Privacy Policy.

1. Who we are

Seedcase is operated as an independent software project (hereinafter “we”, “us”, or “Seedcase”). It is currently a free, private beta run by individuals, with no company incorporated yet. The website is published on a non-professional basis under Article 1-1, II of the French Act of 21 June 2004 on confidence in the digital economy (LCEN): the publisher's identity has been lodged with the hosting provider below and is not published on this site. It can be disclosed to judicial authorities on request.

• Hosting provider . Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States. Phone: +1 650 319 8930. The site is deployed on Cloudflare Pages.
• Contact . For any privacy-related inquiry, you can reach us at [email protected] . We have not appointed a data protection officer, which is not required under Article 37 GDPR. We answer within one month of receiving your request.

2. What data we collect

This website has no user accounts, no customer area and no online payment. When you submit a beta access request, we collect:

• Email address (required). Used to answer your request and tell you when access opens.
• Motivations (required). The free-text description of your use case. Never include a seed phrase, a password or any sensitive data in it.
• Crypto experience level (required). One choice among several levels.
• Interests (required). The features you care about, such as seed phrase backup or inheritance.
• Operating system (required). Helps us distribute test builds.
• X, Discord or Telegram handles (optional). Let us reach you on the beta community channels if you wish.
• Request date . Recorded automatically when the form is sent.

Required fields are necessary to review your request; the form cannot be sent without them. Optional fields are up to you and leaving them empty has no effect on the review.

The form is protected by Cloudflare Turnstile , an anti-bot check provided by Cloudflare, Inc. When the form is displayed and submitted, Turnstile processes your IP address and technical characteristics of your browser (headers, connection fingerprint, interaction signals) to tell a human visitor from an automated program. Seedcase only receives a validation token and stores none of this data. Cloudflare also processes these signals for its own account to improve its detection service and is the controller for that purpose; see cloudflare.com/turnstile-privacy-policy .

Like any hosting provider, Cloudflare keeps technical logs (IP address, requested page, timestamp, browser type) to serve the site, secure it and detect attacks. These logs are handled by Cloudflare under its own retention rules and are not used by Seedcase for audience measurement. We use no analytics tool, tracking pixel or advertising technology of any kind.

3. Why we collect it

Form data is used solely to review your request and select testers, to answer you and tell you when access opens, and, if you are accepted, to run the beta program (sending test builds, collecting your feedback). Each request also triggers a summary email to our internal mailbox [email protected]. The legal basis is your consent, given when you submit the form after reading this policy (Article 6(1)(a) GDPR). You may withdraw it at any time.

Turnstile and hosting logs rely on our legitimate interest in keeping the site and the form secure and free of spam (Article 6(1)(f) GDPR).

We will not use your email address for marketing unrelated to the Seedcase beta program, and we will not pass it on to anyone for that purpose.

4. How we store it

Your data is accessible only to the people running the beta program. We rely on two processors within the meaning of Article 28 GDPR:

• Brevo (Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France): contact storage and email delivery. Data is hosted in the European Union.
• Cloudflare, Inc. (identified in section 1): website hosting and the anti-bot check on the form.

Both are bound by a data processing agreement and act only on our instructions. We do not sell, rent or transfer your personal data to anyone. It may only be disclosed to third parties when a legally empowered authority requires it.

Cloudflare is a US company, so data processed for hosting and the anti-bot check may be processed in the United States. Cloudflare is certified under the EU-US Data Privacy Framework, recognised as adequate by the European Commission decision of 10 July 2023, and its data processing agreement includes the Commission's standard contractual clauses (Article 46(2)(c) GDPR). You can request a copy of these safeguards by writing to us.

5. How long we keep it

Form data and the internal notification emails are retained for the duration of the beta program and deleted within 30 days of the public V1 release of Seedcase, unless you have explicitly opted in to continued communication.

If your request is rejected, your data is deleted within 30 days of that decision. If you withdraw consent or ask for erasure, it is deleted within 30 days of your request, except for technical backups, which are purged on their own cycle. Hosting logs are kept by Cloudflare for a short period it sets, without access on our side. Where a legal obligation or a dispute requires it, only the strictly necessary data may be kept in restricted-access archives for the applicable limitation period.

6. Your rights

Under Articles 15 to 22 GDPR and the French Data Protection Act of 6 January 1978, you have the following rights regarding your personal data:

• Right of access . You may request a copy of the data we hold about you.
• Right to rectification . You may request correction of inaccurate data.
• Right to erasure . You may request deletion of your data at any time.
• Right to restriction . You may ask us to pause processing, for instance while the accuracy of a piece of data you contest is checked.
• Right to object . On grounds relating to your particular situation, you may object to processing based on our legitimate interest.
• Right to data portability . You may receive the data you provided in a structured, commonly used format.
• Right to withdraw consent . You may withdraw your consent at any time without affecting the lawfulness of prior processing.
• Post-mortem directives . Under Article 85 of the French Data Protection Act, you may set directives on what happens to your data after your death.

To exercise any of these rights, contact us at [email protected] , preferably from the email address used in your request. Where we have reasonable doubts about your identity we may ask for proof, which is deleted once checked. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

If, after contacting us, you believe your rights are not respected, you may lodge a complaint with the French supervisory authority, the CNIL (Commission nationale de l'informatique et des libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at cnil.fr , or with the supervisory authority of your own EU member state.

7. Cookies and tracking

This website sets no analytics, advertising or social-media cookies and uses no audience measurement tool. No consent banner is shown because no tracking takes place. If you choose a display language, that single choice is saved in your browser's local storage so the site does not ask again. It stays on your device, is never transmitted to us or to anyone else, contains no identifier, is a strictly necessary storage exempt from consent, and you can clear it at any time from your browser settings. Cloudflare Turnstile, as configured on this site, sets no cookie.

8. The Seedcase applications

The Seedcase desktop application and the Seedcase mobile vault for Android both operate entirely offline. They create no account, call no server and contain no telemetry. Your seed phrase and fragments never leave your devices. Seedcase therefore processes no personal data through its applications.

9. Changes to this policy

We may update this policy as the project evolves, for instance if a new processor or feature is introduced. The date at the top of this page reflects the most recent update. Any substantial change is announced by email to people whose request is pending or accepted. Previous versions are available on request. This policy is governed by the GDPR and the French Data Protection Act; a separate French-language policy describing the same processing is available for French-speaking users.