Privacy
Effective .
This policy says what personal data Fairburn collects, why, what is public, who else sees it, how long it is kept and what you can ask of us. It covers fairburn.family and its API, and sits beside the Terms. Much of Fairburn is public by design: read section 4 before you trade or publish.
1. Who we are
Fairburn, at fairburn.family, is run by its operator, who decides what personal data the site uses and why. Under the GDPR and the UK GDPR that makes the operator the controller of your data, called "we" here. Write to [email protected] about anything in this policy, including every request in section 9.
2. The short version
We keep what an account needs: a sign-in id, one email address, your wallet addresses and the profile you choose. Your trades, and everything else on Robinhood Chain, are public and permanent, and so is a token image once you upload it. We show no ads, run no analytics of our own and sell no data. Fairburn sends no newsletters or notification emails, only answers to what you write to us: sign-in codes come from Privy, which runs sign-in, loads on every page and collects its own usage data (section 6).
3. What we collect and why
What we hold, what it is for, the legal basis for it (section 5) and how long we keep it. Most of it comes from you. Your email and linked wallets come from Privy when you sign in, and trades, balances and holdings from Robinhood Chain's public records. Where the answer is "on chain", nobody can delete it, us included.
| What | Why | Basis | How long |
|---|---|---|---|
| AccountYour Privy account id, how you sign in (X, Google, email or a wallet), one verified email address (your Google one if you sign in with Google) and every Ethereum wallet linked to your Privy account. If you sign in with X: your X account's id and its handle, when it was linked and when a sign-in last confirmed it. We do not keep your name from Google or X: a new account gets a random handle. | Why: To sign you in, to recognise you when you sign in another way with the same email, to hold each X account to one Fairburn account, and to tell whether a coin you launch links to your own X account (section 3, Launch checks). Your email and your linked wallets are shown only to you, and so is your X account unless you choose to show its handle on your profile. | Basis: Contract | How long: While your account exists. |
| ProfileThe handle, name and bio you choose, your earlier handles, when you joined, and the address of your trading wallet. | Why: Your public profile (section 4). Earlier handles keep pointing to you, so old links still work. | Basis: Contract | How long: While your account exists, earlier handles included. |
| Sign-insA signed session cookie, and the ids of your recent sign-ins through Privy. | Why: To keep you signed in, and to make Sign out everywhere end every session. | Basis: Contract; legitimate interest (account security) | How long: The cookie 7 days. Sign-in ids while your account exists, at most the newest 256. |
| What you publishCoins (name, ticker, image, description, and any X, Telegram, Discord, Farcaster or website link you add), comments, likes on comments, and follows. | Why: To publish them. Comments show your handle; a coin does not show who launched it. Likes and follows are public only as counts; follows also decide whose activity appears in your notifications. | Basis: Contract | How long: Coins and comments are hidden, never deleted. A coin never launched, 30 days. Follows and likes until you undo them. What a launch writes on chain (name, ticker, image, description, links) stays for good. |
| Launch checksFor each coin: its ticker and name in a folded form and the X profile and website it links to, each held as a claim for a day so no other new coin takes it; a fingerprint of its image; whether you had signed in with X when you launched it, and whether its X link is that X account. A refused launch is logged for our team: your account, the ticker and name you typed, the check that refused it and what it met, which can be an X profile or a website. | Why: To refuse copies of other coins, to hold each ticker, name, X profile and website to one new coin a day, and to keep your own X profile yours: nobody who types it can keep it off a coin you launch signed in with that X account. A website cannot be proven to be yours: a coin launched signed in with X holds its website for its day against every launch, one launched without an X sign-in only against other launches without one. A website that is an X profile link counts as that X profile. An X post or community link in a coin's X field is held for its day as a website is. The links are the coin's own, public on its page; the claims and the log are never shown. | Basis: Contract; legitimate interest (refusing copies) | How long: Each claim until 24 hours after the launch, counted again from when the coin is listed; deleted within minutes after. A coin still waiting in the launch queue keeps its claims until it is listed; a launch that fails frees them at once. The fingerprint and the links while the coin exists. Refused launches: no set limit yet, like the admin log. |
| Trades and paymentsYour trades, orders refused because the price moved, and the cash you send to other people with any note you add. Balances are read from the chain. | Why: To carry out trades and payments, show your portfolio, and tune our price checks. A note is shown only to the person who receives it. | Basis: Contract; legitimate interest (refused orders) | How long: On chain for good. Our copies while your account exists; refused orders, the newest 1,000 across everyone. |
