Privacy Policy

1. A note on public blockchains

Hashlock is non-custodial. When you transact, information such as wallet addresses, amounts, and transaction hashes is written to public blockchains that we do not own or control. That on-chain data is public, permanent, and pseudonymous by design; it cannot be changed, hidden, or deleted by us or by anyone, and it may be linked to your identity by third parties. Please consider this before transacting.

2. Information we collect

Blockchain and transaction data. Wallet addresses (Bitcoin, EVM, TRON, and Solana), public keys, transaction hashes, and swap and order metadata (such as assets, amounts, chains, timelocks, hashlocks, quotes, counterparties, and status) that we process to operate and secure the Service.

Account and authentication data. When you sign in through our authentication and embedded- wallet provider, we receive identifiers associated with your chosen login method, which may include an email address, a social or Telegram account identifier and username, and a provider user ID. We do not receive your social-account or Telegram passwords.

Data you provide. Settlement and refund addresses, address-book entries you save, counterparties you interact with, messages you send within a deal, and any information you provide when you contact support or request API access.

Technical and usage data. IP address, device and browser type, approximate location derived from IP, timestamps, pages and features used, referring URLs, and server and error logs. We use this for security, abuse prevention, rate-limiting, and to operate and improve the Service.

Anonymous product analytics. Our servers record anonymous, aggregate events about how the Service is used — for example that a request-for-quote was created from the web app or the Telegram Mini App, how long a quote or settlement took, on which chains, and where flows are abandoned. These events are generated server-side; they contain no account identifier, no wallet address, and no IP address, and amounts are recorded only as coarse ranges, never exact values. Because these events cannot be linked to you, they are not personal data, and no analytics script, cookie, or other tracker runs on your device for this purpose. We rely on our legitimate interest in understanding and improving the Service (see Section 5).

Fiat purchase and sale records. If you use the “Buy” or “Sell” option, MoonPay sends us status updates for that transaction: their transaction identifier, whether it is a purchase or a sale, its status and any failure reason, the amounts and currencies involved, and the on-chain transaction hash. We hold this so the Service can show you where your purchase or sale stands. We do not receive your identity-verification (KYC) documents, payment-card details, or bank-account details — those stay with MoonPay (see Section 6).

Referral data. If you join through a partner's invite link or code, or we record that a partner introduced you, we record which partner referred you and any note on how the introduction was made, so that the partner's share of the protocol fees can be calculated. A partner may also give us the contact details (such as an email address or Telegram username) of a person they intend to introduce, so that we can send that person an invite. See Section 6 for what the partner sees.

Compliance data. Results of sanctions, watchlist, and risk screening applied to wallet addresses and transactions, where we perform such screening.

3. Data stored on your device

The Service stores data on your device to function. Your sign-in session is kept in a secure, HttpOnly session cookie that page scripts cannot read and that expires after seven days. Interface preferences and — for atomic swaps — the swap secret (preimage) are kept in your browser's local storage; the secret is generated and kept on your device and deleted automatically 72 hours after it is created, which is longer than any swap needs it. The secret is never transmitted to us in plaintext; only its SHA-256 hashlock is shared as required by the protocol. Our authentication provider may also store session data on your device. Clearing this storage may sign you out and remove any locally-held swap secret.

4. How we use personal data

• To provide, operate, and maintain the Service, including RFQ, quotes, deals, and swap settlement;
• To authenticate you and secure your session and wallet access;
• To protect the Service and users — fraud prevention, abuse detection, rate-limiting, and debugging;
• To comply with legal obligations, including sanctions and anti-money-laundering requirements, and to respond to lawful requests;
• To run our referral program — recording which partner introduced you, calculating and paying the partner's share of protocol fees, and showing the partner the referral information described in Section 6;
• To communicate with you about the Service, including operational and support messages, and material changes to our terms or policies;
• To analyze and improve the performance, reliability, and usability of the Service.

5. Legal bases (EEA/UK users)

Where the GDPR applies, we process personal data on the following legal bases:

• Performance of a contract — to provide the Service you request under our Terms;
• Legitimate interests — to secure and improve the Service and prevent abuse, and to run our referral program, including holding the contact details a partner gives us for a person they introduce, balanced against your rights;
• Legal obligation — to comply with sanctions, AML, and other applicable laws;
• Consent — where we ask for it, such as for any optional communications; you may withdraw consent at any time.

