Privacy notice

1. Scope

This notice covers the SIXPASS web application, its public API, wallet authentication, reward ledger and support workflow. It does not cover third-party wallets, Solana RPC providers, blockchain explorers, console platforms or distributors, which operate under their own policies.

2. Data we process

• Wallet and authentication data: your public Solana address, short-lived challenge nonce and message, signature verification result, and a hashed session token stored in an HttpOnly cookie.
• Onchain and reward data: public transaction signatures and slots, trade direction and SOL amount, token balance snapshots for holders, calculated weight, review status and reason, reward epochs, receipts, credit ledger entries and redemption records.
• Redemption data: selected SKU, declared account region, delivery status, masked code, reveal count and receipt key. Voucher codes are encrypted at rest with a keyring.
• Support data: the case category, note, messages, attachments you upload, attachment metadata and case status. Attachments are limited to PDF, PNG, JPEG or plain text and 8 KB.
• Technical and security data: IP address and request metadata processed by the web server for rate limiting and abuse prevention; timestamps and audit records; local browser preferences for motion, display, region and notification choices.

SIXPASS does not request or store your seed phrase, private key, exchange password, console password, full payment card data or government identity documents. Do not submit them.

3. Why we process it

We process data to authenticate the wallet session; record token balances and eligible holdings; calculate reward allocations; prevent duplicate claims, linked-wallet abuse, fraud and replay; deliver and recover reward codes; handle support and appeals; maintain accounting, treasury and audit records; secure the service; and comply with applicable law.

4. Cookies and local storage

The application sets a strictly necessary HttpOnly session cookie after wallet authentication. It uses browser storage for pending redemption idempotency keys and local display, region, motion and notification preferences. There is no advertising tracker in the current application. Third-party sites opened from SIXPASS may set their own cookies.

5. Public blockchain data

Solana transactions, wallet addresses, token movements and related signatures are public by design. SIXPASS cannot delete or alter onchain data. Public activity pages may show shortened wallet addresses and verified transaction links. Do not treat onchain data as private.

6. Sharing

Data may be shared with infrastructure, database, security and RPC providers acting for the operator; wallet and platform providers as needed to deliver a code; distributors or fulfillment providers handling a specific order or replacement; professional advisers; and authorities where legally required. The current pre-launch software does not include an advertising or data-broker integration. Any production sharing arrangements must be listed in the final notice.

7. Retention

Authentication challenges are short-lived. Sessions expire. Operational records, including credit, reward, redemption, support and audit entries, are retained to prevent replay and fraud, evidence financial integrity and meet legal obligations. Onchain records persist indefinitely. A concrete retention schedule is not yet published and must be added before production.

8. Security

Measures include signed-message authentication, hashed session tokens, encrypted voucher storage, encrypted support attachments, access control, rate limiting, audit logging and reconciliation checks. No system is perfectly secure. You are responsible for protecting your wallet and device, and should sign out on shared devices.

9. Your choices and rights

You can disconnect the session, clear local preferences, download an account export from Profile & settings, and request deletion through a support case linked to a redemption. Depending on your jurisdiction, you may also have rights to access, correct, delete, restrict or object to processing, or to complain to a supervisory authority. Onchain records and accounting audit logs may be exempt from deletion or required to be retained.

The automatic privacy-request path requires an existing redemption reference. A dedicated privacy contact for people without a redemption is not yet published. This is a pre-launch limitation, not a completed rights process.

10. Children

The service is intended for adults aged 18 or older. It is not directed to children. If you believe a minor has provided data, contact the operator once a production contact is published.

11. International processing

Infrastructure providers may process data in other countries. The final notice must identify transfer mechanisms and any applicable safeguards. Do not use the service if those arrangements are unacceptable to you.

12. Changes

This notice may change as the program moves from pre-launch to production. Material changes should be published with a new effective date. The current version is a draft and should not be treated as a final representation of the operator's legal entity or retention practices.

13. Contact

Authenticated reward issues can be opened in the Support Center inside the application. A dedicated privacy contact, operator legal entity and complaint channel must be published before real-customer operation. Never send a seed phrase, private key, password or full voucher code.