Privacy Policy

Scope and interpretation

This Privacy Policy explains how information is handled in connection with the HODL CRYPTO WALLET website, its documentation, product presentations and browser-based tools. It covers the website at the address where this policy is published. It distinguishes information processed by the website itself from information handled by the platform that delivers or controls access to it.

In this policy, “personal information” means information relating to an identified or identifiable person. An IP address, an online identifier or a public blockchain address may be personal information when it can be connected with a person. “We”, “us” and “our” refer to the website operator identified in the Operator details panel, rather than to an independent blockchain, token issuer or hosting provider.

This policy does not describe an installed desktop wallet, browser extension, mobile application or third-party service unless that service expressly incorporates it. Any future release that introduces wallet connections, remote support, telemetry or transaction processing needs a notice reflecting its actual data flows before those features are used.

Who is responsible for information

The website operator is responsible for the purposes and means of the personal-information processing that it determines. Hosting, network security and access-control providers may act on the operator’s instructions for some activities and under their own responsibilities for others. The existence of a hosting relationship does not make those providers the operator of HODL CRYPTO WALLET.

Use the privacy contact in the Operator details panel for questions or requests concerning this website. Requests concerning a platform account, platform sign-in or a provider’s independent processing should also be directed to that provider through its published privacy channels. A provider may need to handle a request when the operator does not hold the relevant record.

The operator identity, country, contact channel and provider-specific retention arrangements must be completed and verified before this draft becomes an effective notice. The diagnostics page is a local preparation tool; it is not an inbox and does not deliver a privacy request.

Information involved in using the website

The current website does not offer HODL account registration, a newsletter subscription, a payment checkout or a form that sends a support ticket. Its interactive portfolio uses sample content. Opening it does not connect a wallet or retrieve your real balances. Information you type into local tools is handled in browser memory for the interaction described below.

Serving a website still involves technical request information. Hosting and delivery infrastructure can receive an IP address, requested URL, request time, browser or device headers, response information and security-related signals. Access-restricted hosting may additionally process sign-in and authorization information. The application does not maintain an HODL customer-profile database or deliberately add those request details to a marketing profile.

Local tools, drafts and diagnostic summaries

Guide searches and the guide assistant use the documentation included with the website. Search text is matched locally against these guides. Asset filters, network filters, interface tabs and the fee calculator also operate in your browser.

The transfer presentation can accept a recipient address and amount, check their format against the selected network and prepare a local draft. It does not sign or broadcast that draft. The account-name control updates the label for the current interface session. These values are not written to an application database, synchronized across devices or intentionally submitted to an application endpoint.

The diagnostic form creates a text summary after you choose to prepare it. Downloading writes a file to your device; copying places text on your clipboard using the browser’s permission model. The website does not send the resulting summary to support. Files, clipboard history, browser extensions and device backups may keep copies under your own settings. Review the text before sharing it elsewhere, and use a verified contact channel.

Information you should keep out of website fields

The website does not request, generate, import or store a recovery phrase, private key, signing key or wallet PIN. Its controls do not require identity documents, payment-card details or access to a bank account. Do not paste such information into searches, recipient fields, diagnostic descriptions or correspondence.

A public address or transaction hash can reveal financial activity when combined with public blockchain records. Provide only the public details needed for a particular question. Remove unrelated addresses, balances, names and screenshots of other people’s information. If you accidentally include sensitive material in a locally generated file, remove it from the file and any copies you control; the website cannot erase files or clipboard history on your device.

Cookies, local storage and preference controls

The current application does not include an analytics SDK, advertising pixel, session-replay tool or social-media tracking widget. Fonts and cryptocurrency images used by the interface are served with the website rather than loaded from a marketing or icon-tracking service. This describes the application implementation; hosting or access-control services can use their own technical cookies.

The Cookie settings control in the footer saves one application record, hodl-privacy, in local storage. That record contains the settings version, a true-or-false preference value, saved and expiry dates, and, only when optional preferences are enabled, the download platform and communication language you select. Local storage is a browser storage mechanism, not an HTTP cookie automatically attached to every request. A first-visit banner offers necessary storage only, optional preferences or a detailed settings panel. The record is written when you save a choice and read when the site checks your settings.

The Functional preferences switch enables memory of your download platform and preferred communication language. Selecting “Only necessary” records a false value and removes the remembered platform and language. A platform explicitly specified in a page link takes priority. You can change the choice in the same control or remove the record through your browser’s site-data settings. Changing the switch does not delete files you downloaded or manage a separate provider’s sign-in cookies.

