Privacy Policy

Crumbs ("we") is the controller of the personal data described here. Contact: privacy@crumbs.example.

• Account data: email address and password hash (email sign-up), or your wallet address and the signed sign-in message (wallet sign-in); country of residence; acceptance records (terms version, timestamps).
• Wallet and vault data: wallet addresses you register, nicknames you give them, your vault address, cached balances, and the public on-chain transactions from those addresses that we index to compute round-ups.
• Settings and instructions: your limits, round-up unit, execution mode, notification preferences, approvals and cancellations.
• Technical data: IP address (used for geo-eligibility and rate limiting), browser type, session identifiers and server logs.
• Audit trail: a log of actions taken on your account (sign-ins, settings changes, approvals) to protect you and to meet our legal obligations.

We do not collect your private keys or seed phrase, card numbers or bank details.

• Performance of a contract (Art. 6(1)(b) GDPR): to run the Service you asked for — detecting round-ups, creating batches, executing your instructions, showing your portfolio.
• Legal obligation (Art. 6(1)(c)): geographic restrictions, sanctions screening of wallet addresses, record keeping.
• Legitimate interests (Art. 6(1)(f)): security, fraud prevention, rate limiting, debugging and improving the Service.
• Consent (Art. 6(1)(a)): optional email notifications. You can withdraw consent at any time in Settings.

Transactions on Robinhood Chain are public and permanent. Your wallet and vault addresses, deposits, swaps and withdrawals are visible to anyone and cannot be erased by us or by you. We only read this data; deletion rights under this policy apply to our own databases, not to the blockchain.

We share personal data only with:

• Infrastructure providers (hosting, managed database, email delivery) under data-processing agreements.
• RPC and price-oracle providers, which receive wallet addresses in the course of reading blockchain data.
• A geo-IP provider, which receives your IP address for country lookup.
• A sanctions-screening provider, which receives wallet addresses.
• Authorities where required by law.

We do not sell personal data and do not use it for advertising.

Providers may be located outside the EEA. Where that is the case we rely on adequacy decisions or the EU Standard Contractual Clauses.

• Account, settings and instruction data: for the life of your account and 30 days after a deletion request.
• Audit trail and transaction records: up to 5 years after account closure where required for legal, tax or anti-money-laundering purposes.
• Server logs including IP addresses: 90 days.
• Sessions: until expiry (7 days) or revocation.

You have the right to:

• Access the personal data we hold about you and receive a copy (including CSV exports of your round-ups and portfolio lots available in the app).
• Rectify inaccurate data.
• Erase your data. On request we delete your account and associated data within 30 days, except records we must keep by law. Withdraw from your vault before requesting deletion; the vault is controlled by your wallet, not by us.
• Restrict or object to processing based on legitimate interests.
• Data portability for data you provided to us.
• Withdraw consent for notifications at any time.
• Lodge a complaint with your supervisory authority (in Ireland: the Data Protection Commission).

To exercise a right, email privacy@crumbs.example from your account email, or include a message signed by your wallet.

Passwords are hashed; sessions are revocable tokens; contract interactions are signed only by your wallet. We apply access controls and logging on our systems. No system is perfectly secure; keep your wallet and credentials safe.

We use no advertising or analytics cookies. The app stores your session token and interface preferences in your browser's local storage, which is necessary for the Service to work. Clearing it signs you out.

The Service is not intended for anyone under 18 and we do not knowingly collect data from them.

We will announce material changes in the app and record the version you accepted. Continued use after the effective date constitutes acceptance.