Privacy Policy
Last updated: January 1, 2026
This Privacy Policy explains how XCCY Labs (together with its affiliates, “XCCY,” “we,” “us,” or “our”) collects, uses, discloses, and otherwise processes information when you access or use our websites, applications, interfaces, APIs, documentation, and related services (collectively, the “Services”), including the web app available at app.xccy.finance.
By using the Services, you acknowledge and understand the practices described in this Privacy Policy.
1. Important context (non-custodial + public blockchains)
XCCY does not custody your assets, and we do not control your wallet or private keys.
When you interact with public blockchains, certain data (e.g., wallet addresses, transaction hashes, token transfers, position states) is public by design and may be visible to anyone via block explorers or blockchain analytics tools. This Privacy Policy applies to information we process through our Services—not to information that is publicly available on-chain.
2. Information we collect
We collect information in three main ways:
information you provide, 2) information collected automatically through your use of the Services, and 3) information from third parties.
2.1 Information you provide to us
You may provide:
Contact information (e.g., email address) if you contact support, subscribe to updates, or participate in surveys.
Support content you send us (e.g., messages, screenshots, logs, transaction hashes) when requesting assistance.
Preferences (e.g., notification preferences, UI settings) where supported.
You should avoid sharing private keys, seed phrases, or wallet recovery information. We will never ask for them.
2.2 Information collected automatically
When you use the Services, we may collect:
Device and browser information (e.g., device type, OS, browser type, language).
Usage and interaction data (e.g., pages viewed, features used, clicks, time spent, referral URLs).
Log and diagnostic data (e.g., IP address, timestamps, error logs, performance metrics).
Approximate location derived from IP address (country/region-level).
Cookie and similar tracking data (see Section 7).
2.3 Wallet and on-chain related data
If you connect a wallet or use features that read blockchain state, we may process:
Wallet addresses you connect to the Services.
Public on-chain data associated with those addresses (e.g., balances, positions, collateral ratios, rates, liquidation thresholds, transaction history relevant to the Protocol).
Transaction metadata shown in the interface (e.g., transaction hash, network, token, amounts), to display status and history.
We do not collect private keys or seed phrases. Any signing occurs in your wallet provider.
2.4 Information from third parties
We may receive information from:
Wallet providers (e.g., connection events, wallet type), depending on the connector you use.
Analytics and infrastructure providers (e.g., performance metrics).
Blockchain data providers (e.g., nodes, RPC providers, indexers) that help us query and display on-chain information.
3. How we use information
We use information to:
3.1 Provide and operate the Services
display dashboards and protocol data;
enable wallet connections and transaction flows;
provide customer support and respond to requests;
send service-related notices (e.g., updates, downtime, security communications).
3.2 Improve and secure the Services
monitor performance and reliability;
diagnose bugs and errors;
prevent abuse, fraud, or malicious activity;
enforce Terms of Service and protect our users, the Services, and our infrastructure.
3.3 Communicate with you
respond to support messages;
send updates you request (e.g., newsletters) and allow you to opt out anytime.
3.4 Legal and compliance
comply with legal obligations;
respond to lawful requests;
exercise and defend legal claims.
4. Legal bases for processing (EEA/UK users)
If you are in the UK or EEA, our legal bases may include:
Performance of a contract (to provide the Services you request).
Legitimate interests (e.g., securing and improving the Services, preventing fraud).
Consent (e.g., certain cookies/analytics, marketing emails where required).
Legal obligation (where we must comply with laws or lawful requests).
5. How we share information
We do not sell your personal information. We may share information in the following circumstances:
5.1 Service providers and vendors
We may share information with vendors who help us operate the Services (e.g., hosting, analytics, customer support tooling, email delivery, security monitoring). They are permitted to use the information only to provide services to us.
5.2 Blockchain networks (public)
When you initiate transactions, information is broadcast to blockchain networks and becomes public. This sharing is inherent to blockchain use and is outside our control.
5.3 Legal, safety, and rights
We may disclose information if we believe in good faith it is necessary to:
comply with law or legal process;
protect rights, safety, and security of XCCY, our users, or others;
investigate fraud or security incidents.
5.4 Business transfers
If we engage in a merger, acquisition, restructuring, financing, or sale of assets, information may be transferred as part of that transaction, subject to appropriate safeguards.
6. Data retention
We retain information only for as long as necessary to:
provide the Services,
comply with legal obligations,
resolve disputes,
enforce agreements, and
maintain security and prevent abuse.
Retention periods vary based on the type of information and the purpose for processing. Public on-chain data is retained by blockchain networks independently of XCCY.
7. Cookies and similar technologies
We may use cookies, local storage, and similar technologies to:
remember your preferences (e.g., UI settings),
maintain sessions,
understand usage patterns,
measure performance and reliability.
Depending on your location, you may see a cookie banner that allows you to manage preferences (e.g., accept/decline analytics cookies where required). You can also control cookies through your browser settings. Note: disabling certain cookies may impact functionality.
8. Security
We take reasonable administrative, technical, and organizational measures designed to protect information from unauthorized access, disclosure, alteration, and destruction. However, no system is perfectly secure, and we cannot guarantee absolute security.
You are responsible for securing your wallet, private keys, seed phrase, and devices.
9. International transfers
We may process and store information in countries other than your own. Where required by law (e.g., UK/EEA), we use appropriate safeguards for international transfers, such as standard contractual clauses or other lawful transfer mechanisms.
10. Your rights and choices
Depending on where you live, you may have rights such as:
Access to your personal information,
Correction of inaccurate information,
Deletion (subject to legal and operational requirements),
Restriction or objection to certain processing,
Data portability,
Withdraw consent (where processing is based on consent).
To exercise your rights, contact us at [email protected]. We may need to verify your request.
Note: We cannot delete or modify data recorded on public blockchains. We can, however, delete personal information we control (e.g., support emails) subject to legal requirements.
11. Children
The Services are not intended for children, and we do not knowingly collect personal information from anyone under 18 (or the age of majority in their jurisdiction). If you believe a child has provided us personal information, contact us so we can take appropriate action.
12. Third-party links and services
The Services may contain links to third-party websites or services (including wallets, block explorers, analytics dashboards). We are not responsible for their privacy practices. Please review their policies before providing information.
13. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. If we do, we will post the updated version and revise the “Last updated” date. Changes are effective when posted unless stated otherwise.
14. Contact us
Support: [email protected] Legal notices: [email protected]
Last updated