6. How we share personal data

We do not sell your personal data. We share it only as described here:

• Service providers (processors) — our authentication and embedded-wallet provider; blockchain RPC, node, and indexing providers; hosting and cloud-infrastructure providers; an error-monitoring provider (Sentry, EU region), which receives error reports — the error, the address of the page or endpoint where it occurred, and, as with any connection, your IP address — with account details, cookies, and request contents excluded and wallet addresses and secrets removed from the error text; and messaging platforms, each acting on our instructions to run the Service;
• Public blockchains — transaction data you initiate is broadcast to public networks (see Section 1);
• MoonPay (independent controller) — if you choose to buy or sell cryptocurrency for fiat currency, we direct you to MoonPay and pass the blockchain address you control, together with an identifier for your Hashlock account so that the resulting transaction can be shown back to you. MoonPay is not our processor: it acts as an independent controller of the personal data it collects from you, under its own privacy policy, and it — not we — collects and holds your identity-verification documents and payment details. We receive only transaction status information back (see Section 2);
• MoneyGram (independent controller) — if you choose to take cash out at, or pay cash in at, a MoneyGram agent, we create a session with MoneyGram and pass an identifier for your Hashlock account; the blockchain address you control is passed to their widget by your browser. MoneyGram is not our processor: it acts as an independent controller of the personal data it collects from you, under its own privacy policy, and it — not we — collects and holds your identity-verification documents and the details of the cash payment. The cryptocurrency transfer is signed by your own wallet, and we never take custody of the funds; our servers do assemble that transfer and relay it to the blockchain on your instruction, which means we process the deposit address and the amount MoneyGram quotes you;
• Referral partners — if a partner referred you (see Section 2), that partner sees you as a numbered client together with the label of the invite you used (which may name you if the invite was made for you personally), when the referral started and ends, whether you confirmed or disputed it, and how many trades you made. They also see their own total earnings and payouts. They do not see your wallet addresses, account details, or the individual transactions you made, though a partner with few clients may be able to estimate your trade sizes from changes in their earnings, and a partner who introduced you personally may be able to tell which numbered client you are;
• Legal and safety — regulators, law enforcement, or other parties where required by law or to protect our rights, users, or the public;
• Corporate transactions — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

7. International transfers

We and our providers may process personal data in countries other than yours. Where we transfer data out of the EEA or UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) or an adequacy decision. You may request more information using the contact below.

8. Retention

We retain personal data for as long as needed to provide the Service and for legitimate business and legal purposes — for example, to operate and reconcile swaps, prevent abuse, and meet compliance and record-keeping obligations. Retention periods vary by data type and applicable law. On-chain data cannot be deleted by us (see Section 1). Referral records, including the contact details a partner gave us for a person they introduced, are kept for as long as the referral can earn the partner a fee share and afterwards as a record for resolving disputes about it.

Raw anonymous analytics events (Section 2) are deleted after 90 days; only aggregate statistics derived from them are kept longer. Because these events are anonymous, they cannot be linked to you, and access, deletion, and portability requests therefore do not reach them — there is nothing identifying to produce or erase.

9. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or object to our processing of your personal data, to data portability, and to withdraw consent. To exercise these rights, contact us at the address below; we may need to verify your request. You also have the right to lodge a complaint with your local data-protection authority. Note that we cannot alter or erase information already recorded on public blockchains, and some data must be retained to meet legal obligations.

10. California privacy rights

If you are a California resident, you have rights under the CCPA/CPRA to know the categories and specific pieces of personal information we collect, to request deletion or correction, and to opt out of “sale” or “sharing” of personal information. We do not sell or share your personal information as those terms are defined under California law, and we do not discriminate against you for exercising your rights. You may exercise these rights using the contact below.

11. Cookies and local storage

We use only strictly-necessary and functional storage — such as the session cookie and interface preferences — required for the Service to work and to keep it secure. We do not use advertising cookies or cross-site tracking. Because this storage is strictly necessary, it operates without a consent banner; you can control or clear it through your browser or device settings, though doing so may impair the Service. Our product analytics (Section 2) is generated entirely on our servers and is anonymous: it uses no cookies, no scripts, and no storage on your device, so it does not change this posture. Beyond the scripts of the authentication, wallet, messaging, and payment providers listed in Section 6 (the MoneyGram widget loads only when you open the cash option), your browser reports from your device only in two ways: our error monitoring (Section 6), which sends a report only when an error occurs, and the browser's own security-policy reports, which tell our servers the page address and the address of anything our security policy blocked (we keep only the blocked site's domain and the rule it broke). Neither stores anything on your device. If we ever introduce non-essential cookies or device-side tracking, we will update this Policy and request consent where required.

12. Security

We maintain technical and organizational measures designed to protect personal data, including encryption in transit, access controls, and least-privilege practices. No method of transmission or storage is completely secure, and you are responsible for safeguarding your wallet, keys, and credentials, which we cannot access or recover.

13. Children

The Service is not directed to, and may not be used by, anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

14. Changes to this Policy

We may update this Policy from time to time. We will revise the “Last updated” date and, for material changes, provide additional notice through the Service. Your continued use after changes take effect constitutes acceptance of the updated Policy.

15. Contact us

For privacy questions or to exercise your rights, contact us at legal@hashlock.markets. Security matters may be reported to info@hashlock.markets.