Privacy Policy

Account details. How you sign in (your email address, your X account's handle and ID, or your wallet address, through our login provider Privy), your Basin wallet address, and the profile you create: username, display name, bio, profile picture, header image, website, and location.

What you post and do. Posts, articles, replies, photos and videos, likes, reposts, follows, blocks, mutes, reports, reward pools you fund or earn from, notifications, and your settings.

Messages. Direct and group messages, including photos and videos you send in them.

Payments. Records of Verified and other payments (the transaction, amount, and currency).

Usage and security. Which posts appear in your feed (to rank it and avoid repeats), the days you use Basin, request counts used for rate limits (tied to your account or IP address), and error reports. Actions by Basin staff are logged, including the IP address and browser they used.

Some things are public by design:

• your profile, posts, replies, reposts, likes, follows, and the pools on your posts;
• everything on the blockchain: your wallet address, balances, and every transaction, including pool funding, payouts, and claims. Anyone can see these on Robinhood Chain, and they can't be deleted.

Messages are private to the people in the conversation, but they aren't end-to-end encrypted: they're stored on our servers, and we may review them to investigate reports or when the law requires it. Photos in messages are stored at hard-to-guess links; anyone who has a link can open that photo.

• to run Basin: your account, feed, profile, messages, notifications, and wallet;
• to run reward pools: working out who engaged, calculating shares, and paying out;
• to check payments for Verified and other paid features;
• to keep Basin safe: scanning uploads, stopping spam, bots, and pool farming, and enforcing our Terms;
• to fix bugs and improve the product, using error reports and overall usage counts;
• to follow the law and respond to lawful requests.

• We don't sell your personal information.
• We don't show ads or share your data with advertisers.
• We never have your wallet's private key, so we can't move your funds.

These companies process data for us, only to provide their service to Basin:

• Privy: sign-in and the built-in wallet.
• Supabase: our database and file storage.
• Railway: hosting.
• Inngest: background jobs, like paying out pools.
• Sentry: error reports, set up not to collect personal details by default.
• Hive: automatic safety scanning of uploaded images and videos, including detection of child sexual abuse material.
• Blockscout: blockchain data such as balances and transaction history.
• LiveKit: live audio for Streams (voice rooms). Audio passes through their servers and isn't recorded by Basin.
• X: only when you link your X account.

Some features connect your browser to other sites directly. Your wallet history loads from Blockscout, and the previews under links in posts load images from the linked site, so those sites can see your IP address. To build a link preview, our server visits the link, not you. Token prices come from public market data and involve no personal information.

We may share information with law enforcement or others when we believe the law requires it, or to protect people from harm, prevent fraud, or protect Basin and its users. Suspected child sexual abuse material is removed, preserved as the law requires, and reported to the appropriate authorities, such as NCMEC in the United States.

We don't use advertising or tracking cookies. Privy stores what's needed to keep you signed in, and Basin saves small preferences in your browser, like whether your wallet panel is open. Clearing your browser data resets these.

We keep your information while your account is open. You can delete your account at any time in Settings → Your account. When you do:

• your posts' text, photos, and videos, and all your uploads, are deleted;
• your likes, reposts, follows, blocks, and notifications are removed;
• you leave all your conversations and your messages are removed;
• your profile is cleared and your username is freed;
• your login with Privy is deleted, which also ends access to the built-in wallet.

We keep a minimal record of your wallet address so past pool payouts stay consistent, and records we must keep by law (like payment records). Deleted posts stay as empty placeholders so replies to them still make sense. Backups are overwritten on a rolling basis. Anything on the blockchain stays there forever.

You can edit your profile, delete posts, change who can message you, block people, choose your notifications, and delete your account, all from the app. Depending on where you live (for example under the GDPR in the EU/UK or the CCPA in California), you may also have the right to access, correct, export, or delete your data, and to object to or limit how we use it.

To make a request, email support@basin.social from the address on your account, or tell us your username. We'll verify it's you and respond within the time the law requires. You can also complain to your local data protection authority.

We protect your data with encryption in transit, access controls, and databases locked to our servers only, and we limit staff access. No system is perfectly secure, so we can't guarantee it. Keep your login and exported wallet key safe; we'll never ask for your key or seed phrase.

Basin is only for people 18 and over. We don't knowingly collect data from anyone younger. If you believe a minor has an account, tell us at support@basin.social and we'll remove it.

We and our providers may process your data in the United States and other countries, which may have different data protection laws than where you live. Where the law requires, we rely on appropriate safeguards for these transfers.

We can change this policy at any time without notifying you. Changes take effect as soon as they're posted here, and the date at the top shows the latest version. If you keep using Basin after a change, you accept the updated policy.