Draft prepared by engineering — pending review by a lawyer before mainnet. It describes how arky works today, from its code, and will change before it is final. Text marked [to be completed: …] is information the operator has not supplied yet.
Privacy policy
Draft of 24 September 2026
arky has no accounts, emails or passwords: your account is a wallet address. This policy explains what we process about you, why, who else sees it, how long we keep it, and your rights under the EU General Data Protection Regulation (GDPR) and French law.
1. Who is responsible
The controller is arky, [to be completed: registered office address], France. Privacy contact: [to be completed: privacy contact email]. [to be completed: data protection officer, if one is appointed]
2. What we never receive
Your private key and recovery phrase. The wallet arky creates is generated in your browser and stored there, encrypted; the key material is never sent to our servers. We do not ask for your name, email, phone number or any identity document.
3. What we process, why, and on what basis
| Data | Why | Legal basis |
|---|---|---|
| Your public wallet address and the message you sign to sign in (“Sign-In with Ethereum”) | To sign you in and show your balances, orders and positions. The sign-in challenge is held in memory for 5 minutes; the session is a signed token valid for 7 days that we do not store. | Performance of our contract with you |
| Your wallet address, checked against the OFAC sanctions list | To refuse service to sanctioned persons. The check is automatic; see section 8. We keep no record of the check, only a count of refusals. | Legitimate interest in complying with sanctions law |
| Orders, fills, positions, prediction bets and redemptions tied to your address | To run the service and show your history | Performance of our contract |
| Your on-chain activity (trades, bets, transfers, token launches), read from the public blockchain | To show prices, charts, holders, leaderboards and wallet pages. This data is already public. | Legitimate interest in running a market interface |
| Messages you send Scout, its replies, token counts, the actions it took, and your agent settings and limits | To provide Scout and show you its history. Each request sends your last 50 messages, your wallet address and the time to our language model provider. | Performance of our contract |
| Facts you ask Scout to remember (at most 20, each up to 280 characters) | Only when you ask (“remember that…”). They are sent with each Scout request to our language model provider. Ask “what do you remember” to see them and “forget” to delete one or all. | Your consent, which you withdraw by asking Scout to forget |
| Trades Scout proposes to you (what, how much, the slippage, its status and transaction), and an append-only log of each step: proposed, reported, verified against the chain, expired | To let you sign the trade in your wallet, confirm the fill from the chain, and keep a record of what the agent did | Performance of our contract; legitimate interest (security and dispute handling) |
| Wallets you follow, their labels, and your price alerts | To provide those features | Performance of our contract |
| Cross-chain deposits you start: your address, the provider, the quote and its status | To track the deposit until it lands. “Forget” hides a deposit from your list; the record itself is kept. | Performance of our contract |
| Referral codes, the wallets bound to them, the signed binding messages, rewards and payouts | To run the affiliate programme and stop abuse | Performance of our contract; legitimate interest (fraud prevention) |
| A daily fingerprint of a referral click: a hash of the day, the code and a random ID stored in your browser (no IP address) | To count clicks on referral links without counting the same visitor twice a day | [to be completed: legal basis to be confirmed by counsel (see cookies page)] |
| Images, names and descriptions you upload when you launch a token or create a market | To publish them; they are public by design | Performance of our contract |
| A location (city, country, coordinates) that an arky administrator can attach to a wallet by hand | Shown next to that wallet’s bets and in trader lists. It is not derived from your IP address. | [to be completed: legal basis; counsel to confirm whether this needs your consent, or to remove the feature] |
| Your IP address | Counted in memory to rate-limit requests and image uploads; the counters are dropped when their window ends. Our own request logs do not record IP addresses. | Legitimate interest (security and abuse prevention) |
We do not use analytics, advertising trackers or an error-reporting service, we do not build advertising profiles, and we do not sell data.
4. The blockchain is public
Everything your wallet does on-chain — trades, token launches, bets, transfers — is recorded permanently on a public blockchain that anyone can read. We cannot change or erase it, and the rights in section 9 do not reach it.
5. Who else processes data
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts the web app, stores uploaded images (R2), rate-limits uploads; sees request data including IP addresses | Global network; company in the United States |
| Fly.io, Inc. | Hosts the data service, Scout and the payouts service | Servers in Paris, France; company in the United States |
| Supabase, Inc. | Hosts the database of orders, positions and records | [to be completed: database region] |
| DeepSeek | The language model behind Scout receives your messages, your wallet address, the facts you asked it to remember and the context Scout needs | China |
| Arc network RPC providers | Your browser sends them the requests it makes to read and write the chain, with your IP address | Depends on the provider |
| Relay, NEAR Intents (1Click), Circle | Quote and carry cross-chain deposits you start; they receive the addresses and amounts involved | Depends on the provider |
| Wallet software you choose (for example Coinbase Wallet, Safe) | Only if you connect it; governed by its own policy | Depends on the provider |
Price data comes from Binance and Coinbase and is fetched by our servers; no data about you is sent to them.
Scout does not search or browse the internet: it uses only arky’s live data, prices and your own history on arky, so nothing you tell Scout is sent to a search engine or a website.
6. Transfers outside the European Economic Area
Some providers process data outside the EEA, including in the United States and, for Scout’s language model, China. [to be completed: transfer safeguards for each provider (adequacy decision, EU–US Data Privacy Framework, or standard contractual clauses) and signed processor agreements]
7. How long we keep it
- Sign-in challenges: 5 minutes. Sessions: 7 days, then they expire.
- Rate-limit counters: in memory, until their window ends or the service restarts.
- Scout confirmations waiting for your answer: 2 minutes. Trade proposals you do not sign expire after 10 minutes.
- Facts Scout remembers: 180 days after you saved them, or sooner if you ask it to forget.
- Scout conversations, trade proposals and their audit log, trading records, deposits, referrals and wallet locations: today there is no automatic deletion; they are kept while the service runs and deleted on request where the law allows. [to be completed: retention period for each category]
- Uploaded images: for as long as the token or market they belong to is shown.
8. Automated decisions
Sanctions screening is automatic: a wallet on the list is refused without a person looking at it. If you think your wallet was refused by mistake, write to us (section 9) and a person will review it. arky makes no other automated decision about you, and does no profiling.
9. Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to set directions for what happens to it after your death. Where processing relies on consent, you can withdraw it at any time. Scout’s memory can be viewed and deleted directly in the chat, without writing to us.
To exercise them, write to [to be completed: privacy contact email] and sign a message with the wallet concerned so we know it is yours. We answer within one month. We may keep what the law requires us to keep.
You can also complain to the French data protection authority, the CNIL (Commission Nationale de l’Informatique et des Libertés, cnil.fr), or to the authority where you live.
10. Cookies and browser storage
See cookies and storage.
11. Children
arky is not for anyone under 18, and we do not knowingly process data about children.
12. Changes
We will publish any change here, with a new date, and ask you to accept material changes.