Privacy Policy — nowcoin

This policy explains what personal data [operator's legal name] ("nowcoin", "we", "us") collects when you use the nowcoin website, apps and browser extension (the "Service"), why we collect it, who we share it with, how long we keep it, and the rights you have. We are the controller of your personal data. You can reach us at [contact email address].

1. What we collect

When you create an account

Your email address, and your password. We store the password only as an Argon2id hash; we never see it or keep it in readable form.
Your legal name and residential address: country, state or region, city, street address and postal code.
A record of your agreement to our Terms of Service and this Privacy Policy: which versions you accepted, when, and the IP address and browser you used.

When you use the Service

Your balances and transactions: your deposit address on each network, the deposits you receive, the withdrawals you make, their destination addresses, amounts, fees and status. Our ledger records every movement of your balance.
Your sign-in sessions: when you signed in, and the IP address and browser used for each session.
Security and technical data: IP addresses, browser type, the times of requests and error details in our server logs, and records of failed sign-in attempts.
Messages you send us through the contact page: your name, email address, the topic you chose and your message, with the IP address and browser you sent it from.

Human verification. To stop automated sign-ups, your browser solves a short computational puzzle before your account is created. The puzzle uses no personal data. Where it is enabled, we also use Cloudflare Turnstile, which processes information about your browser and device, and your IP address, to decide whether you are a person (see section 5).

Blockchain data. Blockchains are public. Transactions to and from your deposit addresses, and the addresses you send to, can be seen by anyone, and cannot be deleted by us or by anyone else.

We do not use analytics, advertising or tracking cookies, and we do not buy information about you from others.

2. Why we use it, and our legal bases

To provide the Service: to open and run your account, credit your deposits, send your withdrawals, show your balance and history, and support you. Our legal basis is the performance of our contract with you.
To meet our legal obligations: including rules on anti-money laundering, counter-terrorist financing and sanctions, record-keeping, and responding to lawful requests from authorities. Our legal basis is compliance with a legal obligation.
To keep the Service and your account secure: to prevent fraud and abuse, detect automated sign-ups, lock accounts after repeated failed sign-ins, and investigate incidents. Our legal basis is our legitimate interest in running a secure service, which is also in your interest.
To tell you about important changes to the Service, to our terms or to your account. Our legal basis is our contract with you and our legitimate interests.

Sign-up is refused automatically from countries and regions where we do not offer the Service. Apart from that, we do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

We share personal data only where needed:

with service providers who host and operate our infrastructure, under contracts that require them to protect it and to use it only on our instructions;
with blockchain networks and the node providers we use to read from and write to them, which receive the addresses and transactions involved in your deposits and withdrawals;
with bridge and exchange providers, when we move funds between networks to complete a withdrawal, which receive the transaction details needed;
with Cloudflare, when Turnstile is enabled, for human verification;
with authorities, courts and regulators, where the law requires it, or where needed to establish, exercise or defend legal claims; and
with a buyer or successor, if our business is reorganised or sold, who will be bound by this policy.

We do not sell your personal data.

4. International transfers

Our service providers may process your data in countries other than your own, including countries outside the European Economic Area and the United Kingdom. Where they do, we rely on safeguards recognised by law, such as the standard contractual clauses approved by the European Commission.

5. Cloudflare Turnstile

When Turnstile is enabled on the sign-up form, Cloudflare, Inc. processes information about your browser and device, and your IP address, to verify that you are a person. It does not use this information for advertising. See Cloudflare's privacy policy for how Cloudflare handles it.

6. Storage in your browser

The site keeps the following in your browser. All of them are needed for the site to work, and none is used for analytics or advertising.

Name	Where	Purpose	How long
`nc_session`	Cookie, sent only to our API and unreadable by the site's scripts	Keeps you signed in	Until you sign out, or at most 30 days
`nc_signed_in`	Cookie	Tells our pages that you are signed in, without holding anything that could sign you in	Until you sign out, or at most 30 days
`nc_locale`	Cookie	Lets our server open the site in your language	1 year
`nc_notice`	Cookie	Remembers that you have seen the storage notice	1 year
`nowcoin.locale`	Local storage	Remembers the language you chose	Until you clear it

The cookies are set for nowcoin.xyz and its subdomains, so that the language you choose and your sign-in carry across login.nowcoin.xyz, signup.nowcoin.xyz, app.nowcoin.xyz and legal.nowcoin.xyz.

7. How long we keep it

Account, identity and transaction records: for as long as your account is open, and afterwards for as long as the law requires, which for anti-money-laundering purposes is usually five years after the account is closed, and longer where tax or accounting law requires.
Sign-in sessions: deleted about 30 days after they expire.
Human-verification records: the puzzle identifiers we keep to stop a puzzle being used twice are deleted within a day of expiring.
Server logs: kept for a limited period for security and troubleshooting, then deleted.
Contact messages: deleted a year after we receive them.
Blockchain data: cannot be deleted by anyone.

8. How we protect it

All traffic to the Service is encrypted in transit. Passwords are stored only as Argon2id hashes. Sign-in uses short-lived access tokens and single-use refresh tokens, and every session on an account is ended if a refresh token is used again after it has been exchanged for a new one. Accounts are locked after repeated failed sign-ins. Access to personal data is limited to the people who need it for their work. No system is perfectly secure; if a breach of your personal data occurs, we will notify you and the authorities where the law requires.

9. Your rights

Depending on where you live, you have the right to:

access your personal data and receive a copy of it;
have inaccurate data corrected;
have your data erased;
restrict or object to our processing of it;
receive your data in a portable format; and
withdraw any consent you have given, without affecting processing that took place before.

Some of these rights are limited by law: for example, we cannot erase records we are legally required to keep. To exercise a right, contact us at [contact email address]. We will reply within one month. You also have the right to complain to a data protection authority, in particular in the country where you live or work.

10. Children

The Service is not intended for anyone under 18, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy. We will tell you about material changes before they take effect and, where required, ask you to accept the new version. The version in force is shown at the top of this page.

12. Contact

[operator's legal name], [registered address]. Email: [contact email address].