Privacy Policy

1. Introduction

This Privacy Policy (the “Privacy Policy”) explains how information relating to your access to and use of the website located at reinforce.fi (the “Interface”) may be processed.

The Interface enables users to interact with the Reinforce Protocol, a decentralized, non-custodial software protocol deployed through public blockchain smart contracts (the “Protocol”).

The Protocol itself is decentralized software and is not a corporation, partnership, foundation, association, decentralized autonomous organization (DAO), trust, or other legal entity.

This Privacy Policy applies solely to information processed in connection with the Interface and related website functionality. It does not govern information processed directly on public blockchain networks or through third-party interfaces, applications, or services that are not part of the Interface.

This Privacy Policy should be read together with the Reinforce Terms of Use, which govern access to and use of the Interface.

By accessing or using the Interface, you acknowledge that information relating to your use of the Interface may be processed as described in this Privacy Policy.

2. Definitions

For purposes of this Privacy Policy:

“Interface” means the website located at reinforce.fi, together with all website functionality, application interface functionality, APIs (if any), and related services made available through it.

“Protocol” means the Reinforce decentralized, non-custodial software protocol deployed through public blockchain smart contracts.

“Services” means the functionality made available through the Interface that enables users to interact with the Protocol.

“Privacy Policy” means this Privacy Policy, as amended from time to time.

Unless otherwise defined in this Privacy Policy, capitalized terms have the meanings assigned to them in the Terms of Use.

3. Scope

This Privacy Policy applies exclusively to information processed through the Interface.

It does not apply to information processed by:

• public blockchain networks;
• smart contracts themselves;
• third-party decentralized applications;
• cryptocurrency wallets;
• digital asset exchanges;
• blockchain explorers;
• third-party websites;
• social media platforms;
• analytics or infrastructure providers acting under their own independent privacy policies;
• any other third-party services that are not part of the Interface.

Your interactions with such third-party services remain subject to their own terms, privacy policies, and applicable legal notices.

The Interface merely provides a software interface through which users may interact with the Protocol. This Privacy Policy does not govern the processing of information performed independently by public blockchain networks or unrelated third parties.

4. Categories of Information Processed

Depending upon how you use the Interface, the following categories of information may be processed.

Wallet Information

When you connect a compatible wallet to the Interface, information processed may include:

• public wallet address;
• wallet connection status;
• supported blockchain network;
• wallet provider;
• transaction requests initiated through the Interface;
• blockchain transaction confirmations;
• wallet-authentication challenges, the exact messages presented for signature, and the resulting cryptographic signatures;
• a short-lived Interface session token stored in a secure cookie and a one-way digest of that token stored by the server;
• the version, hash, URL, and acceptance time of the Terms of Use bound to the signed wallet-authentication message;
• onboarding progress;
• Interface preferences.

The Interface does not collect, store, access, or otherwise process:

• private keys;
• seed phrases;
• recovery phrases;
• wallet passwords;
• wallet-provider login passwords, device PINs, or other custodial authentication secrets;
• biometric authentication data.

A wallet signature and an Interface session token authenticate use of the Interface only. They do not disclose the wallet’s private key and do not grant the Interface authority to sign blockchain transactions without a separate wallet interaction.

Blockchain Information

Because the Protocol operates entirely on public blockchain networks, the Interface may process publicly available blockchain information, including:

• wallet addresses;
• token balances;
• transaction hashes;
• transaction timestamps;
• transaction amounts;
• smart contract interactions;
• blockchain network identifiers;
• publicly available Protocol activity.

Such information is generally publicly available through the relevant blockchain network and may also be accessible through blockchain explorers or other third-party services.

Technical Information

The Interface may automatically process certain technical information necessary for operation, security, and diagnostics, including:

• IP address;
• approximate country or region derived from IP address;
• browser type and version;
• operating system;
• device type;
• preferred language;
• pages visited;
• Interface interactions;
• timestamps;
• server-generated pseudonymous analytics identifier, after analytics consent;
• performance metrics;
• diagnostics;
• crash reports;
• security logs.

