additionally use Google Search Console, which reports aggregate search queries and page performance. It contains no information that identifies an individual visitor.

• To operate the Service — authenticate you, show your membership and badges, remember your preferences, and serve the pages you request.
• To provide what you asked for — process a membership purchase, run an audit job, deliver Telegram alerts, reply to your feedback.
• To keep the Service safe — detect abuse, enforce rate and coupon limits, investigate incidents.
• To improve the Service — understand which content and tools get used and where pages are slow.
• To comply with law and enforce our Terms.

We do not use your information for automated decisions producing legal effects, and we do not profile you for advertising.

Where the GDPR or UK GDPR applies, we rely on these bases:

• Performance of a contract — authentication, membership, badges, audit jobs and everything else you ask us to do under the Terms.
• Consent — analytics cookies, Telegram notifications and any optional email. You can withdraw consent at any time without affecting processing already carried out.
• Legitimate interests — security, abuse prevention, rate limiting, debugging, and keeping records of on-chain payments. We balance these against your rights and use the minimum data needed.
• Legal obligation — where we must retain or disclose information to comply with law.

We share information only with the service providers needed to run the Service, and only to the extent each one needs. We do not sell data.

We may also disclose information where legally required, to enforce our Terms, to protect our rights or the safety of others, or in connection with a merger or transfer of the Service — in which case this Policy continues to apply until you are given notice of a replacement.

Our infrastructure and providers are located primarily in the United States and Singapore. If you are in the EEA, the UK or another region with data-transfer rules, using the Service involves transferring your information to those countries. Where required, we rely on appropriate safeguards such as the European Commission's standard contractual clauses entered into by our providers.

• Account and membership records — for as long as your account exists, and afterwards only as needed to prove a payment or resolve a dispute.
• Sign-in nonces — minutes; they are consumed on use.
• Billing history — retained as a record of on-chain payments; the underlying transaction is public and permanent regardless.
• Feedback messages — up to 24 months, then deleted.
• Audit jobs and reports — up to 12 months, or until you ask us to delete them.
• Telegram subscription — until you send /stop, disconnect from the membership page, or block the bot.
• Server logs — typically 30 to 90 days, longer only where an active security investigation requires it.
• Analytics — per Google Analytics retention settings, currently up to 14 months.

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your information, to receive it in a portable format, and to withdraw consent. Residents of California and other US states with privacy laws have equivalent rights, including the right not to be discriminated against for exercising them — and we confirm we do not sell or share personal information as those laws define it.

To exercise any of these, email [email protected]. Because accounts are wallet-based, we may ask you to sign a message from the relevant address to prove it is yours — that is the only way we can verify a request without collecting more identifying information than we otherwise hold. We respond within 30 days, or the shorter period your law requires.

• Analytics — change your choice at any time from "Cookie settings" in the footer.
• Telegram — send /stop to the bot or disconnect from the membership page.
• Email — every optional email includes a way to stop receiving it.
• Deletion — we can delete your off-chain records, including feedback, audit jobs and Telegram link. We cannot delete on-chain transactions or badges; see section 4.

If you are in the EEA or UK you may also complain to your local data protection authority; if you are in the UK, that is the Information Commissioner's Office.

Browsers send Do Not Track signals inconsistently and there is no agreed standard for honouring them, so we do not respond to DNT. We do treat a Global Privacy Control signal as a request to decline analytics cookies. In any case, analytics never load unless you have affirmatively accepted them.

We serve everything over HTTPS, authenticate wallet sessions with signed messages and short-lived tokens, restrict administrative endpoints, and keep the data we hold to the minimum a feature needs. No system is perfectly secure, and you are responsible for the security of your own wallet and device. If we become aware of a breach affecting your information we will notify you and any regulator as the law requires.

The Service is not directed to anyone under 18 and we do not knowingly collect information from children. If you believe a child has provided us with information, contact us and we will delete it.

We may update this Policy. The "last updated" date above shows when the current version took effect, and material changes will be highlighted on the Service. Where a change requires your consent, we will ask for it before the change applies to you.

Privacy questions and requests: [email protected]

This Policy is governed by the laws of the State of Wyoming, United States, without prejudice to the mandatory data-protection rights of your place of residence.