Privacy Policy

1. Overview

Fund My Yacht ("the Site," "we," "us," "our") is committed to transparency — including how we handle your information. This Privacy Policy describes what data we collect, how we use it, and your rights regarding that data.

We collect minimal information by design. We do not require registration, email addresses, real names, or any personally identifiable information to use the Site.

2. Information We Collect

2.1 Blockchain Data (On-Chain)

When you interact with our smart contracts, the following data is recorded on the public blockchain:

• Your public wallet address
• Transaction amounts
• Timestamp of transactions
• Any message you choose to submit with your transaction

Important: Blockchain data is public, permanent, and immutable. We did not create this property — it is inherent to blockchain technology. We cannot modify, delete, or make private any data recorded on-chain, even upon request. This is a technical limitation, not a policy choice.

2.2 Analytics Data (Off-Chain)

We use Cloudflare Web Analytics, a privacy-first analytics service that:

• Does not use cookies or local storage
• Does not track individual users across sites
• Does not collect personally identifiable information
• Collects aggregate, anonymized metrics only: page views, referrer URLs, browser type, country, and device type

2.3 Information We Do NOT Collect

We do not collect, store, or process:

• Names, email addresses, phone numbers, or physical addresses
• Government-issued identification or KYC (Know Your Customer) data
• Payment card or bank account information
• Social media account information
• IP addresses (Cloudflare may process these transiently for DDoS protection but we do not store them)
• Private keys, seed phrases, or wallet passwords

3. How We Use Information

The limited information associated with the Site is used for:

• Displaying the public leaderboard (wallet addresses, donation amounts, and user-submitted messages)
• Calculating site statistics (total raised, donation count)
• Operating and improving the Site
• Understanding aggregate traffic patterns via analytics

4. Third-Party Services

The Site uses the following third-party services, each with their own privacy policies:

• Cloudflare, Inc. — Website hosting, CDN, DDoS protection, and privacy-first analytics. Cloudflare processes requests to serve the Site and may transiently process IP addresses for security. See: Cloudflare Privacy Policy.
• Blockchain RPC Providers (e.g., Alchemy, QuickNode, or public RPC endpoints) — Used to read data from and submit transactions to the blockchain. These providers may log IP addresses and request metadata per their own policies.
• Wallet Providers (e.g., MetaMask, Phantom, WalletConnect) — You connect your own wallet to interact with the Site. These are third-party applications with their own privacy policies. We do not access your private keys or wallet passwords.

5. Cookies and Tracking

The Site uses no tracking cookies, no advertising pixels, no fingerprinting, and no cross-site tracking technologies. Essential cookies may be used by Cloudflare solely for DDoS protection and site security (e.g., __cf_bm). These are strictly necessary and cannot be opted out of.

6. Data Retention

• On-chain data: Permanent and immutable. Cannot be deleted by anyone, including the Operator. This is an inherent property of blockchain technology.
• Analytics data: Retained per Cloudflare's data retention policies (typically 6 months for Web Analytics).
• Cached leaderboard data: Cached copies of on-chain data may be stored temporarily in Cloudflare Workers KV for performance. This data mirrors what is already public on-chain.

7. Your Rights

7.1 For EU/EEA Residents (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access personal data we hold about you
• Request rectification of inaccurate data
• Request erasure of your data ("right to be forgotten")
• Object to or restrict processing of your data
• Data portability

Important limitation: These rights apply only to off-chain data within our control. On-chain blockchain data is decentralized, public, and immutable — we technically cannot modify or delete it. This is a recognized limitation under GDPR guidance on blockchain technologies.

7.2 For California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act and California Privacy Rights Act, you have the right to:

• Know what personal information we collect and how it is used
• Request deletion of personal information
• Opt out of the sale or sharing of personal information
• Non-discrimination for exercising your rights

We do not sell or share personal information. The same on-chain limitations described in Section 7.1 apply.

7.3 For UK Residents (UK GDPR)

You have substantially similar rights as described under GDPR in Section 7.1. Contact us at the email below to exercise your rights.

8. Children's Privacy

The Site is not intended for use by individuals under the age of 18 (or the age of majority in their jurisdiction). We do not knowingly collect personal information from minors. If we become aware that a minor has used the Site, we will take steps to delete any off-chain data associated with that use. In compliance with the Children's Online Privacy Protection Act (COPPA), the Site does not knowingly collect personal information from children under 13.

9. International Data Transfers

The Site is hosted on Cloudflare's global network, which operates data centers in multiple countries. By using the Site, you acknowledge that data may be processed in countries outside your own, including countries that may have different data protection laws. Cloudflare maintains appropriate safeguards for international data transfers, including Standard Contractual Clauses (SCCs) where applicable.

10. Security

We employ reasonable technical measures to protect the Site, including Cloudflare's enterprise-grade DDoS protection, SSL/TLS encryption for all connections, and secure deployment practices. However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Smart contracts are deployed on public blockchains and their code is verifiable by anyone. While we strive for secure smart contract design, we do not guarantee that smart contracts are free from vulnerabilities.

11. Do Not Track

The Site respects Do Not Track (DNT) signals. Because we do not use tracking cookies or cross-site tracking, your experience is the same regardless of your DNT setting.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Your continued use of the Site after any changes constitutes acceptance of the updated policy.

13. Contact

For privacy inquiries, data access requests, or to exercise your rights under applicable law, contact:

privacy@fundmyyacht.com