Compliance and Sanctions-Screening Information

To comply with applicable legal obligations, the Interface processes certain information for sanctions and jurisdictional-eligibility screening in connection with transactions submitted through the Interface, including:

• wallet addresses involved in a transaction (including sender and recipient);
• IP address and the approximate country or region derived from it;
• the outcome of the screening (allowed or declined) and the applicable sanctions-list version.

Where a wallet address involved in a transaction appears on an applicable sanctions list (such as the U.S. Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) list), or where access originates from a restricted jurisdiction, the relevant operation is declined. Records created for this purpose are retained as described in Section 9.

Communications

If you voluntarily contact the Interface through publicly available communication channels, information processed may include:

• email address;
• username;
• wallet address, if voluntarily provided;
• communication contents;
• support requests;
• bug reports;
• feature requests;
• feedback;
• other information voluntarily submitted by you.

Local Storage

The Interface may use browser local storage or similar technologies to remember:

• language preferences;
• wallet connection preferences;
• hidden balance settings;
• onboarding choices and completion markers;
• academy lesson progress;
• a pending referral attribution code;
• network and transfer-direction choices;
• expanded or dismissed Interface disclosures;
• Interface configuration;
• security preferences;
• other user experience settings.

The Interface’s own browser-local records do not place wallet addresses, transaction hashes, operation or order identifiers, idempotency keys, or amounts in browser local storage. A bounded referral attribution code may remain there until its claim settles, the Interface establishes that the referral no longer applies, or you clear browser storage. Compatible wallet software may separately retain its selected-wallet and connection-session state. Preference information generally remains stored locally within your browser unless removed by you.

5. Purposes of Processing

Information processed through the Interface may be used solely for purposes related to the operation, security, maintenance, and improvement of the Interface.

Depending on how you use the Interface, information may be processed for one or more of the following purposes:

• providing and maintaining the Interface;
• enabling wallet connectivity;
• authenticating control of a connected public wallet and maintaining a time-limited Interface session;
• presenting the current Terms of Use and recording which version the wallet accepted;
• facilitating interaction with the Protocol;
• displaying blockchain information requested by users;
• maintaining the security, integrity, and availability of the Interface;
• preventing, detecting, investigating, or responding to fraud, abuse, malicious activity, security incidents, or unauthorized access;
• monitoring technical performance and diagnosing software errors;
• improving the usability, functionality, accessibility, and reliability of the Interface;
• responding to communications, support requests, and bug reports voluntarily submitted by users;
• complying with applicable legal obligations where required by law;
• enforcing jurisdictional eligibility and restricting or declining access to certain features where required by applicable law, sanctions programs, or regulatory considerations;
• screening wallet addresses involved in transactions against applicable sanctions lists (such as the OFAC SDN list) and declining operations involving a listed address;
• protecting the Interface, supporting infrastructure, and users from misuse or technical disruption.

The Interface is not used to make automated decisions producing legal effects or similarly significant effects concerning individual users.

6. Public Blockchain Data

The Protocol operates on public blockchain networks.

Information submitted to a blockchain through the Interface generally becomes part of the public blockchain ledger.

Public blockchain data is generally:

• publicly accessible;
• transparent;
• immutable;
• replicated across decentralized network participants;
• permanently recorded.

As a result, wallet addresses, transaction hashes, token transfers, smart contract interactions, and similar blockchain records may remain publicly accessible indefinitely.

The Interface cannot:

• modify blockchain records;
• delete blockchain records;
• restrict public access to blockchain information;
• reverse confirmed blockchain transactions;
• erase information permanently recorded on public blockchain networks.

Accordingly, this Privacy Policy applies only to information processed through the Interface and does not govern information permanently recorded on public blockchain networks.

7. Cookies, Local Storage and Analytics

The Interface may use cookies, browser local storage, and similar technologies to support its operation, improve security, and enhance the user experience.

Strictly Necessary Technologies

The Interface may use strictly necessary cookies or browser storage for purposes including:

• wallet connection status;
• wallet-authentication session continuity;
• language preferences;
• Interface configuration;
• hidden balance settings;
• onboarding progress;
• security preferences;
• fraud prevention;
• technical functionality required for operation of the Interface.

