A privacy notice mapped to the actual product path.

1. Scope and roles

This notice applies to the DeSpell web application and its related account, wallet, intent, portfolio, route, simulation and execution-support features. It does not replace the independent privacy notices of wallet providers, blockchains, protocols or other services you choose to use.

The verified controller/operator appears in the status panel when configured. A launch-blocker panel means that identity and contact information is not yet final.

2. Information processed

DeSpell processes information needed for the feature you request.

• Account and authentication data, such as the WebAuthn credential ID and public key held by the passkey server, the smart-account address derived from that passkey, the login method you chose and the short SIWE wallet-session record.
• Public wallet and blockchain data, such as wallet addresses, chain IDs, token contracts, balances, allowances, transaction targets, recipients, transaction hashes and receipts.
• Requests and plan context, including the message you send, corrections, selected options and the material fields required to reconcile an intent.
• Transaction-preparation data, such as route query, amount, calldata, value, spender, approval scope, simulation result and provider status.
• Technical and security data, such as origin, request timing, rate-limit keys, error category and information normally processed by hosting and network infrastructure.
• Browser state, including the versioned onboarding/Terms record in localStorage, short external-wallet session state in sessionStorage, and a display-only record in sessionStorage under despell:unverified-ack:v1 listing chain ID and token contract address pairs whose unverified-token warning you explicitly reviewed, so the same informational banner is not repeated in that browser session. This record ends with the session, is never sent to DeSpell servers, and never relaxes a signing, execution or API check. Wallet connectors may use their own cookies or browser storage.
• Display-only portfolio entries you add yourself, kept in localStorage under despell:custom-tokens:v1 (chain ID, token contract address, symbol, decimals) and despell:custom-chains:v1 (chain ID, chain name, https RPC URL, native symbol, optional explorer URL). These stay in your browser, are never sent to DeSpell servers, and are never used for execution. Balances on a custom chain are read by your browser directly from the RPC endpoint you entered, so that provider sees your wallet addresses under its own privacy terms.
• Saved conversations: an account record linked to your verified wallet address (language and last-seen time), conversation titles, the messages you send, DeSpell's answers and their status, and the display contents of the cards shown in a conversation (amounts, balances and gas fees, tokens, chains, route providers, shortened addresses, transaction hashes, simulation results, question and choice wording, and results such as executed, cancelled or arrived with their times), so a reopened conversation shows them again as past cards that cannot be used. Wallet addresses inside a saved answer or card are shortened to the form 0x1234…abcd, and raw tool results and signed transaction data are not saved. A separate model usage ledger records the purpose, provider, model, token counts, cost, latency and status of each model call, without the message text.
• Security event records: the type, reason, scope and time of a rate-limit hit, a budget refusal, a wallet-session issuance or a bot detection, with keyed one-way hashes (HMAC) of the IP address and wallet. These records do not contain the raw IP address or wallet address.
• Rewards and invite records, created only when you make a fee-bearing trade or use an invite code: for each fee-bearing swap or bridge that DeSpell has verified, the account address, chain ID, transaction hash, trade kind and USD value at that time, and the daily points and fee level derived from them; your personal invite code; the time DeSpell first saw the account, used to tell whether it is new; and, when one account starts through another account's invite, the link between the two account addresses with the code used and the times of the link, of the invited account's first fee-bearing trade and of the invite qualifying. Invite links are never written onchain.
• Optional analytics data after separate opt-in, sent to Google Analytics and PostHog: a random pseudonymous browser identifier (the _ga cookie for Google Analytics, a localStorage entry for PostHog), a fixed allowlisted page path or page section, the broad browser, operating-system and device type, and bounded product-stage event names and properties such as workflow kind, chain ID and status. DeSpell does not send wallet addresses, chat text, token amounts, recipients, transaction hashes, calldata, exact gas used, full page addresses, referrers or free-form errors to either service, and never links the identifier to a wallet.

3. Why information is used

Information is used to authenticate a session, verify wallet control, interpret and reconcile a request, resolve chains and tokens, read a portfolio, compare routes, inspect recipients and approvals, simulate a transaction, present a wallet request, observe a submitted transaction, prevent abuse and maintain the service.

