Privacy notice (draft)
Draft for legal review. This notice is not in force. It describes what the current software actually does. Items in [square brackets] are for the lawyer to complete.
Last updated: [date]. Controller: [legal entity, address, contact].
Summary
Zauber has no analytics, no advertising trackers and no third-party cookies. We store your public wallet address and what is needed to run spells and orders. We never receive your seed phrase or private keys.
What we store
| Data | Why | Where | How long |
|---|---|---|---|
| Public wallet address | To keep your session, list your spells and orders | Database | [until you ask us to delete it] |
| Spells you publish (name, description, steps, visibility) | To show and share them | Database | Until you delete them |
| Order records (wallet, cast group, step type, order id, transaction signature, token mints, trigger text, size in USD, status) | To show your orders grouped by spell | Database | [retention period] |
| Session cookie (signed token with your wallet address) | To keep you signed in | Your browser, httpOnly | 7 days or until you disconnect |
| Order-engine session (encrypted access and refresh tokens) | To place and manage price orders for your wallet | Your browser, encrypted httpOnly cookie | Up to 30 days or until you disconnect |
We do not store IP addresses. To limit abuse, the server keeps, in memory only, a counter keyed by a hash of your IP address with a secret salt. It resets every minute and is never written to disk. Our hosting provider may keep standard access logs; see its notice.
Stored only in your browser
Your trading settings (slippage, expiry) and favourite spells are kept in your browser's local storage. They are not sent to us. Clearing site data removes them.
Who receives data
- Routing and order provider: your wallet address, the transactions you sign, and your orders, so it can quote, execute and hold orders. Its own privacy notice applies.
- Price history provider (GeckoTerminal public API): the token addresses whose charts you open. Requests come from our server, not your browser.
- Solana RPC provider: your browser asks it for your SOL balance, which reveals your IP address and wallet address to it.
- Hosting and database providers: [names], as processors.
The blockchain is public: transactions you sign are visible to anyone, independently of Zauber.
What we never do
We do not sell data, profile you for advertising, publish who authored a spell, or link your wallet to your identity.
Your rights
[Rights under applicable law (access, correction, deletion, objection, complaint to an authority) and how to exercise them.] You can delete your published spells at any time from Spellbook → Your spells.
Contact
[Contact email or form.]