Privacy policy

Controller

Marco Rondoni, Arezzo (Italy) — privacy@nondum.io. [Full details to be added before payments go live.]

What we process and why

• The capsule content (the message): encrypted in your browser before it reaches us. We cannot read it. We keep only the ciphertext and its fingerprint (hash).
• Title and blurred photo preview: in clear, because the capsule page needs them and, if you choose "public", so does the feed. The title also goes into the NFT on Solana, where it can no longer be deleted: do not write other people's names or data in the title.
• Email (optional): for the reminder on the opening date and the receipt. Legal basis: performance of the contract. We never pass it on and never use it for marketing.
• IP address: we keep only an irreversible version (salted hash) to limit abuse; it cannot be linked back to you.
• Payment: handled by Stripe; we receive only the transaction identifier and its outcome. Stripe is an independent controller for payment data.
• Wallet: if you sign in by email through Privy, a Solana wallet is created in your name; its public address is linked to the capsule and visible on-chain.

Where the data lives

Database and encrypted files on Supabase (European Union); website on Vercel; permanent archive of the encrypted files on Arweave (a public distributed network); public proof on Solana (a public blockchain). What is written on Arweave and Solana is, by nature, permanent and replicated worldwide: that is why it only contains encrypted data, fingerprints and the title.

For how long

Until the capsule opens and for one year after; email and IP hash for at most 12 months after opening or after you delete your account.

Your rights

Access, rectification, erasure, restriction, portability, objection, complaint to a supervisory authority (in Italy, garanteprivacy.it). You can ask us at any time to remove title, preview, email and encrypted files from our systems and from the feed. We cannot delete what is already on Solana or Arweave (title, hash, encrypted files): a known technical limit, accepted when sealing the capsule.

Cookies

No profiling cookies. Only the technical ones needed for sign-in with Privy, if you use it.