Privacy Policy

Last updated: 7 November 2026

Proofly has no accounts, names or passwords: your wallet address is your identity. This page lists what we keep, why, and how to have it removed.

Data controller

The data controller is Xenos Panagiotis, reachable at xenospanagiotis3@gmail.com.

What we store on our server

Wallet addresses of people who claim a credential, write a review or host an event, with the session and the time.
Review texts, their salts and review photos. A salt is a random value that lets anyone recompute a review’s fingerprint. Text and salt are public on the review, and photos are stored in a publicly readable bucket. Photo files must carry no camera or location metadata: the app strips it and the server refuses files that have it.
Descriptions and photos of events and sessions, written by their hosts.
IP addresses, for rate limits: stored with each claim attempt and with each Sign in request. Sign in records are deleted once they have expired, the next time anyone signs in. Claim records have no automatic deletion: they stay until you ask us to erase them.
Claim records: the transaction signature and whether we topped up the wallet with devnet SOL.

What is on the blockchain

Solana devnet is public, and anyone can read it. It holds your wallet address, your credentials, each review’s rating and its fingerprint, and the names of events and hosts. Nobody can delete this, including us. The review text and photos are not on-chain.

Cookies and browser storage

proofly_auth: set when you Sign in with your wallet, to show our server which wallet it is talking to. It is strictly necessary, not readable by page scripts, and expires after 8 hours.
proofly_admin: only for moderators, expires after 1 hour.
Your browser also keeps your theme, your last wallet, the authors you hid, and a review or photos waiting to upload. These stay on your device.

We use no analytics, no advertising and no tracking cookies.

Why we use this data

To run the service you ask for, to show and verify reviews, and to protect it from abuse, which is our legitimate interest. We do not sell your data. We do not collect regulated data such as identity documents, health data or card details, and we ask that you do not put any in your content.

Who else handles it

Vercel hosts the app and receives requests, including your IP address.
Supabase stores the database and the photos.
Helius and Solana’s public RPC (Remote Procedure Call) servers relay requests to the blockchain.
Your wallet app handles your connection and signatures.

These providers may process data outside your country. We share data with authorities only when the law requires it.

How content is removed

Withdraw: the author can withdraw a review, which closes its on-chain account. The review stops being shown. Its text, salt and photos stay on our server, unseen, until the author asks us to erase them.
Moderation: when a moderator removes a review, its text, salt and photos are deleted from our server, and copies in caches expire within about 5 minutes. A removed description or photo is deleted the same way. The on-chain record stays, and the page says that the content was removed.
Your request: write to xenospanagiotis3@gmail.com from any address, with your wallet address. We may ask you to sign a message to prove that the wallet is yours. We then erase what we hold about that wallet, except what the law requires us to keep.

Your rights

Depending on where you live, you may have the right to access, correct, erase or restrict your data, to object, and to complain to your data protection authority. Write to us to use any of these rights. What is on the blockchain cannot be changed or erased.

Children

Proofly is not for anyone under 18, and we do not knowingly collect their data. If you believe a minor has used Proofly, write to us and we will erase what we hold.

Changes and contact

If we change this policy, we update this page and its date. See also the Terms of Use. Questions: xenospanagiotis3@gmail.com.