Privacy Policy

[Company legal name], [Registered address], is responsible for the personal data described here. For anything in this policy, write to [privacy@ email].

• Account: your name, email address and a hash of your password. If you sign in with Google, we receive your name, email and Google account ID.
• Sessions: for each signed-in session, its start and expiry, and the IP address and browser it came from, so you can see and revoke your sessions in Settings.
• Organization data: organizations, members and roles, invitations, tokens (profiles), launches, strategies, notes, fees and settings.
• Wallets: wallet addresses, balances, and the encrypted signing keys of wallets created in Orbook. Watch-only wallets are addresses only.
• Activity: the audit log of who did what in each organization, launch logs, signed transactions and their receipts, and risk notices you acknowledged.
• Telegram: if you link Telegram for alerts, the chat ID we send them to.
• Support: what you send us when you contact us.

Everything Orbook sends on-chain (launches, trades, transfers, the addresses involved) is recorded on a public blockchain. Anyone can read it, and neither we nor you can delete it.

• To run the service you signed up for: sign you in, carry out launches, trades and strategies, and show your data. (Contract.)
• To keep accounts and funds safe: verify emails, detect abuse, keep the audit log. (Legitimate interest and legal obligation.)
• To send the alerts and emails you need: verification codes, invitations, transaction alerts. (Contract.)
• To meet legal duties such as sanctions screening and responding to lawful requests. (Legal obligation.)

We share data only with providers that help run Orbook, and only what each needs:

• Hosting and database providers: [hosting provider, region].
• Email delivery (Resend, or an SMTP provider): your email address and the message.
• Google, if you choose Google sign-in.
• Telegram, if you link it for alerts.
• Blockchain RPC nodes, block builders (such as Jito) and market data APIs (such as DEX Screener and 0x): wallet addresses and transactions, which are public anyway.

We don't sell personal data and don't share it for advertising.

Orbook uses only what it needs to work:

• Sign-in session cookie, set by our API when you sign in. It keeps you signed in for up to 12 hours and is strictly necessary, so it doesn't need your consent.
• Theme preference(light or dark), kept in your browser's local storage. It never leaves your device.

We don't use analytics, advertising or tracking cookies. If that changes we'll update this section and ask for your consent first.

An organization can share a Client Portal link that shows a token's trades, strategies, wallet balances, treasury operations and P&L, without a login. Anyone who has the link can see what the organization chose to show.

• The organization decides what the portal shows and who gets the link, and is responsible for that sharing.
• Opening a portal sets no cookie and doesn't require an account.
• The organization can revoke the link at any time; a revoked link stops showing data.

We keep account and organization data while the account or organization exists, and delete or anonymise it within [retention period] after it is deleted, unless the law requires us to keep it longer.

The audit log is append-only and hash-chained: each entry includes the hash of the one before it, so removing an entry would break the chain for the whole organization. When you ask us to erase your data, we remove your account details; audit entries that record what you did may be kept as the organization's record, where the law allows.

Depending on where you live, you can ask to see, correct, export or delete your data, object to how we use it, or complain to your data protection authority. Write to [privacy@ email]. We'll answer within the time the law sets. Data inside an organization you belong to may also be controlled by that organization.

Our providers may process data outside your country. Where the law requires it, we use safeguards such as standard contractual clauses: [transfer mechanism].

Wallet keys are encrypted at rest, passwords are stored as hashes, and access inside an organization is limited by role. See Security for detail.

We'll post changes here with a new revision and tell you in the app or by email when they matter.