Privacy Policy

1. Information We Process

Accounts and wallets

When you create an account or sign in, we and our authentication and wallet providers process your email address, account identifiers, wallet addresses, and information needed to authenticate you and operate your wallet. An embedded Ethereum wallet is created during account setup. We obtain this information from you, from the App, and from the providers supporting these features.

When you use wallet features, the App accesses public blockchain information, such as wallet balances, asset ownership, and transaction records, and processes the transaction information needed to carry out your instructions.

Alerts and notifications

If you enable push notifications, we process a device push token and the punk identifiers, wallet addresses, search filters, and preferences you select for alerts. We store the information needed to evaluate and deliver those alerts on our servers. Notification providers process push tokens and notification contents to deliver messages to your device.

Usage data and session replay

We use analytics to understand screen views, taps, feature usage, and technical performance. Depending on the enabled features, analytics can include device and App information and identifiers that distinguish sessions or installations. Information associated with an identifier can be personal information even when it does not include your name or email address.

When optional session replay is enabled, it records a reconstruction of your interaction with the App to help diagnose usability and technical problems. Sign-in fields are configured to be masked. You can opt out of analytics in the App. Where consent is required, we obtain it before the relevant collection and provide a way to withdraw it.

Technical information

Our services and providers receive network information, including your IP address, when the App connects to them. Technical information is processed to deliver requests, maintain service reliability, and protect against unauthorized activity. Information retained in logs is subject to the retention criteria below.

Fiat-to-crypto services

If you use the USD-to-USDC funding feature, identity-verification and payment providers process the information required for that service. This may include your legal name, contact details, identity-verification information, bank account details, wallet address, and transaction information. Their processing supports verification, fraud prevention, legal compliance, conversion, and settlement.

Independent financial providers also explain their processing and your choices in the privacy notices presented when you use their services.

Communications

If you contact us, we collect your contact details and the information you provide so we can respond and resolve your request.

Information stored on your device

Saved punks, accounts, and searches are stored locally on your device. Saving an item does not itself upload your saved list to our servers. Using an item or filter to configure a remote alert transmits the information needed for that alert. Searches and content requests may also be sent to the services needed to return results.

Authentication session information is stored using iOS Keychain or encrypted storage on Android. Your device or backup provider may include eligible local App data in backups according to your settings.

2. How We Use Information

We use account and wallet information to authenticate you, manage your account, provide wallet features, display blockchain information, and carry out transactions you authorize. We use notification information to deliver the alerts you configure.

We use usage and technical information to understand how the App works, diagnose problems, improve features, and protect the App and its users. We process information associated with funding requests to facilitate services offered by our payment and verification providers.

We also use relevant information to respond to support and privacy requests, communicate service or policy changes, prevent fraud and abuse, enforce our agreements, resolve disputes, and comply with applicable law.

3. How We Disclose Information

We disclose information to providers according to the services they perform and the features you use.

Authentication and wallet providers process account, email, wallet, and authentication information to create accounts, secure wallets, and authorize operations.

Analytics and diagnostic providers process usage, device, and session information subject to the collection settings and controls described in this Policy.

Notification providers process device tokens and message contents to deliver alerts.

Identity-verification and payment providers process identity, financial, wallet, and transaction information to verify eligibility, prevent fraud, and complete funding transactions.

Hosting, security, infrastructure, and support providers process information needed to operate our services, store data, secure the App, and resolve inquiries. Blockchain infrastructure providers process wallet queries and signed transactions.

Providers acting on our behalf process information to deliver the services we request. Providers offering independent services, including financial services, may also process information under their own privacy policies, made available when you use those services.

We may disclose relevant information when you authorize us to do so; when required by law or valid legal process; to investigate fraud or security incidents; or to protect the rights, property, or safety of Windward, users, or others. Information may also be disclosed in connection with a merger, acquisition, reorganization, or transfer of our business, subject to applicable legal requirements and confidentiality protections.

4. Public Blockchain Information

Ethereum is a public blockchain. Transactions you submit may permanently reveal wallet addresses, asset identifiers, amounts, contract interactions, and timestamps. This information can be viewed and copied by network participants, blockchain explorers, and others, and may be linked to your identity.

Windward cannot change or delete confirmed records on the public Ethereum network. Deleting an App account does not erase blockchain records. This limitation does not prevent us from deleting eligible account information held in systems we control.

5. Data Retention

We retain personal information only for as long as needed for the purposes described in this Policy. We determine retention based on the service requested, whether the information remains necessary, applicable legal requirements, outstanding disputes, and security needs.

Account and wallet association records: retained while needed to maintain your account and provide wallet features, then deleted when no longer needed, subject to applicable retention obligations and the account-deletion process below.

Push tokens and alert rules: retained while needed to provide the alerts you request. Rules that you remove and tokens that we identify as invalid are removed from active use. Turning off notifications in your device settings may not immediately notify our servers or remove existing records.