| ReferralsFrom the referral program (Terms, section 5): who referred you and when, the commissions your trades here paid them, your referral link and code (your handle), and visits through referral links: a random visitor id, the link, the coin and the time, with no IP address. | Why: To credit and pay referrers and show them their numbers. A referrer sees the handle and name of each person they referred, how much each traded here since, and the side, amount and fee behind each commission. | Basis: Contract (the referral terms); legitimate interest (counting visits) | How long: Who referred you is on chain for good. Visits 90 days, then only a count per link. |
| Deposits and withdrawalsYour wallet address, destination addresses, amounts, networks, transaction hashes, Relay's ids, your deposit addresses (with the Solana refund address you gave for one from Solana), and withdrawal quotes. | Why: To carry and follow transfers through Relay and answer questions about them. | Basis: Contract | How long: Transfers and deposit addresses while your account exists. Quotes a week, unless a withdrawal was made from one. |
| Token imagesAn image you upload, which we re-encode as a 512-pixel PNG or GIF; that drops location and camera data. We record your account, the file's name and size, and its IPFS address. | Why: The token's logo. | Basis: Contract | How long: Public on IPFS from the moment you upload it, even if the coin never launches, and in practice permanent. Our record while your account exists. |
| ReportsReports you file: what you report, the reason you pick, the time, any note you add, that you confirmed a report of illegal content is made in good faith, and, only if you are signed out, an email address if you leave one. A report from a signed-in person is kept with their account; a signed-out one with a code made from the IP address and the day, which cannot be turned back into the address. A second report on the same thing from the same account, or from the same address on the same day, replaces the first. How much a report weighs can depend on whether you are signed in, how old your account is and whether you hold the coin. | Why: To moderate and stop abuse, and to answer you if you left an email. Reports are never public, and no notice says who reported. Our admins see who filed a report, or "anonymous" for a signed-out one, and the email you left, only to answer you. | Basis: Legitimate interest; legal obligation for valid legal requests | How long: No set limit yet; evidence of illegal content is kept as the law requires. |
| Moderation decisionsEach action taken on something published or on an account: what was done and to what, which admin decided and when, the rule it falls under, the facts given, the reports it answered, a reference that starts with M-, and the statement of reasons sent to the person affected; and any later action that reversed it. The original of anything removed (text, links, a profile's name, bio or handle, an image with its fingerprint), kept privately as evidence. Flags and suspensions on accounts, and the images and X accounts blocked from being used again. | Why: To moderate, to tell you what was restricted, why and how to appeal, to handle appeals, and to answer valid legal requests. Every flag, suspension and removal is decided by a person, not automatically. You see the notices about your own things in the app; the admin's private note is never shown. | Basis: Legitimate interest; legal obligation where the law requires a statement of reasons, and for valid legal requests | How long: The record and the removed originals have no set limit yet; evidence of illegal content is kept as the law requires. Notices show in the app for 180 days. A flag or suspension until an admin lifts it or it ends. |
| Admin log and alertsA log of what our admins do in our admin tools and to whom (a handle or a coin), when, and from where: a code made from the admin's IP address, never the address, and their country. It also records actions taken by our own operations tools, and any signed-in account that tries to use our admin tools without being an admin. Alerts for our team are kept for the admins and can name a handle. | Why: To keep our admin tools secure and every admin action accountable, and to look into misuse. | Basis: Legitimate interest (security) | How long: The log has no set limit yet. An alert that was dealt with goes 90 days after it last fired. |
| Messages to usWhat you write to [email protected], your email address and our answers. | Why: To answer you and act on what you ask, including requests under section 9. | Basis: Contract; legitimate interest; legal obligation for requests under section 9 | How long: Until the matter is settled, and longer only where we need a record of how we answered. |
| IP address and browserYour IP address and browser type, as each request arrives. | Why: To limit how fast one address can call us, to count a referral visit once per address and day, and to keep bots out of the counts. The browser type is checked for bots and not kept in our database. | Basis: Legitimate interest (security) | How long: Never stored in our database: held in memory only to apply the limit, and dropped some time after it resets (limits run from a minute to a day). Request logs: next row. |
