Privacy Policy

This Privacy Policy (this “Policy”) describes how information is collected, used, disclosed, retained, and protected in connection with Safrochain Multisig (the “Application”), a self-hosted threshold multisignature coordination tool for Safrochain and compatible Cosmos SDK networks. The Application is designed as a non-custodial software product: private cryptographic keys remain exclusively within user-controlled wallet extensions and are never transmitted to, stored by, or recoverable through the Application.

This Policy applies to end users, multisig members, administrators, and operators who access or interact with any deployment of the Application, whether hosted by the Safrochain Foundation, a community operator, or a private organization (each, an “Operator”). The entity responsible for data processing in respect of a given deployment is the Operator of that instance, subject to the architectural constraints and product design described herein.

By connecting a wallet, authenticating via signed message, or otherwise using the Application, you acknowledge that you have read this Policy and understand its terms. If you do not agree, you must not use the Application.

“Application” means the Safrochain Multisig web application, associated server components, APIs, realtime channels, and documentation made available for threshold multisignature coordination on Safrochain.

“Authentication Data” means wallet addresses, public keys, session tokens, session identifiers, authentication timestamps, and cryptographic signatures produced during wallet-based sign-in (including ADR-036 or functionally equivalent schemes).

“Collaboration Data” means off-chain operational information stored to enable team workflows, including multisig account names and descriptions, member nicknames, role assignments, transaction drafts, titles, memos, partial signatures, simulation results, audit events, and related metadata.

“On-Chain Data” means information retrieved from public blockchain sources, including account balances, transaction history, sequence numbers, account numbers, and publicly broadcast transaction contents.

“Operator” means the person or entity that deploys, hosts, configures, and administers a particular instance of the Application.

“Personal Data” means any information relating to an identified or identifiable natural person, to the extent such concept applies under applicable privacy and data protection laws.

“User” means any individual or entity accessing or using the Application. References to “you” mean the User.

Information is processed for the following purposes, depending on applicable law and Operator role:

1. Service delivery: to authenticate users, enforce member-only access, display multisig accounts, coordinate partial signatures, simulate transactions, and facilitate broadcast when quorum requirements are met;
2. Security and integrity: to verify SignDoc binding, detect anomalous sessions, apply transport hardening, classify outbound transfers, maintain audit trails, and protect against unauthorized access;
3. Administration: to manage roles, permissions, multisig membership metadata, and organizational settings configured by authorized managers;
4. Compliance: to respond to lawful requests, enforce terms of use, and satisfy legal obligations where applicable;
5. Improvement: to diagnose defects, improve reliability, and develop features, using aggregated or de-identified information where feasible.

Where GDPR or similar regimes apply, processing may rely on contract performance, legitimate interests in operating secure financial coordination software, compliance with legal obligations, and, where required, consent. Operators are responsible for determining appropriate legal bases for their deployments.

The Application does not sell Personal Data. Information may be disclosed only in the following circumstances:

1. Among authorized multisig members within the same instance, consistent with role-based access controls;
2. To infrastructure providers engaged by the Operator (hosting, RPC providers, backup services), subject to contractual confidentiality and security obligations;
3. To wallet extensions when you initiate connection, signing, or chain suggestion flows in your browser;
4. To the public blockchain when transactions are broadcast, as On-Chain Data becomes permanently visible on the ledger;
5. For legal reasons when disclosure is required by law, regulation, court order, or governmental request, or to protect rights, safety, and integrity of users and systems;
6. In corporate transactions involving an Operator, subject to applicable notice requirements.

Operators may host instances in any jurisdiction. If you access the Application from outside the hosting region, your information may be transferred to and processed in countries with different data protection standards. Operators deploying in regulated environments should implement appropriate safeguards, such as standard contractual clauses or equivalent mechanisms, where required by law.

Retention periods depend on Operator policy, multisig operational needs, and legal requirements. Indicative practices include:

• Session data: until logout, expiry, or invalidation;
• Collaboration Data: for the life of the multisig account and organizational retention schedule configured by the Operator;
• Security logs: as determined by Operator, often between thirty (30) and three hundred sixty-five (365) days unless longer retention is required for incident investigation or legal hold;
• On-Chain Data: immutable and permanent on the blockchain regardless of Application retention settings.

Operators should define and publish instance-specific retention schedules where required by applicable law.

The Application incorporates security-by-design principles, including wallet-native authentication, SignDoc verification before signature storage, outflow classification for external sends, hashed session tokens, role-based access control, encrypted backups where configured, and transport hardening. No system is completely secure. Users must protect their devices, wallet extensions, and organizational access policies.

You are responsible for maintaining the confidentiality of your wallet and device. Compromise of a signer endpoint may permit unauthorized signatures or access within the permissions granted to that address.

Depending on your jurisdiction, you may have rights to access, rectify, erase, restrict, object to, or port Personal Data, and to withdraw consent where processing is consent-based. You may also lodge a complaint with a supervisory authority.

• Disconnect your wallet and terminate your session at any time;
• Request correction of inaccurate Collaboration Data through your multisig manager or Operator;
• Cease participation in a multisig by organizational governance and by refraining from further signatures;
• Contact the Operator of your instance to exercise statutory privacy rights.

Because blockchain addresses may constitute pseudonymous identifiers, erasure of On-Chain Data is generally technically infeasible once transactions are confirmed. Off-chain Collaboration Data may be deleted or anonymized subject to Operator capability and legal obligations.

The Application is not directed to individuals under the age of eighteen (18), or the age of majority in their jurisdiction if higher. We do not knowingly collect Personal Data from children. If you believe a child has provided information through an instance, contact the relevant Operator.

The Application integrates with third-party wallet extensions and may rely on public RPC providers, indexers, and token metadata sources. Those services are governed by their own privacy policies. Operators are responsible for selecting trustworthy infrastructure providers.

We may revise this Policy from time to time. Material changes will be indicated by updating the “Last revised” date above. Continued use after changes become effective constitutes acceptance of the revised Policy, except where prohibited by law. Operators may publish additional notices for regulated deployments.

Privacy inquiries should be directed to the Operator of the instance you use. For Foundation-operated or community instances, contact channels published on the official Safrochain website or your organization's designated compliance contact.