Privacy Policy

This draft explains how Orba ("we", "us", or "our") handles information when you visit or use the Orba website, APIs, indexer, agent features, and related services (collectively, the "Service"). It is not yet effective and must be reviewed before Orba launches on mainnet.

1. Information We Handle

Depending on how you use the Service, we may handle:

• Wallet and blockchain data: wallet addresses, transactions, token launches, trades, balances, approvals, tips, and other activity recorded on Arc.
• Authentication data: wallet-signature challenges, signatures, nonces, session tokens, and related security records.
• Service records: profiles derived from wallet activity, favorites, messages, referral relationships and statistics, token positions, and leaderboard data.
• Agent records: agent profiles, operator wallet addresses, hashed API-key records, templates, launches, trades, spend reservations, limits, tips, and operational status.
• Submitted content: token descriptions, images, banners, websites, and social links. Images submitted through Orba may be sent to an IPFS pinning provider.
• Technical data: IP address, request time, route, browser or device information, RPC requests, error and security logs, and rate-limit records generated when your device communicates with our infrastructure.

We do not ask for your wallet seed phrase or private key. Never provide either one to Orba or to anyone claiming to represent Orba.

2. Public Blockchain Data

Arc is a public blockchain. Wallet addresses and confirmed transactions are visible to anyone and may be copied, indexed, or analyzed by third parties. We do not control the blockchain and cannot correct, erase, or reverse confirmed on-chain activity. A wallet address may be personal data under some laws when it can be linked to a person.

3. How We Use Information

We use information to:

• operate wallet authentication and requested product features;
• index and display token, market, profile, referral, and agent activity;
• process image uploads and display user-submitted token content;
• protect the Service, enforce limits, prevent abuse, and investigate incidents;
• maintain reliability, diagnose errors, and measure infrastructure health;
• comply with law and respond to valid legal requests; and
• establish, exercise, or defend legal claims.

Where applicable, our legal bases may include providing the Service you request, our legitimate interests in operating and securing it, compliance with legal obligations, and consent where the law requires it.

4. Browser Storage and Cookies

Orba uses local storage to remember theme and referral information, session storage to preserve an in-progress token launch, and a SameSite theme cookie. Wallet connectors may use their own storage to maintain a connection. These technologies support requested functionality; they are not used by Orba for cross-site behavioral advertising.

5. How Information Is Shared

We disclose information only as needed to operate the Service, comply with law, protect users and infrastructure, or complete a business transition. Providers used for the mainnet Service may include:

• Vercel for website hosting and delivery;
• Render for API hosting;
• Supabase for PostgreSQL data storage;
• Upstash for Redis caching, rate limits, and event delivery;
• Circle, dRPC, QuickNode, and Blockdaemon for Arc RPC access;
• Pinata and public IPFS gateways for token media;
• WalletConnect and the wallet provider selected by you; and
• professional advisers, authorities, or counterparties where reasonably necessary.

This list must be checked against the production provider inventory before publication. Each independent provider may handle IP addresses, device data, wallet addresses, or request metadata under its own terms.

6. Sale, Sharing, and Advertising

Orba does not sell personal information and does not use personal information for cross-context behavioral advertising. If those practices change, we will update this policy and provide any notices or choices required by law before the change takes effect.

7. Retention

We retain off-chain information for as long as reasonably necessary for the purposes described above. Authentication challenges and transient cache data are short-lived. Security logs may be retained long enough to detect abuse and investigate incidents. Token, trade, referral, agent, message, and profile records may be retained while the Service operates and afterward where needed for security, dispute resolution, legal compliance, or reliable historical market records. Backups may persist for a limited recovery period. Production retention periods must be approved before this draft is published.

8. Your Choices and Rights

Depending on where you live, you may have rights to know about, access, correct, delete, restrict, object to, or obtain a copy of personal data we control, and to appeal or complain to a regulator. These rights are subject to legal exceptions and do not allow Orba to alter public blockchain data.

To make a request, email legal@orba.fun. We may ask for reasonable proof that you control the wallet address involved, such as a narrowly worded signature challenge. We will never ask for your seed phrase or private key.

9. Security

We use technical and organizational measures intended to protect off-chain information, including encrypted transport, access controls, rate limiting, secret management, and monitoring. No system is completely secure. You remain responsible for protecting your wallet, device, recovery phrase, and any API credentials issued to you.

10. International Transfers

Orba and its providers may process information in the United States and other countries whose privacy laws differ from those where you live. Where required, we will use an appropriate transfer mechanism or other safeguard.

11. Children

The Service is not directed to anyone under 18, and people under 18 may not use it. Contact us if you believe a minor has provided off-chain personal data.

12. External Services

The Service may link to wallets, block explorers, faucets, social networks, and other third-party services. Their privacy practices are governed by their own policies, not this policy.

13. Changes and Contact

We may update this policy as the Service, providers, or law changes. The final policy will show its effective date. Questions and rights requests may be sent to legal@orba.fun.