| CountryThe country Cloudflare works out from your IP address, and in a few countries the region, read with your requests. If you are signed in, your account keeps each country it was used from and when it was last used from there, at most 12 countries; never the IP address, and never the region. A visitor who is not signed in is judged by the request alone, and nothing is kept. | Why: To apply rules that differ by country: Fairburn is not offered in some countries and regions (Terms, section 1), and from there only the terms, this policy and, where a country's own rules are the reason, the way to take money out answer. Referral rewards are not offered in the United Kingdom (Terms, section 5). An account used from there in the last 30 days cannot use or give a referral code or link, and no new referral is recorded for it; from there, a referral link sets no referral cookie and counts no visit. | Basis: Legitimate interest (applying each country's rules) | How long: Each country 30 days from the last request from it; older ones are dropped every day. |
| Server logsEach request (IP address, page address, time, browser type, referring page), and our own log lines, which can include your handle, your account id or a wallet address. They are written without your email, though in rare cases a fault can copy a record, email included, into a log. | Why: To keep Fairburn secure and fix faults. | Basis: Legitimate interest | How long: 30 days. |
| Error reportsWhen error reporting is on: the error, where in our code it happened and on which page (a page address can include a handle), with addresses, emails, Privy ids and tokens removed. A report sent from your browser also shows our error-reporting service your IP address and browser type, and your browser's own security reports carry the full page address. | Why: To find and fix faults. | Basis: Legitimate interest | How long: As long as our error-reporting service keeps them. |
Notifications are worked out from the above each time you look; nothing more is stored for them, and Fairburn sends no email or push notifications.
4. What is public
Fairburn is a public venue. Anyone, signed in or not, can see:
- your handle, name, bio, when you joined and your trading wallet's address, which links your handle to everything that address does on Robinhood Chain;
- your positions, trades, profit and loss, volume and ranks, your comments, how many people follow you and how many you follow, and your referral earnings;
- payments you received, with the sender's handle and the amount, so a payment you send shows your handle on the other person's profile (a note is shown only to the person who receives it);
- share cards: anyone can make a picture of anyone's portfolio or trade from this same public data, with dollar amounts unless the link turns them off.
On Robinhood Chain every trade, transfer, balance, burn and referral binding, and the launch details of every token, are public and permanent. Fairburn cannot hide or erase them.
5. Legal bases
Under the GDPR and the UK GDPR we rely on three bases. Contract: to run your account and what you ask Fairburn to do, from sign-in and your profile to coins, comments, trades and transfers. Legitimate interests: to keep Fairburn secure, stop fraud and abuse, refuse copied coins, moderate, fix faults, tune our price checks, count referral visits and apply the rules that differ by country (section 3). Our interest is a venue that works and is safe; we keep the data involved small and use it for nothing else, and you can object (section 9). Legal obligation: to answer valid requests from authorities and your requests under section 9.
We do not use your data for advertising and we do not sell it.
No law requires you to give us anything, and you can read Fairburn without an account. To have one, you sign in with X, Google, an email address or a wallet, and we receive your X account, email or wallet address from Privy; without them we cannot open an account for you, and you cannot trade or publish here. Launching a coin needs an account, however you sign in; an X account is never required. For a launch, signing in with one does three things: it proves that a coin's X link is yours, it makes your coin's website hold against every launch for its day, not only against launches without an X sign-in (a website that is an X profile link counts as that X profile instead), and it can let your launch go on when many coins launch in one hour and launches without one are asked to wait.
We make no decision about you by automated means alone that has legal or similarly significant effects on you. The checks that refuse a launch run by themselves, by the rules published in the Terms (section 2): a ticker or a name, or one too close to it, that is on a coin listed here in the last 24 hours or still waiting to launch, a reserved word or a Robinhood Chain token people trade; an X profile or a website on such a coin, unless your X sign-in lets it through as the Terms say; and an image that copies the image of such a coin. They look at the coin, not at you, apart from whether you signed in with X and whether its X link is that X account; and when many coins launch in one hour, a launch from an account without an X sign-in can be asked to wait a few minutes. Burns are run by a program from public chain data. None of this singles out a person, and the one step that does, a flag, is taken by a person. If you think a launch was refused wrongly, write to [email protected] and a person will check it.
