Privacy policy

Last updated 19 October 2026. Version 4.0.

[OPERATOR: legal review] Working draft for the Timechain product as built. Fill in the operating entity and have it reviewed before production.

In short: your wallet is your only account. We store the public Solana address you sign in with, your settings, the coins you launch and, when you bridge, the public Bitcoin address you send to. We never see a private key. Timechain servers hold no user funds. We do not sell data. Everything on chain is public, on Solana and on Bitcoin.

1. Who we are

Timechain is operated by [OPERATOR: legal entity name] ("we", "us"). This policy covers the Timechain website and app ("the Service").

2. What we never receive

Your wallet's private key. Your wallet signs in your browser; only signatures and public addresses reach us.
Your Bitcoin wallet's keys. You give us only a public Taproot address to send a Rune to; your Bitcoin wallet (Xverse, UniSat, OKX or another) keeps its keys.
An email, a password or a social account. A Solana wallet is the only way to sign in. We do not ask for your name or email.
Any private key at all. No private key is held on our servers. Timechain's platform wallets are signed for by Privy, a third-party key provider, and the Runes are held by a canister on the Internet Computer whose key is split across that network's nodes. Neither holds your account data.

3. What we collect

Account: the Solana address you sign in with. The date, version and IP address when you accept the Terms.
Bridge (public data only): the Bitcoin address you name to receive a Rune, the deposit address made for you to send one back, and the Solana and Bitcoin transactions of each movement. All of it is public on chain anyway.
Coins and settings: coins you launch, their metadata and images, launch drafts, your watchlist, pending launch steps and reminders, and records of launches, Rune etches, fee collections, holder payouts, buys and burns with their transaction ids.
Optional: issue reports you send.
Technical: IP addresses for rate limits and abuse prevention, server logs of account actions, limited error diagnostics (never keys or tokens), and one session cookie.

4. How we use it

To sign you in, run the launches and bridge movements you choose, remind you of a launch step you have not finished, show public coin pages and their Runes, keep a record of fee collections, payouts and burns, prevent abuse, investigate reported problems and record your acceptance of the Terms.

5. Public information

Blockchain transactions are public and permanent. Coin pages show on-chain data from Solana and Bitcoin, including holders, trades, the Rune, its custody address and bridge movements, to anyone. We cannot change or delete on-chain data.

6. Who we share data with

We do not sell, rent or trade personal data. We share only what each provider needs:

Your wallet provider (Phantom, Solflare or another Wallet Standard wallet): it signs in your browser and sees the transactions you approve
Railway: hosting and database
Cloudflare: CDN and DDoS protection (IP addresses and request metadata)
Solana RPC providers, pump.fun, Jupiter, GMGN and DexScreener: chain and market data and transaction routing (they see wallet and coin addresses, not your account)
Privy: signs for Timechain's own platform wallets. It receives no personal data about you from us
The Internet Computer: runs the canister that holds the Runes and reads Solana and Bitcoin; it sees the public addresses and transactions of bridge movements
Bitcoin RPC and Runes indexer providers, ordinals.com and mempool.space: Bitcoin and Rune data (they see Bitcoin addresses, not your account)
Google Fonts: delivers some fonts to your browser, which exposes your IP address to it. Code libraries are served from Timechain's own site

We may disclose information when the law requires it or to protect the Service, its users or the public.

7. Storage and security

Data is stored in a PostgreSQL database hosted on Railway and sent over HTTPS. No storage or transmission is perfectly secure.

8. Retention and your rights

Account data is kept while your account is active or until you ask us to delete it; some launch, fee and Terms records may be kept longer for accounting, security or legal reasons. Sessions expire after 30 days without activity. Depending on where you live you may have rights to access, correct or delete your data: email us. On-chain data cannot be changed. Deleting your account does not affect your coins or Runes: they are yours on chain. [OPERATOR: lawyer review]

9. Cookies and local storage

One session cookie keeps you signed in. Your browser's local storage keeps preferences such as theme, the last wallet you used and recent coins. No key of any kind is written to local storage. No advertising cookies.

10. Children

The Service is not for anyone under the legal age where they live. Contact us if you think a child's data reached us and we will delete it.

11. Changes

We will update the date above when this policy changes.

12. Contact

Privacy questions and deletion requests: [OPERATOR: contact email].