Loading
Please wait
We're preparing everything for you
Minimal data: no accounts, no analytics, no ad trackers
We're preparing everything for you
What personal data CloakForge processes, why, who receives it, how long it is kept, and your rights under the GDPR.
Minimal data: no accounts, no analytics, no ad trackers. Wallet activity is public on-chain, and our hosting and RPC providers process your IP address to deliver the service.
The controller responsible for the processing described in this policy is:
CloakForge has no user accounts, no analytics, and no advertising trackers. We process a limited amount of personal data, mainly technical request data and the public wallet address you connect, to deliver the service. Your wallet activity is public on the blockchain.
We process personal data only for the purposes below:
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Deliver the website and build transactions | IP address (transient), wallet address, tool inputs | Art. 6(1)(b) – contract | Not stored by us. Hosting request logs at Vercel: 1 day |
| Security and error diagnostics | Redacted error logs: error message, error type, stack trace, a context label (such as the tool or API route) and a timestamp. Wallet addresses, URLs, signatures and request headers are redacted, and no IP address or browser details are included | Art. 6(1)(f) – legitimate interest in a secure, working service | Better Stack: 30 days; Vercel request logs: 1 day |
| Sanctions compliance | Country and region derived from your IP address by our host; wallet addresses you submit, checked on our server against a bundled public OFAC list (nothing is sent to a third party) | Art. 6(1)(c) – legal obligation; Art. 6(1)(f) | Not stored |
| Fee accounting and tax records | Payer wallet, fee, tool, transaction signature and time (read from the public blockchain) | Art. 6(1)(c) – legal obligation | As long as Czech tax and accounting law requires (up to 10 years) |
| Discount coupons | Coupon code you type (sent to Contentful as a lookup), transaction signature, opaque on-chain memo | Art. 6(1)(b) – contract | Not stored by us. Contentful holds only the coupon definitions; uses are counted from public on-chain history |
| IPFS uploads | The image or metadata you upload; your wallet address and signature (to authorise the upload) | Art. 6(1)(b) – contract | Public and permanent on IPFS. We can unpin our copy |
| Email requests and complaints | Email address, message content | Art. 6(1)(b) and (c) | Up to 3 years after the request is closed |
Blockchain and IPFS data is public and permanent. We cannot erase it.
When you enter recipient, freeze-target, or token addresses, or when the Token Auditor shows holder wallets, we process public blockchain data about those wallets only to perform your request and do not store it.
We use the processors below. Our server functions run in Frankfurt (Germany), but Vercel, Alchemy, and Pinata are US companies. Wallet providers, the Solana network, and IPFS are independent controllers or public networks.
| Recipient | Role | Location | Safeguard |
|---|---|---|---|
| Vercel Inc. | Hosting, server functions, request logs, IP-based country lookup | USA (server functions run in Frankfurt, Germany) | EU-US Data Privacy Framework + DPA |
| Alchemy Insights, Inc. | Solana RPC. Your browser connects to Alchemy directly, so Alchemy sees your IP address and wallet address | USA | DPA with Standard Contractual Clauses |
| A second RPC provider, if configured | Optional failover for Solana RPC requests made by our server (not by your browser). Receives the wallet addresses and transaction data in those requests, not your IP address | Depends on the provider | Provider’s contractual safeguards |
| Pinata Cloud, Inc. | IPFS pinning and gateway for uploads | USA | DPA with Standard Contractual Clauses |
| Better Stack | Redacted error logs | EU region | DPA |
| Contentful GmbH | Content management, tool settings and coupon definitions (no user data; it receives a coupon code only when you type one, as a lookup) | Germany / USA | Not applicable (no personal data beyond the coupon code lookup) |
| CoinGecko, Raydium APIs | Price and pool data requested by our server; no user IP address is sent | Various | Not applicable |
We do not set cookies and do not use analytics, advertising, or fingerprinting tools. The site and the wallet libraries it bundles store only the values below in your browser’s local storage. They are strictly necessary for functions you request (reconnecting your wallet, not showing a closed banner again), so no consent is required (§89(3) Act No. 127/2005 Coll.):
We do not profile you. Requests from blocked regions or sanctioned wallet addresses are refused automatically, as required by sanctions law.
You have the right of access, rectification, erasure, restriction, data portability, and objection. Email privacy@cloakforge.app. We answer within one month and may ask you to sign a message with your wallet to verify a request.
You may object at any time to processing based on our legitimate interests (Art. 21 GDPR).
We do not sell personal information or share it for cross-context behavioural advertising.
The Service is only for persons aged 18 or older.
We use a non-custodial design and redact sensitive fields from logs, but no system is perfectly secure.
We will post the new version on this page with its date.
For privacy questions or requests, contact us:
We keep personal data to the minimum needed to run the service. Questions or requests: privacy@cloakforge.app.