6. Who else sees it
Most of these providers work for us, and each gets only what its part needs. Relay, the wallet you connect, the public nodes and Robinhood Chain do not work for us: Relay gets what it needs to carry a transfer you ask for, and the others see what any user of those networks shows them. We also disclose data when the law requires it, in answer to a valid legal request.
| Who | What they get | Where |
|---|---|---|
| Our cloud hosting provider | What they get: Our servers, database, backups, file storage and logs: everything in section 3. | Where: Servers, database and files in Germany; backups in the EU. Logs can be stored outside the EU, including in the United States. |
| Cloudflare | What they get: Every request on its way to us: IP address, headers, cookies and the page. It tells us which country your IP address is in (section 3), and it may set cookies to tell people from bots. | Where: The United States, and the country of the data centre that serves you. |
| X | What they get: If you sign in with X: X's own sign-in screen, through Privy. X tells Privy your account's id, handle and name, and sees that you signed in to Fairburn. | Where: United States. |
| Privy | What they get: Sign-in and the wallets it creates for you: your X account if you sign in with it, your email, your Google profile, your wallet addresses, the sign-in codes it emails you, device and IP data, and usage events from its code, which runs on every page for every visitor. It may use Cloudflare Turnstile to check a sign-in is human. Wallets it creates are secured by Privy; we never see their keys. | Where: United States. |
| Our IPFS storage provider and IPFS gateways | What they get: Token images, public from upload. Your browser loads them straight from an IPFS gateway, so the gateway sees the IP address and browser type of everyone who views one. | Where: United States; IPFS copies anywhere. |
| Relay | What they get: For a transfer to or from another network, from our server: your wallet address, the destination address (or, for a deposit from Solana, the Solana refund address you gave), the amount and the networks. Never your email, IP address or handle. | Where: United States (not confirmed with Relay). |
| The wallet you connect | What they get: If you sign in with a wallet, for example through WalletConnect (Reown) or Coinbase Wallet: the connection, your address and your IP address. | Where: Depends on the wallet; not confirmed. |
| Our blockchain node provider | What they get: Our server's connection to Robinhood Chain: the wallet addresses it looks up. No visitor IP addresses. | Where: United States. |
| Robinhood Chain's public node | What they get: Your browser reads the chain directly, so the node sees your IP address and the addresses it reads. Our server can read it too. | Where: United States (Robinhood, a US company); not confirmed. |
| Public nodes of other networks | What they get: Your address, when our server checks your balance on Ethereum, Arbitrum, Base, Optimism, Polygon, BNB Chain or Avalanche. Nothing else about you. | Where: Mostly the United States. |
| Our error-reporting service | What they get: Error reports, when error reporting is on (section 3). | Where: United States or Germany, depending on the region we use. |
| Our email providers | What they get: Messages you send to [email protected] and our answers. | Where: United States. |
| Robinhood Chain | What they get: Everything written on chain (section 4), to everyone, for good. | Where: A public ledger, copied worldwide. |
7. International transfers
Our servers, database and files are in Germany, and their backups in the EU. Several providers in section 6 work in the United States or elsewhere outside Switzerland, the UK and the EEA, and chain data and IPFS copies reach every country. Where a provider that works for us receives your data in a country that Switzerland, the UK or the EU has not recognised as giving adequate protection, the transfer relies on the safeguards in its data processing terms: the European Commission's standard contractual clauses with the UK addendum and the adjustments Switzerland requires, or the EU-US Data Privacy Framework, its UK extension or the Swiss-US Data Privacy Framework where the provider is certified under them. Relay, the wallet you connect, public nodes and Robinhood Chain have no such terms with us; they receive your address or your IP address because you ask for a transfer or use those networks through Fairburn. Write to [email protected] for the details of a particular transfer.
8. How long we keep it
Section 3 gives each period. In short: account data stays while your account exists, since an account cannot yet be closed from the app (section 9). Logs, which include IP addresses, go after 30 days. The IP addresses we use for limits and visit counts stay only in our server's memory and are dropped as section 3 says. The countries an account was used from go 30 days after the last request from each. Referral visits become a bare count after 90 days.
Deleted data can stay in our backups for about 30 days, and deleted files in our storage for 7 days. What is on Robinhood Chain or IPFS stays there for good.
9. Your rights
Under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection you can ask us for access to the data we hold about you, a copy of what you gave us in a machine-readable file, the correction of anything wrong, its deletion, a pause on its use while a question is settled, and you can object to what we do on the basis of legitimate interests. Write to [email protected], from the email on your account if it has one. We may ask you to show the account is yours before we act, and we answer within one month.