For same-tab recovery of an in-progress transaction after a reload, the Interface may temporarily store the order identifier, idempotency key, direction, displayed amount estimate, transaction stage, and transaction hash in browser session storage. This state is scoped to the current browser tab and is not retained in browser local storage.

Browser local storage may keep a pending referral attribution code so attribution is not discarded when a tab closes before the first eligible mint. The current tab may also keep unseen-completion markers containing an operation identifier, operation kind, and success or failure outcome. Those markers survive a reload, are not retained in browser local storage, and disappear when the tab session ends or the related Interface action clears them.

If you enable push notifications, the Interface temporarily keeps the push endpoint, selected wallet network, and public wallet binding in browser session storage so the current tab can display and refresh the subscription. Browser local storage retains only the non-identifying choice to hide the push pre-prompt. The browser independently retains the push subscription while permission remains enabled.

These technologies are necessary for the proper functioning of the Interface and generally cannot be disabled without affecting its functionality.

Analytics

Where permitted by applicable law, the Interface may use analytics technologies to better understand how users interact with the Interface and to improve its functionality and reliability.

Analytics information may include:

• browser information;
• operating system;
• device information;
• Interface interactions;
• visited pages;
• navigation events;
• performance metrics;
• anonymous, pseudonymous, or aggregated usage statistics.

Before a consent choice is made, and after analytics is rejected, the Interface uses only cookieless measurement. No persistent analytics identifier is stored on your device and no person profile is created. A strictly necessary cookie records the consent choice, the Privacy Policy version under which it was made, and the exact time of that choice. Cookieless measurement may process the technical information listed in Section 4 to derive a short-lived anonymous identifier on the analytics provider’s servers.

After analytics is accepted, the Interface may store a first-party analytics identifier. Authenticated product events may also be linked using a server-generated pseudonym produced by a keyed one-way transformation of the normalized public wallet address. The transformation key and raw wallet address are not sent to the analytics provider for this purpose. The pseudonym allows events associated with the same wallet to be linked without exposing that wallet address to the analytics provider.

Analytics emitted by background processing without an active consent-bearing request is recorded without a user or wallet identifier and without creating a person profile.

Users may change or withdraw analytics consent at any time through the analytics preference control on this page. Withdrawal stops future pseudonymous capture and returns browser measurement to cookieless mode. Events collected before withdrawal may be retained as described in Section 9.

Session Replay and Diagnostics

Subject to applicable law and any required user consent, the Interface may in the future use diagnostic technologies, including session replay functionality (a capability that is not currently enabled), to investigate software issues, improve usability, and diagnose technical errors.

Reasonable technical measures are implemented to prevent unnecessary collection of sensitive information during diagnostic sessions, including masking or excluding, where technically feasible:

• wallet balances;
• transaction amounts;
• wallet addresses;
• user inputs;
• other sensitive Interface elements.

Marketing Technologies

The Interface does not currently use:

• advertising cookies;
• behavioral advertising technologies;
• cross-site advertising trackers;
• third-party marketing pixels.

If marketing technologies are introduced in the future, this Privacy Policy will be updated accordingly where required by applicable law.

8. Third-Party Infrastructure Providers

The Interface relies upon independent third-party infrastructure providers to support its operation, security, performance, and blockchain connectivity.

Current providers may include, without limitation:

• Cloudflare — content delivery network (CDN), network optimization, caching, security services, and DDoS protection;
• PostHog — product analytics and usage analytics;
• Sentry — application monitoring, diagnostics, crash reporting, and error tracking;
• Alchemy — blockchain infrastructure and Remote Procedure Call (RPC) services;
• CoinGecko — market and pricing information;
• WalletConnect (Reown) — wallet connectivity services;
• OKX Connect — wallet connectivity services;
• jsDelivr — content delivery network (CDN) for web fonts;
• YouTube (Google) — embedded educational video content;
• cloud hosting providers supporting the delivery of the Interface.

The providers used by the Interface may change over time as the Interface evolves.

Independent infrastructure providers process information in accordance with their own privacy policies and legal obligations.

