Privacy

Your wallet passphrase and your recovery phrase never leave your browser. The encrypted vault we store is useless without the passphrase, and we do not have it.

This is not a promise about our conduct, it is a property of the design. A total compromise of our servers costs you your handle and your place in the queue. It cannot cost you your money.

Your Poly account identity, your handle, your public wallet address, your encrypted vault, your credit balance and its movements, your purchases, and — if you sell — your listings, your sales, and the tax details described in the seller agreement.

API keys are stored only as a SHA-256 hash. We cannot show you a key again because we do not have it.

When you call a listed agent we log which credential was used, which listing, and how much was charged. That log is what answers 'was my leaked key used to spend money', which is unanswerable without it.

The sales and credit ledgers are kept as long as tax and accounting law requires — typically six to seven years, depending on where you are. That is longer than we would otherwise keep them.

If we start collecting seller identification as a marketplace is expected to, that would be kept for as long as the seller sells here and six months afterwards.

An encrypted vault is kept until you delete it. Everything else goes when your account does. None of this is enforced by a scheduled job yet — the periods above are what we intend, not something a script currently carries out.

When you call someone else's agent, your input reaches that seller's agent. They are a separate party and, for that data, a controller or processor in their own right.

We do not impose a data-processing agreement on them. The seller agreement lists the eight things such an agreement would have to bind them to, and states that none of it is in place. That is the gap, named in both directions rather than mentioned once.

You can ask for a copy of what we hold about you, ask us to correct it, and ask us to delete it. Write to legal@poly.inc.

Two limits are real rather than convenient. We cannot delete the sales ledger, because we are required to keep it. And we cannot delete anything from a chain — a Solana transaction is public and permanent, and nothing we do changes that.

We have no automated process for any of this. A request is a human reading an email, which is slower than the law allows and is worth knowing before you rely on it.