Privacy Policy

• Your wallet address, when you sign in with it, and when it was first and last used to sign in.
• The Sprouts you plant: the display names you enter for yourself and the recipient, the occasion, card design and message, the unlock date, claim window, backup wallet, the stocks and amounts, and the contract's address and transactions.
• The gift card, sealed. The card's codes are encrypted in your browser with a key that only exists in the card link. We store the encrypted card, but we can't read the codes.
• Access Codes as a one-way hash only. The Claim Code never reaches our servers in readable form.
• Your Garden. Which Sprouts your wallet saved to its Garden. If you keep a Claim Code there, your browser encrypts it first with a key from your wallet's signature, which we never receive, so we store it but can't read it.
• A one-way hash of your IP address when a code is entered wrongly, to limit guessing. The IP itself isn't stored.
• Technical logs kept by our hosting providers (such as request times and errors), for security and fixing problems.

• On the blockchain: everything a Sprout's contract holds or does is public and permanent, including the sender's wallet, the backup wallet, the tokens and amounts, the unlock date, and the wallet it is finally sent to. Nobody, including us, can delete it.
• On Explore: the display names of the sender and recipient, which stocks, how long the Sprout is locked and its card design. Never the amount, wallets or message. Use a first name or nickname if you prefer.
• To the recipient: the names, occasion and the Sprout's outline. The amount, stocks and message are only revealed after it unlocks.

• While you plant a Sprout, a recovery copy (including the card's key) is kept in your browser's local storage so a closed tab doesn't lose the card. It is removed once you confirm you've saved the card.
• Cookies are only used to make the site work: your wallet sign-in session (up to 12 hours), and after you enter an Access Code, a signed cookie that remembers that one Sprout for 24 hours. No tracking cookies.
• Your wallet connection is stored by your wallet software, not by us.

Only to run Sprout: to create and show your Sprouts, deliver them to their recipients, send unclaimed ones to their backup wallet, keep the site secure and fix problems. We don't sell or rent your data, and we don't use it for advertising.

• Railway (hosting the website) and Supabase (database)
• Cloudflare (domain, network and email forwarding)
• Alchemy and public Base RPC nodes (reading the blockchain)
• WalletConnect / Reown (connecting mobile wallets)
• KyberSwap (price quotes and swap routes)

They may process data such as your IP address and wallet address to provide their service, under their own privacy policies. Some of them are located outside your country.

We keep a Sprout's details for as long as they are needed for it to be opened, claimed or sent to its backup, and to show you your history. Sign-in records and logs are kept for as long as they're useful for security. Blockchain data can't be deleted by anyone.

You can ask us for a copy of the data we hold about your wallet, or ask us to correct or delete it, by writing to support@sprout.gift. We may need to keep what a Sprout still needs to work until it is claimed or sent to its backup, and we can't change anything on the blockchain. Depending on where you live, you may also have the right to complain to a data protection authority.

A Sprout can be a gift for a child, but only adults can plant one. Recipients don't create an account, and we don't knowingly collect data from children beyond the display name a sender chooses.

We may update this policy; the date at the top shows the latest version. Questions or requests: support@sprout.gift.