The Interface does not control how such independent providers process information once it has been transmitted to them.

Users are encouraged to review the privacy policies of any third-party services they choose to use in connection with the Interface.

9. Data Retention

Because blockchain information is permanently recorded on public blockchain networks, blockchain data generally cannot be modified or deleted.

Information processed through the Interface is retained only for as long as reasonably necessary to:

• operate the Interface;
• maintain security;
• detect or investigate abuse;
• diagnose technical issues;
• improve the functionality and reliability of the Interface;
• comply with applicable legal obligations;
• resolve disputes where applicable.

Retention periods may differ depending upon:

• the nature of the information;
• operational requirements;
• technical requirements;
• legal obligations;
• security considerations.

Certain records created for sanctions and compliance-screening purposes — including wallet addresses, IP address, and the derived country or region associated with a screened transaction — are retained for a longer period as required by applicable law (which may be several years) in order to meet applicable legal and regulatory obligations.

Wallet-authentication challenges and operational session records expire or are revoked under their stated security deadlines and are removed through routine retention processes. The server stores a one-way digest of the session token, not the token itself.

In-progress transaction recovery state in browser session storage is removed when the operation is cleared or completed and, in all cases, when the browser tab’s session ends.

Pending referral attribution in browser local storage is removed when its claim settles or the Interface establishes that the referral no longer applies. It also disappears if you clear browser storage. Unseen-completion markers in browser session storage are removed when the related action clears them and, in all cases, when the browser tab’s session ends.

The current-tab copy of a push subscription binding is removed when the browser tab’s session ends. The server removes a subscription when you disable it, when the push provider reports that it is no longer valid, or after the subscription has not been refreshed for the stated inactivity period.

Wallet-bound Terms of Use acceptance evidence is retained as permanent evidence of the exact document accepted and the cryptographic proof of acceptance. This evidence includes the public wallet address, challenge context, document descriptor and hash, exact signed message and signature, verification method, and acceptance time. It is not deleted by routine wallet-session cleanup.

Where information is no longer reasonably required, it may be deleted, anonymized, or aggregated where technically feasible and consistent with applicable law.

10. Data Security

Reasonable technical and organizational measures are implemented to help protect information processed through the Interface against unauthorized access, alteration, disclosure, destruction, or misuse.

Such measures may include:

• encrypted communications;
• access controls;
• infrastructure monitoring;
• security logging;
• software updates;
• vulnerability management;
• incident response procedures.

However, no website, software application, blockchain network, internet transmission, or electronic storage system can be guaranteed to be completely secure.

Accordingly, no representation or warranty is made regarding the absolute security of information processed through the Interface.

Users remain solely responsible for protecting:

• private keys;
• recovery phrases;
• wallet credentials;
• wallet-provider authentication credentials;
• connected devices.

Loss or compromise of any of the foregoing may result in permanent loss of access to digital assets.

The Interface cannot recover lost wallets, restore access credentials, retrieve private keys, or reverse blockchain transactions.

11. International Data Transfers

The Interface and its supporting infrastructure may utilize independent service providers located in multiple jurisdictions.

Accordingly, information processed through the Interface may be transferred to, stored in, or processed in countries other than the country from which you access the Interface.

Where applicable, reasonable efforts are made to use infrastructure providers that implement appropriate safeguards for international data transfers in accordance with applicable privacy laws.

Because the Protocol operates on decentralized public blockchain networks, blockchain data may be replicated and processed globally by independent blockchain network participants.

Such decentralized processing is an inherent characteristic of public blockchain technology and cannot be limited or controlled through the Interface.

12. Privacy Rights

Depending on your jurisdiction and applicable law, you may have certain privacy rights regarding information processed through the Interface.

Such rights may include, where applicable:

• the right to request access to information relating to you;
• the right to request correction of inaccurate information;
• the right to request deletion of information where legally and technically feasible;
• the right to request restriction of processing;
• the right to object to certain categories of processing;
• the right to data portability where applicable;
• the right to withdraw consent where processing is based upon consent;
• the right to lodge a complaint with an applicable supervisory authority.

