Privacy Policy

01 Scope and definitions

This Policy applies to information processed by XSPLASH when you use our website and app (collectively, the "Service") to send or claim crypto payments. Capitalized terms not defined here have the meanings given in our Terms of Service.

• "Personal data" means any information relating to an identified or identifiable natural person.
• "Process" means any operation performed on personal data, including collection, storage, use, disclosure, and deletion.
• "Escrow" means the on-chain smart contract on Solana in which funds are locked until the recipient claims them or the sender cancels for a refund.
• "@handle" means a public X (Twitter) username used to address a payment to a recipient.

02 Information we collect

We collect only the minimal information needed to route a payment to the right person and let them claim it. Specifically:

Recipient X @handle. When you send a payment, we process the recipient's public X @handle so we can resolve who the payment is for and later verify their claim through X sign-in (OAuth).

Wallet public addresses. We process the public Solana addresses of senders and recipients. These are already public information on the blockchain. We never receive or store your private keys or seed phrase.

On-chain transaction data. Deposits, claims, cancellations, and refunds are recorded on the public Solana blockchain. We read this public data to display payment status.

X account identifiers. When a recipient signs in with X to claim, we receive basic public profile information from X (such as the @handle and account identifier) to verify the claim and, if needed, create a wallet for them.

Optional email. We collect an email address only if you voluntarily provide one — for example to join a waitlist or contact support. It is never required to send or claim a payment.

Minimal product analytics. We may collect a small amount of optional, privacy-respecting usage data (such as which screens are viewed) to understand and improve the Service.

03 Information we do NOT collect

XSPLASH is non-custodial by design. We never collect, receive, store, or have access to:

• Your private keys or wallet secret keys;
• Your seed phrase or recovery phrase;
• Custody or control of your funds — funds only ever move between your wallet and the on-chain Escrow;
• Card numbers, bank details, or any fiat payment information — XSPLASH handles crypto only and does not process card or fiat payments.

Because we cannot access your keys or funds, we cannot move, freeze, or recover them on your behalf.

04 How we use information

We use the information described above to:

• Resolve a recipient from the @handle you enter and address the payment to them;
• Lock funds into, and release them from, the on-chain Escrow smart contract;
• Verify a recipient's identity through X sign-in so the correct person can claim;
• Create a wallet for a recipient who does not yet have one, so they can receive funds;
• Display payment, claim, cancellation, and refund status;
• Respond to support requests and, if you opted in, waitlist communications;
• Detect and prevent abuse, fraud, and security incidents;
• Maintain, debug, and improve the Service, and comply with our legal obligations.

We do not sell personal data. We do not use your data to train machine learning models.

05 On-chain and public data

XSPLASH runs on the public Solana blockchain. Deposits into Escrow, claims, cancellations, and refunds are permanent, public transactions visible to anyone.

We do not control the Solana blockchain and cannot remove, reverse, or edit data once it is recorded on-chain.

06 Third parties

To operate the Service we interact with a small number of third parties. Each is independent and operates under its own privacy policy:

• X (Twitter). Used for sign-in (OAuth) and to resolve and verify recipient @handles.
• Solana network. The public blockchain that records deposits, claims, cancellations, and refunds.
• Your wallet provider. The wallet you connect (such as Phantom, Solflare, or Backpack via WalletConnect) signs transactions with keys only you control.
• Analytics provider. We may use a privacy-respecting analytics provider for minimal, optional usage measurement.

We do not control these third parties and are not responsible for how they process data on their side. You should review their policies where relevant.

07 Cookies and analytics

We use a small number of cookies and similar technologies, limited to:

• Strictly necessary cookies to keep the app functioning and maintain your session while connected.
• Optional, privacy-respecting analytics to measure feature usage. We do not use these for cross-site advertising.

You can clear cookies in your browser at any time. You may opt out of analytics by enabling "Do Not Track" or by contacting us at the address in §12.

08 Data retention

We retain information only as long as needed for the purposes described in §04, or as required by law.

• On-chain data (wallet addresses and transactions) is permanent and public on the Solana blockchain and is outside our control.
• Handle-to-payment mappings are retained as needed to resolve and verify claims, then reduced or deleted.
• Optional email is retained while you remain on the waitlist or until you ask us to delete it.
• Analytics is retained in aggregated or pseudonymous form for a limited period.

We will delete or anonymize off-chain personal data within a reasonable period on request, except where retention is required by law or to resolve a dispute. We cannot delete on-chain data.

09 Your rights

Depending on your jurisdiction, you may have the right to:

• Access the off-chain personal data we hold about you;
• Correct inaccurate or incomplete personal data;
• Delete your off-chain personal data, subject to legal retention obligations;
• Restrict or object to certain processing;
• Receive a copy of your data in a portable format;
• Withdraw consent where processing is based on consent;
• Lodge a complaint with your local data protection authority.

These rights apply to off-chain data we control; public blockchain data cannot be altered or deleted. To exercise any right, contact us at the address in §12.

10 Security

We apply administrative, technical, and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, and destruction. Because XSPLASH is non-custodial, the security of your funds depends primarily on your own wallet and the on-chain Escrow smart contract — we never hold your keys.

NO METHOD OF TRANSMISSION OR STORAGE IS PERFECTLY SECURE. WHILE WE WORK TO PROTECT YOUR INFORMATION, WE CANNOT GUARANTEE ABSOLUTE SECURITY. KEEP YOUR WALLET AND SEED PHRASE SAFE — WE CANNOT RECOVER THEM. IF YOU BELIEVE YOUR WALLET HAS BEEN COMPROMISED, ACT IMMEDIATELY AND CONTACT US.

11 Children

XSPLASH is not directed to children under the age of 16 and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us so we can delete it.

12 Changes and contact

We may update this Policy from time to time. When we do, we will update the "Last updated" date above and, for material changes, provide additional notice through the Service.

Questions about this Policy or requests to exercise your rights should be directed to: