PRIVACY & COOKIE POLICY
Last updated: 2 October 2026
This policy explains how personal data is processed when you use cybersea.art, in line with the EU General Data Protection Regulation (GDPR / RODO) and the ePrivacy rules on cookies.
1. Data controller
The controller of your personal data is CyberSea – Michał Szafarski. For any privacy matter contact us at cyberseanft@gmail.com.
2. What we process, why and on what legal basis
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Bitcoin wallet address(es) and a one-time signed message | Signing in, showing your portfolio and points, linking several wallets to one account | Art. 6(1)(b) GDPR — providing the service you request | Session: 7 days. Account (linked wallets): until you remove them or ask us to delete the account |
| Discord user ID and display name (only if you connect Discord) | Granting holder roles on our Discord server, /refresh command | Art. 6(1)(b) GDPR | Until you disconnect Discord in Settings or ask us to delete it |
| Public blockchain data (which wallet holds which piece) | Leaderboard, points, holder verification | Art. 6(1)(f) GDPR — legitimate interest in running the collector programme | Recomputed daily from public on-chain data |
| Aggregated, anonymous page-view statistics | Understanding which pages are used, improving the site | Art. 6(1)(a) GDPR — your consent (analytics category) | Aggregated statistics only, no personal profile |
| IP address and technical request data in server logs | Security, preventing abuse, troubleshooting | Art. 6(1)(f) GDPR — legitimate interest in a secure service | Short-term logs kept by our hosting provider |
Providing data is voluntary. Without signing in with a wallet you can still browse the site, but you cannot use the portfolio, leaderboard account or Discord roles.
Please note that blockchain data is public and permanent by design — we cannot change or delete information recorded on the Bitcoin blockchain.
3. Cookies and similar technologies
We store small pieces of information in your browser. Essential ones are required for the site to work and do not need consent. Anything else is used only after you agree, and you can change your decision at any time.
| Name | Type | Category | Purpose | Duration |
|---|---|---|---|---|
cs_session | Cookie (HttpOnly, first-party) | Essential | Keeps you signed in after verifying your wallet signature | 7 days |
xverse_account | Local storage | Essential | Remembers the connected wallet in this browser | 7 days |
cs_cookie_consent | Local storage | Essential | Remembers your cookie choices | 12 months |
| Vercel Web Analytics | Script (no cookies) | Analytics — consent required | Anonymous, aggregated page-view statistics; does not track you across websites | Not stored in your browser |
You can also delete stored data at any time in your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
4. Recipients and third-party services
- Vercel Inc. — website hosting, serverless functions and analytics.
- Upstash — database storing accounts, linked wallets and Discord links.
- Discord — only if you choose to connect your Discord account.
- Your wallet provider (e.g. Xverse) — the wallet extension you use to sign in operates under its own privacy policy.
- Ordinals content and image services (e.g. ordinals.com, render.ord.net) — artworks are loaded directly from these services, so they receive your IP address when your browser requests the content.
- Marketplaces (e.g. Satflow, Osura, ord.net) — only when you follow a link to them; from then on their own policies apply.
Some of these providers are based outside the European Economic Area (mainly in the USA). Such transfers are based on the EU-U.S. Data Privacy Framework or on Standard Contractual Clauses approved by the European Commission.
We do not sell your data and do not use it for advertising or profiling.
5. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy of it,
- rectify inaccurate data,
- have your data erased (“right to be forgotten”),
- restrict processing,
- data portability,
- object to processing based on our legitimate interest,
- withdraw consent at any time (via Cookie settings in the footer),
- lodge a complaint with a supervisory authority — in Poland the President of the Personal Data Protection Office (UODO), or the authority in your EU country of residence.
To exercise your rights, write to cyberseanft@gmail.com. You can also unlink wallets and disconnect Discord yourself in Settings.
6. Automated decisions
Discord holder roles and leaderboard points are assigned automatically based on public blockchain holdings. This does not produce legal effects or similarly significant effects on you within the meaning of Art. 22 GDPR.
7. Changes to this policy
We may update this policy when the site or the law changes. The date of the latest version is shown at the top. If we start using new non-essential technologies, we will ask for your consent again.