Version 2026-10-14 · Applies to staterfi.com, the Sepolia testnet app at /app/, and the mainnet app at /router/
| Data | When | Why |
|---|---|---|
| Email address | You submit the waitlist form | To notify you when testnet access opens, and for occasional product updates you can opt out of anytime |
| IP address, browser/device info | Any visit, automatically, via Cloudflare (our hosting provider) | Standard web security and abuse prevention — the same as almost any website. We don't use this for tracking or advertising |
| Wallet address | You connect a wallet to the app | Checked against the OFAC sanctions list at the moment you connect. That check stores nothing. The address is public blockchain data, visible to anyone on Sepolia regardless of whether you use our site |
| Wallet address, which page you were on, country, hashed IP, browser string, terms version, a digest of the terms text served, timestamp | You accept the Terms in either application | This we do store. It is the record that you accepted a specific version of the Terms, which we need to be able to show. We record which surface you accepted on, because the testnet app and the mainnet app are separate acceptances. We also store a hash of the exact Terms and Privacy text we served you, so it is provable what you agreed to. Your IP address is hashed before storage and the raw address is never kept. If no wallet is connected when you accept, no wallet address is stored |
| The first two letters of your email address and its domain | You join the waitlist | Sent to the team's private Discord channel as a notice that someone signed up. The full address stays in the store described in section 3 |
| The text of a problem report, the step you were on, and the first and last characters of your wallet address if you were connected | You send a report from the app | Stored, and sent to the same private Discord channel so that a person sees it |
| A public tag on your deposit | You deposit through the mainnet app | Each deposit made through this page carries a number inside the transaction that marks it as made through StaterFi. It is public, like the deposit itself, and it identifies the page, not you. It lets deposits be counted from the blockchain alone, without our collecting anything |
| Your IP address, seen by Google | Any visit | The pages load their typefaces from Google Fonts, so Google's servers receive the request. We receive nothing from it |
| Aggregate page views | Any visit, via Cloudflare Web Analytics | To see which pages get visited. It is cookieless, doesn't fingerprint you, and doesn't follow you to other sites |
Waitlist emails and terms-acceptance records are stored using Cloudflare's infrastructure (Workers KV), on the same platform that hosts this website. Cloudflare acts as our infrastructure provider; see Cloudflare's own privacy policy for how they handle data on our behalf. We do not use a separate third-party email marketing tool at this stage. Signup notices and problem reports are also delivered to a private Discord channel, so Discord processes those two items on its own servers; see Discord's privacy policy.
How long we keep it. Waitlist emails, terms-acceptance records and reports are kept until you ask us to delete them or until the project no longer needs them. There is no automatic deletion schedule yet.
Our applications read balances and market data through public RPC endpoints named in their configuration. Connecting a wallet shares only your public wallet address with the page, as with any Ethereum application; we never see your keys.
One thing worth stating because most policies omit it: the RPC provider that serves those reads can see your IP address alongside the wallet address being queried. That is inherent to how every browser-based Ethereum application works, ours included, and it is not something we can remove by policy. The mainnet app at /router/ reads through a public node provider; the Sepolia app reads through the endpoints in its configuration. If that linkage matters to you, use a wallet or browser that routes RPC traffic through infrastructure you choose.
Transactions you sign are broadcast by your own wallet, not by us. We never see or hold a signed transaction before it reaches the network.
This site uses your browser's local storage for three narrow purposes: keeping a backup copy of your waitlist submission on your own device, remembering simple UI preferences in the testnet app (like your last-used tab), and recording which version of the Terms you have accepted, per application, so we do not ask again on every visit — accepting the testnet terms does not mark the mainnet interface as accepted, and the two are stored under separate keys. This data stays on your device and is never transmitted to us as tracking data.
You can ask us to delete your email address from our waitlist at any time by emailing [email protected] with the subject "Delete my data." We'll confirm removal within a reasonable time. If you're in the EU/UK or California, this covers your GDPR/CCPA-style right to deletion for the data we hold: the email address if you gave us one, any report you sent, and the record of the Terms you accepted. We may keep an acceptance record for as long as we need to be able to show that the Terms were accepted, and will tell you if we do.
StaterFi is not directed at, and we do not knowingly collect data from, anyone under 16.
The mainnet app is live, and this policy was revisited on 13 October 2026. It will be revisited again when a third-party service or an identity check is introduced. We'll update the date above when that happens.
Questions or deletion requests: [email protected]