Privacy Policy

1. General information

Protecting your personal data is very important to me. I only process your data in accordance with applicable laws (GDPR, German DDG). This privacy policy explains the key aspects of how data is processed on this website.

2. Controller

3. Hosting

This website is hosted by Cloudflare, Inc. (USA). When you visit the site, Cloudflare may process your IP address for technical reasons. This is necessary to deliver the website and protect it from attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Cloudflare is certified under the EU-US Data Privacy Framework (DPF), ensuring an adequate level of data protection for transfers to the USA.

4. Analytics, tracking, and cookies

This website uses Cloudflare Web Analytics, a cookie-free analytics tool provided by the hosting provider Cloudflare (see section 3). Only aggregated usage data is collected (page views, referrer, browser, operating system, country). There is no individual visitor tracking or cross-site tracking. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in analyzing website usage). For more information, see Cloudflare's privacy policy.

Beyond that, this website uses no additional tracking tools, analytics services, or advertising cookies. Only browser localStorage is used to store functional preferences (theme, language selection). This data never leaves your browser and is not shared with third parties.

5. Client-side data processing (hashing)

The core process of CommitProof, hashing your text, takes place entirely in your browser. Your original text never leaves your device at any point. Only the computed SHA-256 hash is written as metadata into a Cardano transaction. Neither the plaintext nor any personal data is transmitted to my server.

6. Cardano wallet and blockchain data

When you connect a Cardano wallet to this website, the following data is processed:

• Wallet address: used locally in the browser to create transactions.
• Transaction hashes: stored for verification and display of your proofs.
• Network ID: checked to ensure your wallet is connected to the correct network.

The wallet connection uses the CIP-30 standard of your wallet provider. I have no access to your private keys. Transactions are only signed and submitted to the Cardano network after your explicit confirmation in the wallet.

Blockchain data (transactions, metadata, block times) is publicly visible. This is inherent to blockchain technology and is beyond my control.

7. Third-party API services

This website retrieves cryptocurrency price data from CoinGecko (Gecko Labs, Inc.). This API call is made server-side. Your IP address is not shared with CoinGecko. No personal data is transmitted. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in displaying current prices).

To retrieve blockchain data, this website queries the KOIOS REST API (koios.rest), an open-source Cardano blockchain data provider. Transaction hashes and wallet/stake addresses may be transmitted to KOIOS for verification and proof retrieval. These are pseudonymous blockchain identifiers, not personal data in the traditional sense. Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest).

8. Server-side data storage (Cloudflare KV)

When you pay via Stripe (credit card), I store the following data in Cloudflare KV (key-value storage) to ensure correct transaction processing:

• Cardano transaction hashes: to prevent the same transaction from being processed more than once. Deleted after one year.
• Stripe event IDs: to prevent duplicate payment processing. Deleted after 30 days.

When you pay directly with ada via your wallet, no data is stored on my server.

No names, email addresses, or other personal data is stored. Identification is solely through the pseudonymous wallet address. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection. If you believe the processing of your data violates data protection law, you may lodge a complaint with the supervisory authority. In Baden-Württemberg, this is:

Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Königstraße 10a
70173 Stuttgart, Germany
https://www.baden-wuerttemberg.datenschutz.de

10. Objection to unsolicited emails

The use of contact data published as part of the legal notice obligation for the purpose of sending unsolicited advertising and information materials is hereby objected to.