Privacy policy

This policy describes how Zenith Asset Management LLC, the company behind Slyng ("we", "us"), handles information when you use the website at slyng.tech, the Slyng app for iPhone, and the APIs behind them (together, the "Service"). It is part of the Terms of Use. Where privacy law uses the words, we are the "controller" or "business" for the information described here, except for information a provider collects under its own policy, which is called out below.

• Your wallet address, when you connect a wallet or create one through the Service. It is already public on the chain. It is your identity throughout the Service, and everything below is keyed to it.
• Sign-in details, held by Privy. Signing in to the app, or to the site with an embedded wallet, goes through Privy, Inc. Privy collects the email address, Apple ID or other login you use, creates and secures the embedded wallet, and holds those details under its own privacy policy. We receive the wallet address. Where you sign in with an email address it is visible to us in Privy's dashboard; we do not use it for marketing and do not add it to any list.
• What you publish. A coin's name, ticker, description, links and image; a profile handle, bio and avatar; chat messages and replies; likes; who you follow. All of it is public and attributed to your address.
• A photo you pick. The app asks for permission to your photos only when you choose an avatar or a coin image, and uploads only the image you picked. We never read your library.
• Your inbox. Records of who followed, replied to, liked or mentioned you, and whether you have seen them, so the inbox and its badge work.
• That you accepted the terms: the version, the time, and the signature your wallet made, recorded against your address so you are not asked on every device and so the record is provably yours.
• Your name and email, only if you join the waitlist for the app. We use them to send you the invite and for nothing else. We do not add you to a mailing list or pass them to anyone. Ask and we delete them.
• Sponsored transactions. When we pay the network fee for a transaction, we record the sending address, the operation's hash, the calls it makes, the gas involved and the time. That is how the per-wallet and daily limits are enforced and how the app can ask what happened to an operation.
• A session. Posting, liking, following and clearing your inbox use a signed session: on the site, a cookie that lasts twelve hours; in the app, a session kept in the phone's secure storage. It proves the request came from your wallet and holds nothing else.
• Direct messages. When you message another wallet, we store the message, who sent it, who it went to, when, and how far each of you has read, so the conversation can be shown to the two of you. Messages are stored on Slyng's server and are not end-to-end encrypted. They are not public: only the two wallets in a conversation can read it, and only with their signed session. If you report a message, we read that message to review the report, and we may remove it. Messages are kept for as long as the conversation exists.
• Technical data. The hosting provider's server logs record IP addresses, user agents, request paths and times for a short period, as every web host does. The RPC providers that read the chain and the bundler that sends sponsored transactions see network requests too, including an IP address. The Service uses no analytics SDK, no advertising SDK and no tracking pixel.
• Card purchases go through MoonPay. Buying crypto with a card or Apple Pay is a transaction between you and MoonPay, which runs its own identity verification under its own privacy policy. We pass MoonPay the wallet address the crypto should arrive at and sign the request; we receive nothing about your identity, your card or your bank.
• A cache of public chain data: coins, trades, balances and prices, copied from the blockchain so pages load. It is not collected from you.

We never collect or store private keys, seed phrases or wallet passwords, and nothing in the Service asks for them. We do not collect government identification, a date of birth, precise location, contacts, or advertising identifiers. We do not track you across other websites or apps, we do not build an advertising profile, and we do not sell personal information.

• To run the Service: show your profile and coins, deliver messages and notifications, keep your inbox, record that you accepted the terms, and pay for sponsored transactions within their limits.
• To keep it safe: rate limits, abuse prevention, moderation, and the sanctions and eligibility rules in the Terms.
• To send you the app invite you asked for.
• To comply with the law and to establish or defend legal claims.
• To understand use in aggregate, from counts that identify no one.

Where the law of the European Union or the United Kingdom applies, our legal bases are performing our agreement with you, our legitimate interests in running and securing the Service, your consent where we ask for it (photos, the waitlist), and our legal obligations.

• Everyone, by design. Your wallet address, what you publish, and everything you do on the chain are public. Other users see your handle, avatar, bio, coins, messages and follows.
• Providers that run the Service on our behalf. Vercel hosts the site and its APIs. Supabase holds the database and uploaded images. Privy handles sign-in and embedded wallets. Alchemy bundles and pays for sponsored transactions. MoonPay handles card purchases. WalletConnect links external wallets. RPC providers read the chain. Apple distributes the app and runs TestFlight. Each sees what it needs for its job, under its own terms.
• The blockchain. A transaction you sign is sent to a public network and recorded there forever.
• When the law requires. We may disclose information to comply with a law, court order or lawful request, to enforce the Terms, or to protect the rights, safety or property of anyone.
• A successor. If the Service changes hands, the information goes with it under this policy.

We do not sell personal information and do not share it for cross-context behavioural advertising.

Every transaction you make is recorded on a public blockchain by design. We cannot delete it, and neither can anyone else. Anything you do on chain can be linked to your address by anyone, forever, whatever this policy says. Choosing a handle links that handle to the address too.

The site sets one cookie, the twelve-hour session described above, and only when you sign in to post. It uses your browser's local storage to remember that you accepted the terms and small interface preferences. The app keeps its session and wallet material in the phone's secure storage. There are no third-party advertising cookies. Because we do not track, there is nothing for a "Do Not Track" or Global Privacy Control signal to switch off, and we treat either as an opt-out from any sharing anyway.

What you publish stays until you delete it or we remove it. Inbox records stay for as long as your inbox needs them. Records of sponsored transactions stay for as long as the limits and our accounts need them. The terms acceptance stays for as long as it is evidence of the agreement. Waitlist details stay until the invite is sent or you ask. Server logs are kept briefly by the hosting provider under its defaults. The cache of chain data is a copy of public information and is refreshed continually.

Every connection is encrypted. Requests that change something about you are signed by your wallet and checked on the server. Keys never touch our servers, and the secrets the Service itself uses are held in provider configuration, not in code. No system is perfectly secure, and the security of your wallet, your device and your sign-in is yours.

You can change or clear your handle, bio and avatar at any time by editing your profile, unfollow anyone, ask us to hide a chat message, and delete the app or disconnect a wallet whenever you like. Depending on where you live you may also have the right to ask what we hold about you, to correct it, to delete it, to receive a copy, to object to or restrict some uses, to withdraw a consent you gave, and to complain to your data protection authority. California residents have the rights to know, delete and correct, to opt out of sale or sharing (we do neither), and not to be discriminated against for exercising them. To exercise a right, contact us (section 14); we will ask you to prove control of the wallet by signing a message, because the wallet is the only identity we have. We cannot delete anything on the chain, or copies that others have already taken of what you published.

The Service is for adults. It is not directed at anyone under 18, and we do not knowingly collect information from anyone under 18. If we learn that we have, we delete it.

The Service is operated from the United States and its providers store data there and in other countries where they operate. If you use it from elsewhere, your information is transferred to and processed in those places, where the law may differ from yours.

A material change gets a new version number and effective date at the top, and you will be asked to accept it again before continuing to use the Service with your wallet.

Write to Zenith Asset Management LLC at dakota@zenithassets.io. You can also reach us through the X account or the Telegram group linked in the site footer, but send legal notices and privacy requests by email.