Privacy Policy

1. Introduction

Subnano is operated by madsb.com, registration number DK26607094, Denmark. Contact hello@subnano.me. We are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, and protect your information when you use our platform.

2. Information We Collect

Subnano collects minimal user data necessary for account creation, transaction processing, and platform functionality. The types of data we collect include:

• Account Information: Username, email (if provided), and profile details.
• Transaction Data: Nano (XNO) and Base/USDC wallet addresses, signatures needed for authentication or payment verification, network identifiers and original purchase/settlement history.
• Usage Data: Logs of platform interactions, purchase records, and login sessions.
• Technical Data: IP address (anonymized after processing), browser type, and device information.
• Analytics Data: Section views, clicks, device type, and referrer information to improve platform usability (stored locally in your browser and on our servers).

We do not collect sensitive personal data or financial details beyond what is necessary for cryptocurrency transactions.

3. How We Use Your Data

We use collected data for the following purposes:

• To facilitate and verify Nano (XNO) and native USDC payments on Base.
• To record purchase disclosures, express immediate-delivery consent and immutable order confirmations, and handle purchase-related support enquiries and complaints. These records support contract performance and applicable accounting, consumer protection and legal obligations.
• To manage user authentication and access.
• To provide customer support and improve platform performance.
• To prevent fraud, abuse, and unauthorized access.
• To analyze user behavior and improve the platform experience (first-party analytics only).

4. Data Storage and Security

• User data is stored in Supabase, a secure backend service with encrypted databases.
• Access control policies and rate limiting are enforced to protect sensitive information.
• IP addresses associated with login sessions are anonymized periodically to enhance privacy.

5. Data Sharing and Disclosure

• We do not sell or share user data with third-party advertisers.
• Transaction-related addresses, amounts and hashes may be recorded on the public Nano or Base blockchain. These public records cannot be erased by deleting your Subnano account.
• We may disclose information if required by law or to prevent fraud and abuse.

6. User Rights and Control

• Users can update or delete their profiles at any time.
• Users can request data deletion by contacting support.
• Wallet-only users can manage their account and contact us to exercise data rights. We retain financial and legal audit records where required after account deletion; this does not keep public profiles active.

7. Analytics and Local Storage

Subnano uses necessary authentication and private checkout cookies, including host-only HttpOnly bindings for Base wallet login and USDC guest checkout. We also use localStorage and sessionStorage for functional recovery metadata and first-party analytics:

• Necessary cookies identify your chosen session and original checkout. Clearing them can require wallet login to recover account access; a public transaction hash does not replace a private credential.
• We use browser storage for non-spendable operation correlation and functional or analytics identifiers. A payment recovery record is not a wallet seed or authority to spend.
• Analytics data includes section views, clicks, device type, and referrer information.
• Post analytics includes first-party post view events used for creator-facing performance insights.
• Pseudonymous analytics identifiers used for post analytics are retained for up to 90 days.
• All analytics data is first-party only and never shared with advertisers or external tracking services.
• Session tokens are used for authentication and access control.
• You can clear your browser's localStorage at any time to remove these identifiers.

8. Third-Party Integrations

• Subnano uses Supabase for account and database processing, blockchain RPC providers for Nano/Base verification and Coinbase/CDP for the USDC facilitator method. Wallet SDKs and selected wallet providers process connection and signing requests according to their own policies. Only data needed for the requested authentication, payment and recovery is sent.
• We do not share personal data with these services beyond what is required for transaction validation.
• The local Subnano MCP server stores saved account credentials and operation state on your computer. It sends the authentication and request data needed for your chosen actions to the Subnano API. Wallet seeds and private keys remain local.
• Tool results and any content you add to a conversation are made available to your chosen AI client. That provider handles the conversation according to its own privacy policy and your account settings. Use the trusted local setup prompts for secrets, rather than pasting them into chat.
• Subnano Browse processes public search and reading requests without a Subnano account. Requests still reach Subnano services and may be included in service logs and operational analytics. Anonymous access does not mean the request is processed only on your device.
• Removing an MCP connection does not delete your Subnano account or its saved local state. Manage your account separately and preserve local state when updating or reconnecting.

9. Subnano Browse for AI Assistants

• Subnano Browse receives the search terms, filters and Post identifiers your assistant sends to answer your request. It returns public Post titles, author names and handles, introductions, publication details and prices, and the text of published free Posts. It does not request your conversation history, account credentials or wallet information.
• Vercel hosts the Browse server and Subnano API, and Supabase provides the underlying public catalog. These providers process the requests needed to return results and maintain service availability. Your AI provider receives the tool results and any Post context you explicitly add to the conversation.
• The Browse application processes requests in memory and does not persist search terms, tool results, user identities or MCP sessions. Application-level operational analytics is disabled. Vercel may retain technical request logs, including network metadata, request paths, timestamps and response status, for up to 30 days under its runtime logging limits. The Browse project does not export those logs to a separate log service.
• You can stop future requests by disabling or removing the Browse connection. Remove selected Post context in the interactive browser, and manage saved conversations through your AI provider. For questions or deletion requests concerning Subnano-held data, contact hello@subnano.me; do not send wallet seeds, private keys or passwords.

10. Changes to this Policy

We may update this Privacy Policy from time to time. Users will be notified of significant changes through platform notifications or emails (if provided).