Privacy Policy

1. Controllers and scope

This Policy covers the Sherhood interface operators (“we”, “us”). It applies when you use sherhood.xyz, connect a wallet, save a profile, view leaderboards, or call our APIs. It does not cover third-party wallets, explorers, OpenSea, Telegram, Orynth, or RPC providers you use independently.

2. Categories of data

• Wallet & on-chain data — public addresses, balances, approvals, Sherd pool deposits, Sherd ownership, marketplace listings/trades. This data is read from Robinhood Chain (and related RPCs). We do not receive your private keys or seed phrases.
• Display profile (database) — if you opt in by signing a message: unique display name, URL slug, avatar id, allow-receive flag, wallet address, and update timestamp. Stored in MongoDB Atlas (database sherhood, collection profiles).
• XP, streaks, actions, activity cache — derived from public chain events (deposits, creates, claims, trades, etc.). We may materialize and cache scores and activity timelines in MongoDB (wallet_scores, profile_stats, xp_events) to make leaderboards and profile pages load faster. These scores are not financial instruments.
• Signatures — wallet signatures used to prove control when saving or deleting a profile. Signatures are verified server-side; we do not use them to move funds.
• Local browser storage — wagmi / RainbowKit / WalletConnect session state and a local profile cache for faster UI. Clearing the browser or using Delete my account removes local copies.
• Technical / hosting logs — Vercel, CDN, RPC, and Atlas may process IP address, user-agent, request path/timing, and error logs to deliver and secure the Service. We do not sell this for advertising profiles.
• Optional third parties — price APIs, Telegram, OpenSea, Orynth, explorers you open yourself; their policies apply separately.

3. What we do not collect

We do not ask for government ID, passwords, seed phrases, or payment card numbers for Sherhood accounts. Never send private keys to anyone claiming to be Sherhood support.

4. Purposes of processing

• Show protocol state and route transactions you initiate
• Operate display profiles, People directory, and allow-receive sends
• Compute and display XP, streaks, actions, and leaderboards
• Improve reliability, security, and performance (caching, abuse prevention)
• Comply with law if compelled

Because the product is experimental, features and retention may change without notice (see Terms).

5. Legal bases (where applicable)

Where GDPR/UK GDPR or similar laws apply, we rely on: (a) your consent / contractual necessity for optional profiles you create by signing; (b) legitimate interests in operating a public experimental interface, caching public chain-derived stats, and securing the Service; and (c) legal obligation when disclosure is required.

6. Retention & Delete my account

Profiles and cached XP/activity remain until you delete them or we purge data for abuse, legal, or operational reasons. Use Profile → Delete my account and sign the deletion message to remove your MongoDB profile and associated off-chain caches, then clear this browser’s interface storage and disconnect the wallet.

Blockchain records (deposits, NFTs, trades, addresses) cannot be deleted by Sherhood. Re-indexing public chain activity may recreate XP caches for an address that remains active on-chain even after profile deletion.

7. Sharing and processors

We do not sell personal data. Infrastructure processors (including Vercel hosting and MongoDB Atlas) process data to run the Service under their terms. Public profile fields you enable (name, avatar, and wallet if allow-receive is on) are visible to other users. Compelled disclosure may occur if legally required.

8. International transfers

Hosting and database providers may process data in the United States and other regions. Do not use the Service if you require enterprise residency or contractual SCCs tailored to your organization — this is experimental consumer software.

9. Security

We use HTTPS, signed profile updates, and standard cloud controls. No method of transmission or storage is 100% secure. You are responsible for wallet and device security.

10. Children

The Service is not directed to children under 18 (or higher age of majority in your jurisdiction).

11. Your rights

Depending on your location, you may have rights to access, correct, or erase personal data we hold off-chain. Profile edit and Delete my account are the primary self-serve tools. Contact us via Telegram for residual requests. We may ask you to prove wallet control. Rights do not extend to rewriting public blockchain history.

12. Changes

We may update this Policy at any time by posting a new version with an updated date. Continued use after posting means acceptance.

13. Contact

Telegram · Terms of Service