Privacy Notice

This Privacy Notice explains how the operator of Moonseum (“Moonseum,” “we,” “us,” or “our”) handles personal information when you use moonseum.io and related pages, APIs, account tools, and discovery services that link to this Notice (the “Service”). Moonseum determines the purposes and means of the off-chain processing described here. Public blockchains operate independently and their participants may separately determine how blockchain data is processed. The Service is non-custodial and does not request or store private keys or seed phrases.

Account and profile data: email address, authentication identifiers, display name, username, biography, avatar or banner URLs, account timestamps, and preferences you provide. Wallet and blockchain data: public wallet addresses, wallet-link verification status, token or NFT ownership data, public transactions, signatures used for verification, and publicly available collection or asset metadata. Public blockchain information may reveal activity associated with a wallet even if you do not create an account. Feature data: watchlists, cart items, notification preferences, price alerts, search history, collection drafts, listing drafts, and support or privacy-request information. Technical and security data: IP address, request metadata, device or browser information, authentication cookies, rate-limit records, error details, security events, and operational logs. We configure telemetry to avoid intentionally transmitting authorization headers, cookies, request bodies, private keys, seed phrases, or wallet signatures. Local data: essential cookies and browser storage used for authentication state, theme, currency preference, and guest watchlists.

We collect information directly from you, from your browser or wallet when you interact with the Service, from public Solana blockchain records, and from service providers that supply authentication, hosting, database, RPC, collection, NFT, market, security, or operational information.

We use information to provide and personalize discovery and account features; authenticate users and link wallets; display profiles and public asset activity; sync watchlists and preferences; save and manage drafts; respond to requests; maintain security and prevent fraud, abuse, manipulation, or Terms violations; debug, monitor, and improve the Service; comply with law; and establish, exercise, or defend legal claims. Where applicable law requires a legal basis, we process information to perform our contract with you, pursue legitimate interests in operating and securing the Service, comply with legal obligations, and obtain consent where required. We do not intentionally sell personal information, use it for cross-context behavioral advertising, or use it to train general-purpose artificial-intelligence models.

Public wallet addresses, profiles you make public, and blockchain transactions can be visible worldwide and copied by anyone. Blockchain records generally cannot be altered or deleted by Moonseum. Deleting your Moonseum account removes supported off-chain records but cannot erase public blockchain data, third-party copies, or records another party must retain.

We disclose information as needed to operate the Service with Vercel (hosting and delivery), Supabase (authentication, database, and managed backups), Upstash (distributed rate limiting), Better Stack (redacted operational telemetry), Solana RPC or indexing providers, and marketplace-data providers. Providers process data under their own terms and, where applicable, on our behalf. We may also disclose information when required by law or valid legal process; to protect users, rights, safety, and the Service; to investigate fraud or security incidents; with your direction or consent; or as part of a merger, financing, reorganization, sale, or transfer of the Service, subject to appropriate protections. Wallet and blockchain data may be inherently public.

We use essential authentication cookies and browser storage for security, session continuity, theme, currency preference, and guest watchlists. These technologies are necessary for requested features or remember choices. We do not currently use third-party advertising cookies. Clearing cookies or local storage may sign you out, remove local watchlists, or reset preferences.

We retain account, profile, wallet-link, preference, and user-created feature data while your account is active or as needed to provide the Service. Account deletion removes supported off-chain account records through the server-controlled deletion process, subject to security records, legal holds, fraud-prevention needs, and managed-backup expiry. Wallet verification challenges expire after five minutes and used or expired records are scheduled for daily deletion after the configured retention window, currently 24 hours. Security, request, and error logs are retained only as long as reasonably needed for operations, incident response, abuse prevention, legal compliance, and backup cycles. Public blockchain data cannot be deleted by Moonseum.

Account settings let authenticated users export account data, unlink eligible non-primary wallets, and permanently delete their Moonseum account after recent authentication. You may also have rights under applicable law to access, correct, delete, restrict, object to, or obtain a portable copy of personal information, withdraw consent, and appeal or complain to a privacy regulator. We may verify a request by requiring access to the relevant authenticated account or other information reasonably necessary to prevent unauthorized disclosure or deletion. We will not discriminate against you for exercising a privacy right. Some requests may be limited by law, security, another person’s rights, public blockchain permanence, or records we must retain.

Moonseum and its providers may process information in the United States and other countries whose data-protection laws differ from those where you live. Where required, providers or Moonseum use recognized transfer mechanisms or other lawful safeguards. The production database is currently hosted in the United States, in the us-east-1 region.

We use safeguards designed for the nature of the Service, including HTTPS, non-custodial wallet architecture, server-controlled sensitive mutations, database row-level security, authentication controls, distributed rate limiting, redacted telemetry, maintenance jobs, and release checks. No system is completely secure. You are responsible for protecting your wallet, private keys, seed phrase, email account, and device. Moonseum will never ask for a seed phrase or private key.

The Service is intended only for people age 18 or older and is not directed to children. We do not knowingly collect personal information from a child under 13. If we learn that we collected such information, we will take reasonable steps to delete it. A parent or guardian who believes a child provided information should use a verified support channel published in the Service.

We may update this Notice as the Service, providers, or law changes. We will post the revised version and effective date. If a change is material, we will provide additional notice through the Service where reasonably practicable.

Authenticated users can exercise supported access, portability, wallet-unlinking, and deletion choices through Account & Privacy settings. Other privacy questions or requests may be submitted through a verified support channel published within the Service. Never include a seed phrase, private key, password, or unnecessary wallet signature in a request.