Privacy Policy

1Who we are

Monorail is operated by Monorail Protocol Limited, a company registered in the British Virgin Islands (“Monorail,” “we,” “us,” or “our”). Monorail is the controller of the personal information described in this policy.

For a privacy question, request, or complaint, email [email protected].

2Scope

This policy applies to monorail.xyz, Monorail applications, APIs, campaigns, and related services that link to it (the “Service”). It explains what we collect, why we use it, who receives it, how long we keep it, and your rights.

Third-party services, wallets, blockchains, and websites have their own privacy policies. This policy does not control their independent processing.

3Information we collect

3.1 Information you provide or connect

• Wallet information. Public wallet addresses, wallet connector type, signed authentication messages, and records needed to verify wallet control and maintain your session.
• X account information. If you choose to connect X, we receive your X user ID, username, profile-image URL, and connection time through X OAuth. We do not store your X access token.
• Campaign information. Terms acceptance, referral codes and attribution, eligibility, scores, rankings, prizes, and other campaign records.
• Preferences. Interface settings and other choices you save in the Service.
• Communications. Information you send when you contact us through email or community and support channels.

3.2 Blockchain and transaction information

Public blockchains record wallet addresses, transactions, token activity, timestamps, and contract interactions. We index and process public blockchain data to provide swaps, histories, analytics, campaigns, fraud prevention, and related features. Blockchain records are public and can remain available permanently.

3.3 Information collected automatically

• Usage information. Pages viewed, features used, clicks, referrals, session timing, swap-flow events, success or failure categories, token pairs, broad USD-value ranges, and other product events.
• Device and network information. Browser, device type, operating system, language, referring page, approximate region, and network request information such as IP address where required to deliver and protect the Service.
• Cookies and browser storage. Session cookies, analytics identifiers, wallet-connection state, preferences, pending referral codes, and temporary campaign-consent state.

3.4 Information we do not collect

• We do not receive or store wallet private keys, seed phrases, or wallet passwords.
• We do not store X access tokens.
• We do not sell or rent personal information.
• We do not use session replay in PostHog.

4How we use information

We use information to:

• connect and authenticate wallets and linked accounts;
• provide swaps, transaction history, profiles, campaigns, leaderboards, and prizes;
• operate, maintain, measure, troubleshoot, and improve the Service;
• remember preferences and maintain sessions;
• respond to support and privacy requests;
• detect and prevent fraud, abuse, security incidents, and manipulation;
• enforce our terms and protect users, Monorail, and third parties; and
• comply with legal, tax, sanctions, and regulatory duties.

5Legal bases

Where the GDPR, UK GDPR, or similar law applies, we process information on these legal bases:

6Analytics and connected services

We use the following services:

We can also use infrastructure, database, communications, professional, and compliance providers where needed to operate the Service. They may process information only for the relevant service or as the law permits.

7When we disclose information

We can disclose information:

• to the providers described above and other processors needed to operate the Service;
• when you ask us to connect or interact with a third-party service;
• to comply with law, sanctions, court orders, or valid government requests;
• to investigate fraud, abuse, security incidents, or violations of our terms;
• to protect the rights and safety of Monorail, users, or third parties; and
• as part of a merger, financing, restructuring, sale, or transfer of all or part of our business.

Wallet addresses, X usernames, transactions, contest scores, ranks, prize status, and other public-facing profile information can be displayed publicly where needed for Service operation and transparency.

8International transfers

Monorail is established in the British Virgin Islands. We and our providers can process information in the British Virgin Islands, the United States, the European Economic Area, and other locations. Where required, we use recognized safeguards for international transfers, such as adequacy decisions or standard contractual clauses.

9Retention

We retain account and profile information while your account or linked identity remains active. After closure or inactivity, we generally retain associated personal information for up to 24 months for security, fraud prevention, dispute resolution, and Service integrity.

We can retain contest, transaction, compliance, tax, audit, and legal records for longer where reasonably needed or required by law. Public blockchain data remains on the relevant blockchain and is outside our control. Aggregated or de-identified information can be retained without a fixed period when it can no longer reasonably identify you.

10Cookies and browser storage

• Necessary storage supports authenticated sessions, wallet state, security, saved preferences, referrals, and campaign flows.
• PostHog can use cookies and local storage to assign an analytics identifier, group events into sessions, and recognize return visits.
• Google Analytics can use cookies or similar identifiers for measurement under Google's policies.
• Self-hosted Plausible does not use cookies or persistent identifiers for its standard aggregate measurement.

You can clear or block browser storage through your browser. Blocking necessary storage can prevent authentication, wallet connection, saved settings, or campaign features from working correctly.

11Your rights

Depending on where you live, you may have rights to:

• access personal information we hold about you;
• correct inaccurate or incomplete information;
• request deletion of personal information;
• restrict or object to processing;
• receive portable information where applicable;
• withdraw consent where processing relies on consent; and
• complain to an applicable data protection authority.

Email [email protected] to make a request. We can ask for information needed to confirm your identity and wallet control. These rights can be limited by applicable law and cannot remove public blockchain records.

12Security

We use technical and organizational measures designed to protect personal information, including encryption in transit, access controls, restricted database access, secure session cookies, and specialized network protection. No system is completely secure. You are responsible for protecting your wallet, device, credentials, and recovery information.

13Age requirement

The Service is intended for people aged 18 or older. We do not knowingly collect personal information from a person under 18. If you believe a person under 18 has provided personal information, contact us so we can take appropriate action.

14Changes to this policy

We can update this policy as the Service, providers, or law changes. We will revise the effective date and, where required, provide additional notice of material changes.

15Contact

Email: [email protected]