Analytics, replays, and technical logs: retained for the period necessary to analyze usage, diagnose issues, and investigate security incidents. The retention period depends on the relevant analysis or investigation and whether identifiable records remain necessary.

Support information: retained as needed to resolve the inquiry, complete related follow-up, and handle applicable disputes or recordkeeping obligations.

Financial-service records: records held by Windward are retained as needed to support the transaction and meet applicable obligations. Independent payment and verification providers may have separate legal retention requirements.

Backups: deleted information may remain in backups until those backups expire under the applicable backup schedule.

Local and blockchain information: local saved information remains until you clear it, subject to device storage and backup behavior. Public blockchain information may remain indefinitely.

6. Security and Wallet Storage

We use safeguards designed to protect personal information, including HTTPS encryption for network communication and platform-protected storage for sensitive authentication information.

Wallet key management is provided through our wallet infrastructure provider. The storage and processing of encrypted key material can involve infrastructure outside your device; local authentication storage does not mean that all wallet key material remains exclusively on the device.

No method of storage or transmission is completely secure. Protect access to your device and authentication methods, and keep any exported wallet credentials confidential.

7. Device Permissions

The App requests permission when needed for the relevant feature. Declining permission may make that feature unavailable. You can manage permissions through your device settings.

Notifications: used to deliver alerts you request.

Microphone and speech recognition: used to convert speech into search text when you activate voice search. Windward does not retain voice-search audio.

Face ID or other biometrics: used for local authentication and transaction approval. The App receives an authentication result, not your biometric template.

Photo library: used to save selected punk artwork. The App does not browse or read your photo library through this feature.

Motion sensors: used locally for parallax interface effects. Motion data is not transmitted to Windward.

8. Your Choices and Account Deletion

Analytics: you can opt out of analytics collection in the App. Where processing relies on your consent, you can withdraw that consent. Withdrawal does not affect processing lawfully performed before it was withdrawn.

Notifications: manage alert preferences in the App or disable notification delivery in device settings.

Local information: clear saved punks, accounts, and searches using the App’s controls. Clearing local information or uninstalling the App does not by itself delete your account or information already held by our services.

Request account deletion

You can request deletion of your CryptoPunks App account and associated personal information by emailing contact@windwardlabs.xyz with the subject “CryptoPunks account deletion.” Include the email address associated with your account. You do not need to reinstall the App to submit a request.

We may verify your identity before acting on your request. We delete eligible account information and request deletion by providers processing it on our behalf. Where we must retain information for legal compliance, security, fraud prevention, or an unresolved dispute, we explain the applicable exception. Public blockchain records and records independently held by financial providers are subject to the limitations described above.

Before deleting your account, review the effect on wallet access and make arrangements to retain access to your assets. Account deletion does not transfer assets or reverse transactions.

9. Privacy Rights

Depending on your location and the law that applies, you may have rights to access your personal information; obtain a portable copy; correct inaccuracies; request deletion; restrict or object to processing; withdraw consent; and opt out of qualifying sales, sharing, targeted advertising, or profiling. You may also have the right to use an authorized agent, appeal a denied request, and exercise your rights without discriminatory treatment.

Submit a request to contact@windwardlabs.xyz. We may request information reasonably needed to verify your identity or an agent’s authority. We respond within the period required by applicable law and explain any denial or extension. Where an appeal is available, you can submit it by replying to our response.

European Economic Area and United Kingdom

Where applicable data-protection law treats Windward as a controller, we are responsible for deciding how and why we process information covered by this Policy.

We rely on performance of our contract with you for account administration and requested App features; legitimate interests in operating, securing, and supporting the App for necessary security and support processing; legal obligations for required compliance records; and consent for optional processing where required. Our legitimate interests are subject to your interests and rights.

Where we rely on legitimate interests, you may object to the processing based on your particular circumstances. You may also complain to the data-protection authority where you live or work or where the alleged infringement occurred. Information needed to provide a requested feature or meet a legal obligation is required for that purpose; without it, that feature may be unavailable.

10. International Processing

Windward is based in the United States. Information may be processed in the United States and other countries where our providers operate. Those countries may have privacy laws that differ from the laws where you live.

11. Children’s Privacy

The App is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information, contact us so we can investigate and delete information collected improperly.

Financial-service features are subject to the age and eligibility requirements presented by the relevant provider. Additional protections may apply to children under local law.

12. Changes to This Policy

We may update this Policy when the App or our practices change. We will post the revised Policy with an updated effective date and provide notice of material changes through the App or another appropriate channel before they take effect. Where a change requires your consent, we will obtain it before applying the new processing.

13. Contact Us

For questions about this Policy or to exercise your privacy rights, contact:

Windward Labs, Inc.
Email: contact@windwardlabs.xyz