# Privacy Policy

_Last updated: 2026-08-08_

This policy explains what personal information Chimi collects, why, and who else sees it. It is written to be read, not to be skimmed past. Chimi is operated by **Chimi Labs Ltd.**, Cayman Islands.

> The short version: we collect an email address so you can log in and get transaction confirmations, and technical data needed to run the site. We are **non‑custodial** — we never hold your private keys and never ask for identity documents. We do not sell your data and we run no advertising.

## Who we are

Chimi is operated by Chimi Labs Ltd., registered in the Cayman Islands. For any question about this policy, or to exercise the rights described below, write to [help@chimi.finance](mailto:help@chimi.finance).

## What we collect

| Category | What it is | Why we have it |
| --- | --- | --- |
| **Account data** | An email address, and — if you sign in with Google — your Google display name and account ID. Your wallet addresses. | To identify your account and to send you transaction confirmations. |
| **Technical data** | IP address, browser and device type, and which pages you viewed. | To serve the site, keep it working, and diagnose errors. |
| **On‑chain activity** | Deposits, withdrawals and vault positions associated with your wallet address. | To show you your portfolio. This data is public on the blockchain whether or not you use Chimi. |

## What we never collect

- **Your private keys.** Chimi is non‑custodial. Your wallet is created and secured by Privy, and Chimi cannot see, export, or transact with your keys.
- **Identity documents.** No passport, no driver's licence, no proof of address, no selfie.
- **Bank or card details.** Chimi never touches your bank account.
- **Your Google password.** Sign‑in happens on Google's own pages; your password is never sent to Chimi.

## What we receive when you sign in with Google

If you choose “Continue with Google”, Google sends Chimi three pieces of information about your account — and nothing else:

| What Google sends us | Where it is stored | What it is used for |
| --- | --- | --- |
| **Your email address** | Privy, our login provider | Identifying your account, and sending you welcome and deposit/withdrawal confirmation emails through Resend |
| **Your display name** | Privy | Shown in your account interface. It is not sent anywhere else. |
| **Your Google account ID** | Privy | A stable identifier that links your Google login to your Chimi wallet, so you get the same wallet each time you sign in |

**What we do not receive.** Chimi requests only your basic profile and email address. We do not receive your Google password, your contacts, your Gmail, your Drive files, your Calendar, your photos, or anything from any other Google service. No other Google permission is enabled for Chimi, so no other Google data can reach us even in principle.

**Where it does not go.** Your email address and name are never written to a blockchain — on‑chain records contain wallet addresses only. They are not included in the internal operational alerts described below, which carry a wallet address and transaction details and no personal identifiers. They are not sent to the blockchain indexer we use for your transaction history. They are never sold, rented, or shared with advertisers, and Chimi runs no advertising and no cross‑site tracking.

**If you would rather not use Google:** signing in with an email code gives us your email address and nothing else. Signing in with an external wallet gives us no email address at all — in that case we cannot send you confirmation emails.

## Who else sees your data

Chimi uses the following providers. Each receives only what it needs to do its job.

| Provider | What it does | What it receives |
| --- | --- | --- |
| **Privy** | Login and non‑custodial embedded wallets | Email address, Google profile fields, wallet addresses |
| **ZeroDev** | Processes your transactions so you don't pay gas | Wallet address, transaction details |
| **Resend** | Delivers our emails | Your email address, and the amount, asset and transaction reference quoted in the message |
| **Sentry** | Error monitoring, in production only | Error reports, which may include a wallet address |
| **Vercel** | Hosting, plus page‑view and performance analytics | IP address, browser type, pages viewed |
| **Telegram** | Chimi's internal operations alerts | Transaction type, amount, wallet address — no email address and no name |
| **The Graph** | Indexes your transaction history | Wallet address, queried by our server |
| **Relay** | Cross‑chain bridging, only if you bridge | Wallet addresses and bridge amounts |
| **Price provider** | Token prices | No personal data |

## Blockchain data is public and permanent

Every deposit and withdrawal you make is a public blockchain transaction, permanently recorded and linked to your wallet address. Anyone can read it. Chimi cannot edit or delete it, and neither can we — this is how blockchains work, not a choice we made. If you later ask us to delete your account, that removes your Chimi account record but cannot remove your on‑chain history.

## How we protect your IP address on-chain

Most crypto apps send blockchain requests straight from your browser to a third‑party node provider, which lets that provider tie your IP address to your wallet address. Chimi does not: blockchain reads are routed through our own server, so the node provider sees our server rather than you.

## Cookies and local storage

Chimi sets no advertising cookies and does no cross‑site tracking. Privy stores authentication data in your browser to keep you signed in between visits, and we store your language preference. Our page‑view analytics is cookieless.

## Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete your account and the data attached to it. Write to [help@chimi.finance](mailto:help@chimi.finance) from the address on your account and we will respond within 30 days. Deleting your account does not, and cannot, delete your blockchain transaction history — see the section above.

## How long we keep it

Account data is kept for as long as your account exists, and deleted when you ask us to close it. Error reports and analytics are kept on our providers' own retention schedules, which are measured in months rather than years.

## Age

Chimi is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.

## Changes to this policy

We may update this policy. If a change materially affects how we handle your data, we will say so in the app. The “Last updated” date at the top of this page is always authoritative.

## Contact

Questions about this policy: [help@chimi.finance](mailto:help@chimi.finance).