Saved conversations let you reopen and continue earlier conversations after signing in with the same wallet, so this processing is needed to provide that feature. They are not used for model training, evaluation, analytics or marketing; any such use would first ask for a separate, specific consent. Security event records are used only to detect and respond to abuse.

Rewards and invite records are used to calculate points and fee levels, to count invites so they can later be turned into rewards, and to prevent abuse such as inviting yourself or splitting activity across wallets. You see only your own points and invite counts. You never see the address, trades or amounts of an account you invited, and it never sees yours. The operator reviews these records only to turn them into rewards, handle abuse and process deletion requests.

Depending on applicable law and the specific processing, the legal basis may be performing the service you requested, steps taken at your request, legitimate interests in security and reliability, compliance with law, or consent where DeSpell asks for a separate and specific consent. Merely displaying this notice is not recorded as blanket consent.

4. Infrastructure and service providers

Only the information needed for a particular step should be sent. Providers may act under their own terms and privacy notices.

• ZeroDev: a passkey server that stores only the WebAuthn public key and credential ID so a passkey account can be registered and restored, and a bundler that relays your signed UserOperations to the network. Neither receives a private key.
• Reown / WalletConnect, Coinbase Wallet SDK and external wallet providers: external wallet connection transport and the messages or transaction requests you approve in that wallet.
• Vercel and network infrastructure: application hosting, delivery and operational logs.
• Upstash Redis: short-lived atomic replay, rate-limit and SIWE-challenge state, plus the invite code, invite link, account first-seen time and fee level described in section 2; write credentials remain server-only.
• Neon Postgres: the server database for saved conversations, the model usage ledger, security event records and the ledger of verified fee-bearing trades, daily points, fee levels and invite links described in section 2.
• Google Cloud Vertex AI: bounded interpretation of the request and plan context; model output is not a security or signing authority.
• Google Analytics: optional, consent-gated measurement of the safe app page path and bounded product-stage events. The Google tag is not requested before opt-in, advertising storage and personalization remain denied, and DeSpell does not set a Google User-ID.
• PostHog: optional, consent-gated product analytics of the same bounded events, used to see where people stop between a quote, a signature and a confirmation and whether they come back. Events reach PostHog only through DeSpell's own server address, so PostHog does not receive your IP address, cookies or full page address. Session recording, click capture, heatmaps, surveys and error capture are off, and no person profile is created.
• Tenderly: transaction simulation using chain, signer address, target, calldata and value.
• GoPlus, Blockscout, Alchemy and RPC providers: address, contract, history, balance and chain checks.
• LI.FI, deBridge, Across and GIWA infrastructure: route queries and transaction preparation using the relevant chains, token contracts, amount and recipient.
• DefiLlama, Merkl, GeckoTerminal, xStocks and optional Ondo sources: market or product evidence for supported read and conditional execution features.
• On-chain reads through our RPC providers: vault contract state, share price history and deposit simulation that DeSpell measures itself before a deposit is offered.

5. Public blockchains

Wallet addresses, transactions, token transfers, approvals and contract interactions submitted to a public blockchain can be visible permanently and copied by anyone. DeSpell cannot erase, correct or make private data that has been finalized on a public network. Avoid placing personal information in transaction data or public memo fields.

6. Local storage, sessions and cookies

The first-run record stores document IDs, versions, language and timestamps in your browser. It is not a wallet signature, identity-bound legal record or security credential. Clearing site data removes it and causes the current version to be shown again.

External-wallet and passkey-account SIWE sessions use short browser-session state. WalletConnect, Coinbase Wallet SDK and wallet providers may separately use cookies, local storage or secure frames required for their services. Review their notices and browser controls for those technologies.

Google Analytics and PostHog remain off until you make a separate analytics choice. If allowed, Google may set the _ga measurement cookies and PostHog keeps a random identifier in localStorage without a cookie. You can change that choice from Analytics choices in the app footer; disabling analytics sends a denied consent update, removes the known first-party GA cookies and the PostHog identifier, and stops DeSpell from forwarding later events.

