OnyxPrivacy Policy

This Privacy Policy (the "Policy") describes how Onyx ("Onyx", "we", "us", or "our") handles personal information in connection with the website located at onyx.org and its subpages (the "Website"), and any other Onyx service that links to this Policy (together with the Website, the "Services").

This Policy does not apply to third-party websites, applications, exchanges, wallets, or services that we do not operate, even where we link to them from the Website. It also does not govern information recorded on the Onyx blockchain or any other public, permissionless ledger, which is discussed in Section 12.

By using the Services you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Services.

We collect as little personal information as we reasonably can. What we do collect falls into three groups.

Information you give us

• Email address, when you subscribe to the Onyx newsletter from the Website footer or join a waitlist such as the Onyx Card waitlist.
• The contents of any message you send us, for example by email to legal@onyx.org.

Information collected automatically

• Approximate location. Our hosting provider resolves your IP address to a two-letter country code at the network edge. We store that country code alongside your newsletter or waitlist signup; we do not store the IP address itself with your contact record.
• Request data. Like most websites, our servers and hosting provider process technical data about each request, such as your IP address, browser and device type, referring page, the pages you visit, and timestamps. We use your IP address transiently to rate-limit form submissions and to detect abuse.
• Bot-protection signals. Our signup forms use an automated bot-detection service that evaluates browser and device signals to distinguish people from automated scripts. Those signals are used only to classify the request.

Information from other sources

We do not buy personal information from data brokers. If you reach the Website from a third-party platform, such as a social network or an app store, that platform may share limited referral data with us under its own terms.

We use the information described above to:

• Deliver the newsletter, waitlist confirmations, and other communications you have asked for.
• Understand where our audience is located, at a country level, so that we can plan product availability and communications.
• Operate, secure, and maintain the Website, including rate limiting, bot detection, debugging, and preventing fraud or abuse.
• Respond to your enquiries and legal requests.
• Comply with applicable law, and establish, exercise, or defend legal claims.

We do not sell your personal information, and we do not use it for targeted advertising.

Where the data protection laws of the European Economic Area, the United Kingdom, or a similar jurisdiction apply to you, we rely on the following legal bases:

• Consent, for sending you the newsletter and waitlist emails. You can withdraw consent at any time using the unsubscribe link in any email or by contacting us.
• Legitimate interests, for operating and securing the Website, understanding our audience at a country level, and defending legal claims. We balance these interests against your rights and freedoms.
• Legal obligation, where we are required to retain or disclose information by law.

We share personal information only with the categories of recipients below.

• Service providers. We use third-party providers to host the Website, deliver email, and protect our forms from automated abuse. At the date of this Policy these are Vercel (hosting, edge networking, and bot protection) and Resend (email delivery and contact management). These providers process information on our behalf and under contractual confidentiality obligations.
• Professional advisers. Lawyers, accountants, auditors, and insurers, where necessary to obtain advice or protect our interests.
• Legal and safety. Courts, regulators, law enforcement, or other parties where we believe in good faith that disclosure is required by law or is necessary to protect the rights, property, or safety of Onyx, our users, or others.
• Corporate transactions. A successor or acquirer in connection with a merger, acquisition, reorganisation, or sale of assets, subject to this Policy.

We do not share your email address with other subscribers, exchanges, or advertisers.

The Website is designed to work without tracking cookies. We do not currently use third-party advertising or cross-site analytics cookies.

The Website may use strictly necessary cookies, local storage, or similar technologies for security and basic functionality, for example to protect the newsletter and waitlist forms from automated abuse. These cannot be disabled through the Website, but you can block or delete them using your browser settings; doing so may prevent the forms from working.

If we introduce analytics or other non-essential technologies in the future, we will update this Policy and, where required, ask for your consent first.

• Newsletter and waitlist contacts are retained until you unsubscribe or ask us to delete them, or until we discontinue the relevant list. After you unsubscribe we keep a suppression record of your email address so that we do not contact you again by mistake.
• Server and security logs are retained for a limited period, no longer than is necessary for security and debugging, and are then deleted or anonymised.
• Correspondence with us is retained for as long as needed to deal with your enquiry and for any applicable limitation period after that.

We use technical and organisational measures appropriate to the sensitivity of the information we hold, including encryption in transit, access controls, rate limiting, and bot protection on public forms. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your information has been compromised, please contact us at legal@onyx.org.

Onyx operates internationally, and our service providers may store or process information in the United States and other countries that may not offer the same level of data protection as your home jurisdiction. Where required, we rely on appropriate safeguards, such as standard contractual clauses, for such transfers. By using the Services you understand that your information may be transferred to and processed in those countries.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy of it.
• Correct inaccurate or incomplete information.
• Delete your information, subject to legal retention requirements.
• Object to, or ask us to restrict, certain processing.
• Receive your information in a portable format.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with your local data protection authority.

To unsubscribe from the newsletter, use the link at the bottom of any newsletter email. To exercise any other right, email legal@onyx.org from the address you want us to act on. We may need to verify your identity before responding, and we will respond within the time required by applicable law. We will not discriminate against you for exercising your rights.

The Services are not directed to children, and we do not knowingly collect personal information from anyone under 18 years of age. If you believe a child has provided us with personal information, contact us at legal@onyx.org and we will delete it.

The Onyx network is a public, permissionless blockchain. Transactions, wallet addresses, smart-contract interactions, and governance votes recorded on it are public, permanent, and outside our control. We cannot modify or erase on-chain data, and this Policy does not apply to it. Please consider this before associating a wallet address with information that identifies you.

The Website links to other Onyx properties (such as app.onyx.org, explorer.onyx.org, docs.onyx.org, and the Onyx Wallet apps) and to third parties, including exchanges, app stores, GitHub, Medium, and social networks. Each of these is governed by its own privacy policy, which we encourage you to read.

We may update this Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, for material changes, take additional steps to notify you where required by law, such as emailing subscribers. Your continued use of the Services after a change takes effect means you accept the updated Policy.

Any question, request, or notice relating to this Policy or to your personal information must be sent by email to legal@onyx.org. We do not accept privacy notices by post, telephone, or social media, and a notice is effective only once it has been received at that address.