Some of these rights may not apply in every jurisdiction or under every circumstance.

Because the Protocol operates on public blockchain networks, certain requests may not be technically possible to fulfill.

In particular, information permanently recorded on public blockchain networks generally cannot be:

• modified;
• deleted;
• erased;
• restricted from public access.

Nothing in this Privacy Policy should be interpreted as guaranteeing the modification or removal of immutable blockchain records.

13. Legal Bases for Processing

Where applicable privacy laws require identification of a legal basis for processing, information relating to the use of the Interface may be processed on one or more of the following grounds:

• providing and operating the Interface requested by users;
• legitimate interests in maintaining the security, integrity, reliability, functionality, and continuous improvement of the Interface;
• compliance with applicable legal obligations;
• protecting the Interface against fraud, abuse, malicious activity, or security incidents;
• the legitimate interests in, and where applicable the compliance with, sanctions and regulatory requirements — including screening wallet addresses and access location against applicable sanctions programs and restricted jurisdictions;
• user consent, where consent is required under applicable law, including for certain analytics or diagnostic technologies.

Where processing is based upon consent, such consent may be withdrawn at any time in accordance with applicable law.

Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal and may affect the availability of certain optional Interface functionality.

14. Compliance and Restricted Jurisdictions

The Interface currently does not require Know Your Customer (KYC), Anti-Money Laundering (AML), or identity verification procedures in order to interact with the Protocol.

The Interface does not intentionally collect:

• government-issued identification documents;
• biometric information;
• proof of address;
• tax identification numbers;
• similar identity credentials.

The Interface does, however, apply automated compliance controls to transactions submitted through it: access to certain features is restricted based on the approximate country or region derived from a user’s IP address, and wallet addresses involved in a transaction are screened against applicable sanctions lists (such as the OFAC SDN list). Operations that originate from a restricted jurisdiction, or that involve a listed wallet address, are declined. These controls do not involve identity verification or the collection of identity documents.

Users remain solely responsible for complying with all laws applicable to their use of the Protocol and the Interface, including without limitation:

• sanctions laws;
• tax obligations;
• reporting requirements;
• financial regulations;
• digital asset regulations;
• other applicable legal requirements.

Future versions of the Interface may introduce additional compliance measures where required by:

• applicable law;
• security considerations;
• supporting infrastructure providers;
• future Protocol functionality.

15. Children’s Privacy

The Interface is intended solely for individuals who have reached the age of legal majority in their jurisdiction.

The Interface is not directed toward children.

Information is not knowingly collected from individuals who are not legally permitted to use the Interface.

If it becomes known that information has been voluntarily submitted by an individual who is not legally eligible to use the Interface, reasonable efforts may be made to delete such information where technically feasible and where doing so does not conflict with applicable law or the immutable nature of public blockchain records.

16. Changes to this Privacy Policy

This Privacy Policy may be updated periodically to reflect changes relating to:

• the Interface;
• applicable law;
• security practices;
• technical infrastructure;
• supporting service providers;
• Protocol development.

Updated versions become effective upon publication through the Interface unless otherwise specified.

The “Effective Date” appearing at the beginning of this Privacy Policy indicates the version currently in effect.

Continued use of the Interface following publication of an updated Privacy Policy constitutes acknowledgment of the revised Privacy Policy.

17. Contact

Questions relating to this Privacy Policy or information processed through the Interface may be submitted through the publicly available community channels.

The following communication channels are currently available:

• Email — [email protected]
• Discord — discord.com/invite/JRqw7nS7B8
• Telegram — t.me/reinforce_fi

As the Protocol is decentralized software and is not operated by a legal entity, communications submitted through these channels may be responded to by individuals maintaining or supporting the Interface.

No specific response time is guaranteed.

18. Acknowledgement

By accessing or using the Interface, you acknowledge that you have read and understood this Privacy Policy.

Where required by applicable law, your consent will be requested separately before optional categories of information — such as analytics or diagnostic technologies — are processed.

Your continued use of the Interface constitutes acknowledgment of this Privacy Policy as it may be updated from time to time.