7. Retention

Current security artifacts are short-lived: route and transaction commitments are generally 90 seconds, SIWE challenges about five minutes, and external-wallet and passkey-account sessions about 30 minutes. Production nonce, rate-limit and SIWE state uses shared Redis TTLs and is unavailable after expiry; hashed identifiers are used in keys instead of raw user, session or signer text.

The onboarding record stays in your browser until cleared or replaced by a new policy version. The separate analytics choice expires after 180 days and is then requested again. Public blockchain records may be permanent. If you opt in, Google Analytics retains limited pseudonymous measurement under the property settings and Google’s terms, and PostHog retains the same limited pseudonymous events under the project settings and PostHog’s terms; DeSpell’s dashboard retention must be kept at the shortest practical setting. The PostHog identifier in your browser is removed when you disable analytics or when the 180-day analytics choice expires. Hosting, authentication, model, routing, simulation and security providers may retain their own service and security logs under their settings and notices. Any later operator-owned durable telemetry requires an updated retention schedule and notice before collection.

Saved conversations are kept until you delete them and are not deleted automatically after a fixed period. A deleted conversation leaves your list immediately and is permanently removed about 30 days later. The model usage ledger is deleted after 180 days and security event records after 30 days.

To improve service quality, DeSpell keeps route quote, bridge, vault and gas measurements and their anonymous aggregates for up to 90 days. These records contain no wallet address, transaction hash or raw amount. Raw route comparison records are kept for up to 14 days.

Rewards and invite records are kept while you use the service and for up to three years after your last activity, then deleted. The copies in Upstash Redis expire about 400 days after they were last updated. When you ask for deletion, DeSpell deletes your points, fee-level and invite records, including invite links where you are either side, and keeps only a one-way hash of the address so that it does not accrue points again. Deleted points cannot be restored.

8. Sharing, sale and advertising

Information is shared with the providers described above only to operate, secure or support the requested feature, or when required by law. The current product does not implement a system for selling personal information or targeted advertising. This does not control a third party’s independent processing under its own notice.

9. International processing

Infrastructure and blockchain participants may operate in multiple countries. Information may therefore be processed outside your location. Saved conversations and the server records in section 2 are stored with Neon, whose servers may be outside your country. The final operator must identify applicable transfer mechanisms and regional disclosures before launching in jurisdictions that require them.

10. Security

DeSpell uses SIWE wallet-session checks, origin restrictions, expiring server-authenticated artifacts, role-aware address checks and point-in-time simulation. These controls reduce risk but cannot guarantee security. Browser compromise, wallet compromise, provider incidents and public-chain behavior remain separate risks.

Do not send a seed phrase, private key or password through the chat. DeSpell does not need those secrets to interpret a request.

11. Your choices and rights

You may clear browser storage, disable optional analytics from Analytics choices in the app footer, disconnect an external wallet, stop using the service and choose whether to sign a transaction. Depending on applicable law, you may also have rights to access, correct, delete, restrict or object to processing, receive a portable copy, withdraw a specific consent and complain to a regulator.

You can delete one saved conversation, or all of them, from the conversation list at any time.

Blockchain records and data controlled independently by another provider may not be erasable by DeSpell. Rights requests, including a request to delete your account record or your rewards and invite records, should use the verified privacy contact shown above once configured.

12. Children

DeSpell is not designed for children or for anyone who cannot legally authorize the relevant wallet and financial activity. Do not use the service if you are below the minimum age required where you live.

13. Changes to this notice

Material changes receive a new document version and publication date. The first-run flow presents the current Terms acceptance and privacy notice separately; it does not convert an old browser record into acceptance or consent for a new purpose.

14. Contact and complaints

The verified controller and privacy contact appear in the status panel. Governing law and dispute venue appear when configured. During an explicitly configured free MVP beta, the panel may instead mark the postal address as temporarily deferred. That deferral ends before DeSpell charges any fee, starts a paid plan or removes the beta label, and may end earlier when applicable law or legal review requires it.