The record expires 180 days after you save your choice. Expired or incompatible settings are removed when read, and the site asks for a new choice. It may be removed earlier by you or your browser. The core information pages remain usable if local storage is unavailable. The application does not treat silence, scrolling or ordinary navigation as consent to a future optional tracking feature.

Purposes and applicable legal grounds

Information should be used only for the purpose for which it is needed. The current purposes are delivering the website, administering access where restricted hosting is used, protecting the service, running local tools at your request and remembering a saved privacy choice. The implementation does not sell visitor information, run behavioral advertising or build a marketing audience.

Where the GDPR or comparable law applies, a legal basis must be identified for each relevant processing activity. Delivery, proportionate troubleshooting and abuse prevention may rely on legitimate interests in maintaining a usable and secure website, subject to the required balancing assessment. Responding to a binding legal duty relies on the applicable legal obligation. A legal obligation must actually apply; this policy does not create one.

Consent is appropriate where the law requires it for optional storage or another optional purpose. Consent must be specific to that purpose and capable of withdrawal. A contractual basis applies only where processing is objectively necessary for an actual contract or a step you request before entering one; reading a privacy policy does not by itself create such necessity.

The final legal-basis record must reflect the operator’s location, audience and provider arrangements. This draft does not claim that a particular national privacy statute applies to every visitor or that a consent preference authorizes uses not described here.

Hosting, access control and other recipients

The website is delivered using OpenAI Sites and Cloudflare infrastructure. These services can process connection, security and delivery information necessary to operate their platforms. If an access restriction requires platform sign-in, the platform handles authentication and authorization. That sign-in is separate from an HODL CRYPTO WALLET account and does not provide the website with custody of digital assets.

The current application does not use the available platform identity helper to create a visitor profile, display platform account details or store an HODL account record. Infrastructure-level information may nevertheless be present in the request environment or provider logs. Operator access, retention and provider roles must be assessed against the actual service configuration.

Information may also need to be disclosed in response to a lawful, applicable requirement, to investigate abuse or establish or defend a legal claim. Such disclosure should be limited to what is necessary and permitted. This policy is not a blanket authorization to transfer visitor information to an unrelated buyer or use it for an incompatible purpose.

External links and blockchain information

The website links to documentation, block explorers and other independent services. Following a link initiates a request to that destination, which can receive connection information and, depending on the browser and link configuration, referral information. The destination’s privacy terms govern its own processing. Its logos or links do not mean that it is operated by HODL CRYPTO WALLET.

A blockchain may keep addresses, transfers and other records publicly accessible for an extended or indefinite period. The current website does not write your inputs to a blockchain. If you separately use an installed application or a third-party service to publish a transaction, the resulting public record is outside this website’s storage controls. Deleting browser data does not erase an external blockchain record.

International processing

Hosting and access-control infrastructure may process information in countries other than your country of residence. The presence of a regional website address does not by itself establish that every request or support operation remains in one country. The applicable service configuration and contractual arrangements determine the relevant locations and responsibilities.

Where a transfer of personal information is subject to legal restrictions, a valid transfer mechanism and any required supplementary measures must be in place. Depending on the circumstances, these may involve an adequacy decision or approved contractual safeguards. This draft does not claim a particular mechanism has been signed or that a provider certification covers every activity. Information about applicable safeguards should be available through the operator’s verified privacy contact once the arrangements are confirmed.

Retention and deletion

The website distinguishes transient browser state, a persistent browser preference and infrastructure records. Search text, filters, draft transfers, edited account labels and unexported diagnostic summaries have no application-level persistent storage. They are normally lost when the relevant interface resets or the page is reloaded or closed; browser restoration features and device software may retain their own copies.

The hodl-privacy record expires 180 days after the last saved privacy choice and remains subject to your browser’s storage controls. Exported diagnostic files and clipboard copies remain under your control. The operator cannot remotely delete them. Clearing site data may also remove other settings associated with the same website origin.

Hosting and security logs follow the providers’ actual retention settings and contracts. No specific number of days is asserted here because those settings have not yet been confirmed for this deployment. Before publication, the operator must document the applicable period or sufficiently specific retention criteria, including any access-control records.

If the operator later receives correspondence through a verified contact channel, it should retain it only while necessary to resolve the request and meet applicable recordkeeping or legal-claim needs. Any legal hold should be limited to relevant material and reviewed when the reason ends. Backup deletion may follow a controlled rotation rather than immediate selective removal.

Security and device responsibilities

The current website minimizes application-level collection, uses HTTPS when served at its hosted address and avoids asking for signing secrets. These measures reduce exposure but do not make any device, network or online service immune to compromise. No statement on this website promises absolute security, uninterrupted availability or recovery of lost credentials.

