Documentation and policies

• Website requests: hosting and network services receive IP addresses, requested URLs, timestamps, browser/device information and technical error or security data when delivering the sites.
• Wallet features: addresses you connect or enter, selected networks, public keys used for staking, balances, positions, delegations, rewards and transaction details. Records come from your wallet, public Flare or Songbird networks and the relevant data providers.
• Transaction preparation: token addresses, amounts, slippage settings and, where needed, your wallet address are used to prepare the action you request. Your wallet handles signing; the web interfaces do not ask you to supply a private key or recovery phrase.
• Managed-wallet counter: after a supported Yield Hub action, your address and transaction hash are sent to our server to check the public transaction. The counter stores a salted hash of the address and publishes a total. This is pseudonymisation, not anonymisation; a hash remains potentially linkable to a wallet.
• Local settings: wallet connection state, cached results, pending actions, staking reminders and display preferences may be stored in your browser. Local storage is not the same as a shared server database.
• Messages: if you email us, we receive your email address and whatever information or attachments you choose to include. Please send only what is needed.

Disconnecting a wallet stops the connection, but does not erase browser storage, previous support messages or public blockchain history.

We use technical and wallet data to deliver the pages and wallet tools you request, retrieve public positions, prepare transactions and troubleshoot failures. Our legitimate interests are operating a useful, reliable service and protecting it against abuse. Support correspondence is used to answer requests and resolve problems on the same basis.

The managed-wallet counter measures use of supported Yield Hub actions without publishing a list of wallets. Its proposed basis is our legitimate interest in measuring service use; the necessity, retention and balancing assessment must be approved before this draft is adopted. It is separate from wallet-connection analytics.

Optional processing that requires consent must stay off until you choose it, and consent must be withdrawable. A wallet connection, a transaction signature or continued browsing is not blanket consent to analytics. Browser notifications require your browser permission and can be disabled through the site settings and your browser.

Where a specific legal duty requires processing, such as handling a data-rights request, we rely on that obligation. You may object to processing based on legitimate interests. Without a wallet address, wallet-specific tools cannot operate; without contact details, we cannot reply to a message.

The sites use browser storage for connection continuity, requested features and preferences. A browser notification permission is not a cookie and does not create an email subscription. The current notification feature uses local browser notifications, not a Flare Oracle push subscription.

• Main website: local storage holds wallet caches, staking public keys and activity, pending deposits or withdrawals, notification settings and theme preferences. Routine wallet caches have a three-minute freshness window; older data can still be used as a fallback.
• Delegator App: wallet connection state uses SDK-managed cookies/storage. The theme cookie is session-based, the sidebar preference cookie lasts seven days, and persisted query results have a 24-hour reuse limit.
• Private review access: authorised reviewers can receive a signed, HTTP-only access cookie with a one-hour lifetime. It is not a general visitor account or advertising cookie.

Cache freshness and reuse limits are not deletion timers. Browser records can remain until replaced, removed by the app or cleared in browser settings. Clear site data separately for each domain; doing so can remove local reminders and pending-action tracking, but does not remove on-chain assets or revoke token approvals.

Optional Reown AppKit analytics is to be disabled in the Delegator App release accompanying this notice. Until that release is verified, the existing app configuration still enables it. Wallet connectivity can still involve technical processing by Reown/WalletConnect and your wallet provider; disabling optional analytics does not make those services anonymous.

• Hosting and storage: Vercel delivers the main website and processes request and operational data. A Redis-compatible service stores server-side data, including the pseudonymous wallet counter; the production provider and settings must be confirmed before adoption.
• Wallet connectivity: RainbowKit/wagmi and Reown/WalletConnect support connections to your chosen wallet. These services and the wallet provider may receive technical connection data and wallet addresses.
• Blockchain and protocol services: RPC services, including Flare public endpoints and QuickNode, and protocol APIs receive the queries needed for wallet features. Browser-direct requests expose your IP address to the recipient; wallet lookups can also expose the queried address. SparkDEX reward lookups use the wallet address. OpenOcean receives token/amount details and your address when building a swap through our server.
• Public networks: signed transactions and their contents are broadcast to the applicable network and can be viewed, copied and indexed by others.
• Support and administration: authorised developers and the email service handling our shared mailbox can access information needed for support or operations. Information may also be disclosed where a lawful request or legal obligation requires it.

Relevant provider notices include Vercel and Reown. External protocol, wallet and social links take you to independently operated services. This notice does not replace their policies.

Internet infrastructure, wallet services and blockchain networks may process information outside the European Economic Area. We cannot promise that all processing stays in the EU. For transfers under our control, an applicable lawful transfer mechanism, such as an adequacy decision or standard contractual clauses with any necessary additional safeguards, must be established.

The actual provider arrangements, regions and safeguards remain subject to verification before adoption of this draft. Ask info@flareoracle.io for information about the safeguards applicable to your data. Public blockchain publication is distinct from a controlled transfer to a contracted provider.

• Browser records: see the storage section above. Some pending-action records have age filters, but those filters do not guarantee that the underlying browser entry is deleted.
• Wallet counter: the current implementation has no automatic expiry for salted wallet identifiers. They avoid repeat counting for the lifetime of the counter. A proportionate retention decision and deletion process are required before this draft is adopted; the current behaviour is not a promise of time-limited retention.
• Support, logs and incident records: retention must be limited to the time needed to answer a request, investigate a problem, maintain security or meet an identified legal obligation. Provider log settings, mailbox rules and any longer legal holds must be recorded before adoption; this draft does not claim an unverified fixed deletion period.
• Blockchain records: public transactions may remain indefinitely. Flare Oracle cannot edit or erase the blockchain or copies held by independent participants.

Where the GDPR applies, you can request access, correction, erasure, restriction or portability of your personal data, subject to the conditions for each right. You can object to legitimate-interest processing and withdraw consent for processing based on consent, without affecting earlier lawful processing.

Email info@flareoracle.io with your request and enough context to locate the relevant data. We may need proportionate verification that it concerns you, but will never ask for a private key or recovery phrase. Requests normally receive a response within one month. If a permitted extension is needed because of complexity or number of requests, we must explain it within that first month.

You can complain directly to a data protection authority, including in the country where you live or work or where the alleged infringement occurred; you do not have to contact us first. Authorities include the Dutch Autoriteit Persoonsgegevens and Finland's Office of the Data Protection Ombudsman.

Blockchain permanence does not remove your rights over off-chain data we control. We will explain any lawful limitation on a request. Yield rankings and route checks are informational; the interfaces do not make decisions about you with legal or similarly significant effects solely by automated processing.

These financial tools are not directed at children. Do not send us children's information; contact us if you believe it has been provided. No internet service or smart contract can be guaranteed secure. Our information security policy summary explains the scope of our responsibilities and how to report a concern.

Changes will be dated here. Material changes to purposes or processing require appropriate notice before they take effect and fresh consent where required; a policy update alone is not consent.