1. Scope and operator
This draft explains the data handled by the Tokon website and its associated services. The legal identity and contact details of the operator responsible for this processing have not been provided. They must be completed before this becomes a final privacy notice. Public blockchain infrastructure is separate from the website’s databases and support service.
2. Information used by the service
- Wallet sessions: wallet addresses, network, signed login challenges, session identifiers and security timestamps.
- Trading: public balances, token holdings, transaction hashes, orders and signed order instructions used by the existing executor.
- Browser wallets: encrypted key backups, wallet names and addresses, registration proofs, trading preferences and spending limits. Plaintext private keys and unlock passwords are not intended to be sent to Tokon’s storage API.
- Community: public usernames, posts, replies, votes, saved posts, joined groups, moderation roles and action records. Saved-post selections are scoped to the signed-in wallet.
- Support: the signed-in wallet, ticket subject, category, messages, status and timestamps. Only the requester and platform support staff can access a ticket through the support interface. Hosting and storage providers process this data to operate the service.
- X and rewards: connected X account identifiers and username, connection timestamps, encrypted authorisation tokens, verification results, reward eligibility, reservations and claims.
- Identity verification: when you choose owner verification, the verification provider handles the submitted identity material; Tokon processes the integration’s status and reference data. The provider’s notice applies to its collection.
- Technical data: hosting and security services can process IP addresses, request metadata and operational logs. Browser storage is used for sessions, settings, wallet locking, transaction recovery and presence.
3. Purposes and proposed legal bases
These records support authentication, wallet features, requested transactions, account displays, rewards, community functions and support. Security checks, rate limits, moderation and audit records help prevent abuse and investigate failures. Where applicable law requires a legal basis, the operator must confirm the appropriate basis for each purpose, including performance of a requested service, legitimate interests assessed against user rights, legal obligations or consent. Optional X and verification flows begin when you choose to use them; this does not establish a legal basis for every related use of data.
4. Public information and recipients
Blockchain transactions and wallet activity may be publicly visible indefinitely, even if you stop using Tokon. Public community content can be copied by other people. Do not include sensitive personal details in public posts. Token-community admins do not receive access to private platform support tickets.
The service uses Vercel for website hosting, Cloudflare for application storage and media, Fly.io for backend services, blockchain RPC infrastructure, X for the optional account connection, and Didit for optional identity verification. Each processes data relevant to its function. Data may be processed outside your country. Applicable transfer safeguards, provider terms and the operator’s obligations must be confirmed for the final policy.
5. Storage, security and retention
Tokon uses access checks, encrypted key backups and encrypted X tokens. These measures do not make a compromised browser or device safe. Never submit a seed phrase, wallet password or private key in support tickets.
Data is not automatically deleted merely because you disconnect a wallet. Public blockchain data cannot be erased by Tokon. Removed forum content may remain in storage for moderation and investigation. Support records, audit records, backups and account records need an operator-approved retention schedule; no automatic deletion period is promised by this draft. The final notice must state the retention periods or criteria actually implemented.
6. Your choices and requests
You can disconnect your wallet, lock a browser wallet, manage local settings and revoke Tokon’s access in X. Revocation may affect features and does not automatically erase records already stored. Back up any generated wallet before clearing local data or requesting account deletion.
Depending on applicable law, you may have rights to access, correct, delete, restrict, object to processing or receive a copy of certain data, withdraw consent, and complain to a data-protection authority. Requests can be submitted through Support. A separate contact for people unable to sign in remains to be specified. Requests may require proportionate identity checks, and legal or technical limits can apply, particularly to public blockchain records.
7. Children and updates
The proposed service is intended for adults. The operator must establish a process for handling information received from children and rights requests. When this policy is finalised or materially changed, its date and notice should be updated. This draft does not claim regulatory compliance.