Use an up-to-date browser and operating system, verify the website address and limit the permissions of browser extensions. On a shared device, close local tools and remove downloaded diagnostics or clipboard entries containing information you do not want another person to see. Keeping a public address out of a field may still be sensible even though that address is visible on a blockchain.

If a personal-information incident affects processing for which the operator is responsible, applicable investigation and notification duties must be followed. Whether notification is required, to whom and within what time depends on the relevant law and the circumstances. A provider incident must also be evaluated within the operator’s own responsibilities.

Your privacy rights

Rights depend on your location, the applicable law and the reason information is processed. They are not all unconditional, and some relate only to information the operator actually holds or can reasonably identify. Subject to those conditions, you may be entitled to the rights summarized below. Exercising a right should not result in unlawful discriminatory treatment.

For information held only in your browser, local deletion is often the most direct control: reset the page, clear site data or remove your own file. You may still ask about the operator’s processing. There is no need to reveal a private key or sign a financial transaction to make a privacy request.

• Access: ask whether your personal information is processed and obtain the information and copies required by applicable law.
• Correction: request correction of inaccurate information and completion of relevant incomplete information.
• Erasure: ask for deletion where the legal conditions are met, recognizing lawful retention exceptions.
• Restriction: request that processing be limited while a qualifying dispute or request is addressed.
• Objection: object to processing based on legitimate interests where the relevant law grants that right.
• Portability: receive or transmit certain information in a usable format where the applicable legal conditions are met.
• Withdrawal: withdraw consent for a consent-based activity without affecting processing that was lawful before withdrawal.
• Complaint: contact the competent supervisory authority or another legally available review body.

How requests should be handled

Use the privacy contact identified in Operator details and describe the website, your request and a reasonable way to respond. Include only information needed to locate the relevant record. For instance, a page URL and approximate request time may help identify a technical event; a full wallet history is generally not needed.

An identity check may be appropriate when there is reasonable doubt about the requester’s identity or authority. It should be proportionate to the risk of disclosing information to the wrong person. The operator should not collect an identity document as a routine condition when a less intrusive check is sufficient. An authorized representative may act where the applicable law permits.

Where GDPR response rules apply, requests are generally answered without undue delay and within one month. A permitted extension of up to two further months requires timely notice and reasons. Other laws can set different deadlines. If a request cannot be granted in full, the response should explain the relevant reason and any available complaint or review route. Charges or refusals are permitted only in the limited circumstances allowed by the applicable law.

Analytics, profiling and automated decisions

The current application does not use analytics tracking, advertising segmentation, session recording or profiling to make decisions about visitors. It does not carry out a solely automated decision with a legal or similarly significant effect on a person. The local guide assistant matches documentation text rather than evaluating a person’s finances or eligibility.

Local address-format checks, fee examples and category filters are interface functions. They are not credit scoring, identity verification, sanctions clearance, investment suitability assessments or transaction-risk guarantees. Infrastructure providers may operate their own automated abuse-detection or access-protection systems under their applicable terms.

Children and sensitive information

The website is intended to explain a financial-technology product to an adult audience and is not designed to solicit personal information from children. It does not operate a child account service or an age-verification flow. Do not submit information about a child through a diagnostic description or later contact channel unless there is a necessary and lawful reason.

If a parent, guardian or other person believes that information concerning a child has reached the operator, they should contact the verified privacy channel so the matter can be assessed and appropriate action taken. A request concerning data held only on a device or by an independent platform may require action with that device or platform as well.

Changes to this policy

The policy should be revised when the actual website processing changes or when a relevant legal requirement changes. The publication date and version identify the notice available at a particular time. Material new collection, optional tracking, wallet connections or a remote support service should be explained before the relevant processing begins, with consent obtained where required.

Continued browsing is not treated as consent to an unrelated new purpose. A change to this document does not retroactively make an undisclosed or unlawful activity lawful. Keep a copy if you need to refer to the policy that applied at a particular time. Substantial changes should be brought to users’ attention in a manner appropriate to their impact.

Contact and related information

For the website’s privacy practices, contact the operator using the completed Operator details panel. Do not use a sample blockchain address as a contact channel and do not send funds to verify a request. The local diagnostics form does not submit messages. A working contact address must be provided before this draft is published as the effective policy.

Read the Terms of Use for the scope of the website and the limitations of its product presentation. Cookie settings in the footer controls the local application preference described here. Independent hosting, authentication and linked services may provide separate controls and notices for their own processing.