Legal

Privacy Policy

Last updated: August 7, 2026

This policy describes the data chironchain.com collects, what it does not, and how the operator (the pseudonym “Chiron” / @chironchain) handles it. The policy is written to mirror what the website actually does. If you find a discrepancy, the actual code is the source of truth, and we will fix the policy.

1. What this policy covers

This policy covers chironchain.com only. Clicking “Become a member” takes you to this site’s own onchain checkout at chironchain.com/checkout, where your wallet pays the membership contract on Base directly — there is no third-party checkout site in the flow. Verification and group access run through @ChironsCaveBot on Telegram, governed additionally by Telegram’s own privacy policy. The bot stores a binding between your wallet address and your Telegram user ID solely to gate access to the private group.

2. What we collect

a. Wallet addresses

We may receive an inviting member’s wallet address when we serve a referral landing page (e.g. chironchain.com/r/<id>): the opaque referral ID rides the checkout URL and is resolved to the inviter’s wallet on the server, then embedded as the referrer-fee recipient in the purchase transaction. Wallet addresses never travel in URLs. As a buyer, your browser connects your wallet directly to the Base blockchain on /checkout; your address is used in-page to construct the transaction and is never sent to our servers. Wallet addresses we do receive are public blockchain data; we do not consider them personal data in isolation, but we treat them as identifying information for the purposes of this policy. Lawful basis: our legitimate interest in operating an honest referral program for members.

b. Referral attribution

Existing members may share referral links of the form chironchain.com/r/<id>. When such a link is clicked, we record an attribution event so the inviting member sees their referral count. The referral system stores click counts keyed by the inviting wallet address. We do not store the visiting user’s wallet address. Lawful basis: our legitimate interest in operating a referral program for members.

c. One first-party cookie

When you visit a referral link, we set a single first-party cookie called ref-visitor-id. This cookie contains an opaque random UUID, expires after 24 hours, and is marked HttpOnly, Secure, and SameSite=Lax. Its sole purpose is to deduplicate rapid repeat clicks on the same referral link from the same device, so a single visitor cannot inflate a member’s referral count by refreshing. Lawful basis: our legitimate interest in operating an honest referral counter.

d. Web analytics

We use a privacy-respecting cookieless web analytics product in its default cookieless mode. It records page views and coarse device characteristics (browser type, screen size, country) without setting cookies or collecting personal data. See §5 for the named provider and its privacy policy. Lawful basis: our legitimate interest in understanding aggregate site usage.

e. Server logs

Our hosting provider records standard request metadata for every HTTP request, including IP address, user-agent string, request path, response status, and referrer. We use these logs only for operational monitoring, abuse detection, and rate limiting. We do not enrich, correlate, or sell server logs. Lawful basis: our legitimate interest in operating a secure service.

f. Operational state in our key-value store

We use a third-party serverless key-value store (named in §5). The keys we read or write on this site are:

• ref-id:<id>— resolves a short referral identifier to the inviting member’s wallet address.
• clicks:<wallet>— lifetime referral click count for an inviting member.
• clicks-day:<wallet>:<date>— per-day click count, used for graphs in the member-facing dashboard.
• clicks-feed:<wallet>— rolling sorted set of recent click events (timestamp + opaque cookie id), capped at 100 entries, used to render the “recent clicks” column of the same dashboard.
• click-dedup:<cookieId>:<wallet> — 24-hour dedup marker tied to the cookie above.
• events:funnel:<name>:<date>— aggregate funnel counters (e.g. events:funnel:site-visit:2026-05-04) with no per-user granularity.
• rl:<route>:<ip>— short-lived rate-limit counters keyed by IP address.

None of these keys contain off-chain personal information such as name, email, phone number, address, or payment data.

3. What we do NOT collect

• Minimal browser storage, no tracking storage. The site sets no cookies other than the single one named above. It uses two narrow pieces of on-device storage, neither containing an identifier we ever read server-side: a sessionStorage flag on buy-intent landing pages (so returning from checkout with the Back button does not bounce you straight back to it; cleared when the tab closes), and, on the /checkoutpage only, the wallet library’s standard localStorage record of which wallet you last connected, which stays in your browser.
• No payment data. Payment happens onchain in USDC, directly from your wallet to the membership contract. We never see a credit-card number, bank details, or any off-chain payment instrument.
• No email, phone, name, or address. The site has no signup form, no newsletter, and no contact form.
• No precise geolocation. We do not request, read, or store geolocation. We do not derive country from IP. We do not read any cf-ipcountry-style header.
• No browser fingerprinting. We do not fingerprint browsers beyond the coarse, cookieless device metrics our analytics product collects.
• No advertising trackers. No Meta Pixel, no Google Analytics, no Hotjar, no third-party retargeting.

4. Cookies summary

That is the entire cookie inventory.

5. Third parties we share data with

• Vercel— hosting and cookieless analytics. Privacy policy.
• Upstash— key-value storage for referral counters and rate-limit state. Privacy policy.
• Base RPC (Coinbase) — on the /checkout page your browser queries the Base blockchain directly (price, balance, allowance), which exposes your wallet address and IP to the RPC operator the same way any onchain app does.
• WalletConnect (Reown)— only if you choose a QR-code or mobile deep-link option in the connect dialog on /checkout, your browser opens an encrypted pairing channel through the WalletConnect relay (plus the SDK’s config and telemetry endpoints), which exposes your IP to the relay operator. Browser-extension wallets never touch it. Privacy policy.
• Unlock Protocol— the onchain membership contract standard our lock runs on (the protocol, not their website). Privacy policy.
• Base— the public Layer-2 blockchain on which the membership contract lives. Wallet addresses and onchain transactions are public by design.
• Telegram— the messaging platform on which the Cave operates after checkout, via @ChironsCaveBot. Privacy policy.

We do not sell, rent, or trade data to anyone. We share data with the third parties above only to the extent required to provide the service.

6. International transfers

Our hosting and key-value providers operate in the United States and the European Union, and your data may be processed in either region depending on routing. Where required, our processors rely on Standard Contractual Clauses or equivalent transfer mechanisms.

7. Retention

8. Your rights

Depending on where you live, applicable law (such as the EU GDPR, the UK GDPR, or the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA)) may give you the right to:

• request a copy of the data we hold about you;
• request correction or deletion of inaccurate data;
• object to or restrict processing carried out on the basis of legitimate interest;
• request portability of data you provided to us; and
• lodge a complaint with your local data-protection authority.

To exercise any of these rights, contact us by direct message to @chironchain on X. We will respond within 30 days. Because the site collects no off-chain identifiers, the most actionable request is typically deletion of records keyed to your wallet address; we will need you to prove control of that address (for example, by signing a message) before acting.

9. Changes

We update this policy by changing the “Last updated” date at the top. Because we maintain no email list, we do not notify you of changes by email; you should re-read this page when significant product changes occur.

10. Contact

Questions, requests, and complaints: direct message @chironchain on X.