Privacy Policy
DRAFT — pending counsel review, not yet in force
1. What we collect
Account: the email from your Google or email sign-in, and the Sui wallet address derived from it. Donations: amount, chosen side, optional display name, and the on-chain transaction digest. Eligibility: to enforce our supported-jurisdiction rule, your approximate location (country and state, derived from your IP) is checked at the network edge when you visit — it gates access but is not attached to or stored with your donations. Operations: standard server logs and security telemetry. We do not currently run identity verification (KYC); if we add it, this policy will be updated before that control goes live.
2. What is public
Donation amounts and transaction digests are public on the Sui blockchain by design — that transparency is how anyone can verify a Fight. Your legal name is never published. Display names appear only where you opt in, and any donation can be made anonymously.
3. What we never do
We do not sell personal data. We do not store or display precise locations. We do not send push notifications without explicit opt-in. We do not use donation history for advertising, and we set no cross-site or advertising cookies.
4. Processors
We share only what each service needs to do its job: Supabase (our application database for off-chain records), Mysten Labs Enoki (sign-in and gasless-transaction infrastructure), Transak (third-party card-to-USDC on-ramp, used only if you pay by card), Cloudflare Turnstile (bot and abuse protection on sign-in and forms), Upstash (rate limiting and abuse prevention), Resend (transactional email delivery), and Vercel (application hosting and server logs). We do not use any advertising or product-analytics processors.
5. Cookies and local storage
We use a small number of first-party cookies and no advertising or cross-site trackers. "fff_session" is an essential, HttpOnly cookie that keeps you signed in (SameSite=Lax), and "fff-consent" remembers your privacy choices. "fff-ref" is set for 7 days when you arrive through a supporter's share link so the referrer gets credit — it holds only a short referral code, no identity. Cloudflare Turnstile may set its own cookie for bot protection on pages with sign-in or forms. Your browser also keeps small preferences in local storage on your device (for example, your recent donations for one-tap re-donate and the display name you choose); these never leave your device and are not identity data. A full, itemized list — and controls to turn optional storage on or off — is on our Cookie Notice at /legal/cookies (also reachable from "Your Privacy Choices" in the footer).
6. Retention and deletion
Off-chain personal data is retained while your account is active and for any period required by financial-compliance law, then deleted. On-chain records — donation amounts, wallet addresses, and transaction digests — are permanent and outside any party's control; this is disclosed before your first donation. Deleting your off-chain data does not and cannot remove those public on-chain records.
7. Your rights and how to reach us
You can request access to your off-chain data, a copy of it, correction, or deletion, and exercise California privacy rights where applicable. Email support@fightforfunds.com, submit a deletion request from your account page, or use "Your Privacy Choices" in the footer to opt out of optional data uses. We act on verified requests within the time the law allows.
8. US state privacy rights — being finalized with counsel
This section is being finalized with counsel and is not yet in force. When published it will set out, for US state privacy laws (e.g. CCPA/CPRA): the categories of personal information collected and the sources; the business and commercial purposes for each; the categories of third parties we share with; retention periods per category; your rights to know, access, correct, and delete; your right to opt out of the sale or sharing of personal information (we do not sell personal data); how to submit and verify a request, including via an authorized agent; and our commitment not to discriminate for exercising these rights. To opt out of optional data uses today, use "Your Privacy Choices" in the footer; we also honor Global Privacy Control.