Some of this you can do yourself. You can edit your name, bio and handle on your profile, end every session on every device with Sign out everywhere in the account menu, and, if Fairburn created your wallet, export its key from the wallet menu. To change your email, write to us.
There is no button to delete an account yet. To ask for deletion, write to [email protected]. We then delete or anonymise the data we hold about you, apart from what we must keep to settle a dispute over a transfer, stop abuse or meet a legal obligation. We cannot delete anything on Robinhood Chain (trades, transfers, referral bindings, payouts, a token's launch details), nor an image already on IPFS, which other nodes and gateways may keep even after we stop pinning it. Copies in our backups are gone within about 30 days.
You can also complain to a data protection authority: in the EU, the one where you live, work or think the problem happened; in the UK, the Information Commissioner's Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch). We would like the chance to put it right first.
If you live in California or another US state with a consumer privacy law, you have the right to know what personal information we collect, use and disclose, to have it corrected or deleted, and not to be treated differently for asking. We do not sell personal information or share it for cross-context behavioral advertising. Ask the same way, at the same address; someone you authorize can ask for you.
10. Cookies and browser storage
We set no advertising cookies and run no analytics of our own; the two referral cookies at the end of this table are the only cookies we set that the site does not need to work. This is everything Fairburn itself keeps in your browser:
| Name | What it does | How long | Kind |
|---|---|---|---|
| co_sessionCookie | What it does: Keeps you signed in. Signed, and readable only by our server. | How long: 7 days | Kind: Strictly necessary |
| co_signout_pendingLocal storage | What it does: Finishes a sign-out that was interrupted. | How long: Until the sign-out completes | Kind: Strictly necessary |
| co:pending-withdrawal:<wallet>Local storage | What it does: A withdrawal you signed (destination, amount, network, transaction) until our server has recorded it, so it is never sent twice. | How long: Until it is recorded | Kind: Strictly necessary |
| co:pending-payment:<wallet>Local storage | What it does: A payment you signed (recipient, amount, note, transaction) until our server has recorded it. | How long: Until it is recorded | Kind: Strictly necessary |
| co_bell_seen:<id>Local storage | What it does: When you last read your notifications. | How long: Until you clear it | Kind: Preference |
| co_share_offeredSession storage | What it does: The coins where we already offered you sharing. | How long: Until the tab closes | Kind: Preference |
| co_refCookie | What it does: The handle of the person whose referral link first brought you here, so they are credited when you sign in or make your first trade. | How long: 30 days | Kind: Referral; not needed for the site to work |
| co_vidCookie | What it does: A random id, so a referral link counts each visitor once. | How long: 1 year | Kind: Referral; not needed for the site to work |
We also delete an old cookie, co_user, if your browser still has one. Other services keep their own. Privy's code, which loads on every page, can store items such as privy:caid, an id for Privy's own usage analytics, and after you sign in privy:token and similar items that hold your Privy session; it may also use cookies named privy-token, privy-session, privy-id-token and privy-refresh-token. Cloudflare may set __cf_bm or cf_clearance to tell people from bots. WalletConnect (items starting wc@2:) and Coinbase Wallet keep their own when you connect through them.
You can block or clear all of these in your browser. Without co_session you cannot stay signed in. Without the referral cookies a referral link credits nobody, though you can still enter the code of the person who invited you after you sign in.
11. Security
Session cookies are signed, sent only over HTTPS and hidden from page scripts. Our servers accept traffic only through our network provider, and our database cannot be reached from the internet and accepts only encrypted connections. We re-encode every uploaded image, which removes location and camera data. Wallets Fairburn creates for you are secured by Privy: we never see their keys. Alerts and error reports have addresses, emails and Privy ids removed before they are sent, and no page or admin screen shows your account's email to anyone but you; an email you leave with a report is shown to our admins only to answer you. Our admin tools need a second sign-in step as well as an admin's sign-in, and every action taken there is logged. No system is perfectly safe; if a breach puts you at risk, we will tell you and the authorities as the law requires.
12. Children
Fairburn is not for anyone under 18. We do not ask your age, and we do not knowingly hold data about anyone under 18. If you think a child is using Fairburn, write to [email protected] and we will delete what we can (section 9).
13. Changes
When this policy changes, we post the new version here with a new effective date. If a change affects how we use data you have already given us, we will say so on the site before it applies.