Privacy Notice

1. Controller and contact

The URlsURlf project currently determines why and how personal data is processed through the service.

Privacy questions and rights requests: privacy@urlsurlf.com. General legal contact: legal@urlsurlf.com.

2. Data we process

• Space and authentication data: Space address and name, a protected representation of the permanent key, sessions, agreement records, passkey public credentials and sign-in security events. We do not have a recovery copy of the permanent key.
• Inbox and messaging data: sender and recipient metadata, subject, message body, attachments, delivery status and anti-abuse signals.
• Profile and public content: chosen display name, biography, profile image, posts, listings, comments, publication status, saves and aggregated view counts.
• Payment and blockchain feature data: configuration you submit, transaction references and temporary verification challenges. XRPL proof features are designed to retain the proof result or nullifier rather than persist the raw account address where the feature description says so. Public blockchain transactions remain available independently of us.
• Help data: messages to help and, only when you activate voice help, captured audio, transcript and the response needed for that session.
• Technical data: IP address, user agent, timestamps, request and security logs, device or browser information, cookies and similar session identifiers.

Please do not submit unnecessary sensitive personal data or anyone else’s private information.

3. Why we process data and our legal bases

• Provide the service: create and authenticate a Space, deliver messages, publish content at your direction and operate requested features. The basis is performance of our contract with you.
• Protect the service: prevent spam, fraud, abuse, credential attacks and technical failures; enforce our Terms; and keep reliable records. The basis is our legitimate interest in operating a safe and dependable service and, where relevant, performance of the contract.
• Meet legal duties: respond to lawful requests, preserve required records and comply with applicable law. The basis is legal obligation.
• Optional actions: process information when you choose to publish content, add a passkey, verify a blockchain claim or start voice help. Depending on the feature, the basis is your request under the contract, legitimate interests or consent where the interface expressly asks for it.

We do not sell personal data, run behavioural advertising or use solely automated decisions that produce legal or similarly significant effects.

4. Who receives data and international transfers

We share data only as needed to provide, secure or lawfully administer the service:

• Amazon Web Services: hosting, storage, databases, email handling, logs and content delivery, primarily in the United States (us-east-1).
• xAI: audio and related context only when you activate the voice-support feature.
• Message recipients and delivery providers: content and metadata required to deliver a message or email you send.
• Public audiences and networks: content you publish and blockchain transactions you choose to initiate.
• Authorities, advisers or transaction parties: when required by law, necessary to protect rights or security, or part of a legitimate corporate transaction with appropriate safeguards.

When data is transferred from the European Economic Area, United Kingdom or Switzerland to a country without an adequacy decision, we rely as applicable on contractual safeguards such as the European Commission’s Standard Contractual Clauses, provider data-processing terms, or an applicable recognised transfer framework.

5. How long we keep data

• Active Space, inbox, profile and feature data is generally kept until the Space or relevant content is deleted.
• An unclaimed temporary Space may be deleted after 24 hours.
• Normal authenticated sessions expire after 30 days.
• Passkey registration and authentication challenges expire after about 5 minutes.
• XRPL verification challenges expire after about 10 minutes, and temporary verification credentials after about 24 hours.
• Security and operational logs are retained only as long as reasonably needed for security, troubleshooting, abuse prevention and legal obligations.

Deletion may take additional time to age out of encrypted backups and security records. We may retain limited information longer when law, a dispute, fraud prevention or enforcement of our Terms requires it. Data already delivered to another person, published to a public blockchain or copied by others is outside our deletion control.

6. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, receive portable data, and withdraw consent where processing relies on consent. You may also complain to your local data-protection authority. EEA users may contact the supervisory authority in the country where they live, work or believe an infringement occurred.

Send a request to privacy@urlsurlf.com. We may need information sufficient to verify that you control the relevant Space without asking you to email the permanent key. Some rights are subject to legal exceptions.

7. Security, credentials and your choices

We use technical and organisational measures intended to protect data, but no online service can guarantee absolute security. A passkey can provide a convenient alternate sign-in on supported devices, but it does not recover or replace the permanent key.

You control whether a profile, post or listing is published. You can delete individual content where the feature provides that control, or permanently delete the Space through Settings.

8. Children and changes

The service is not intended for anyone under 18. We do not knowingly offer it to children.

We may update this Notice when processing, providers, law or features change. We will change the date and version and present material updates in the service where appropriate.