This policy explains what personal information Buy Me Tokens ("we", "us") collects when you use Buy Me Tokens at https://buymetokens.xyz (the "Service"), why, who we share it with, and the choices you have. It goes with our Terms of Service.
The short version: we collect little. We don't sell your data, we don't show ads, and we never hold your money. We only read public blockchain records to confirm a payment arrived.
1. What we collect
If you create a page (a "Creator"):
- Account details from the sign-in method you choose (Google or GitHub): your name, verified email address, profile photo, and your account ID with that provider.
- Page content you add: page name, display name, bio, tagline, images, links (such as your GitHub, X or LinkedIn), and payment destinations such as wallet addresses and payment links.
- Payments you receive through our checkout: amount, network, time, status, and the blockchain transaction ID, so we can confirm them and show them to you.
- Reports about your page from other people (reason and optional note).
If you only visit or support someone: you don't need an account, and we don't ask for your name or email. If you pay through our checkout, we record the payment (amount, network, time, status and transaction ID) and the wallet address it came from, which are already public on the blockchain. We use them only to confirm the payment and prevent fraud. We never see your card, bank, or wallet keys. If you pay through another site (such as GitHub Sponsors), we don't see that payment at all.
Collected automatically (everyone):
- Technical logs from our hosting: IP address, browser and device type, pages requested, and timestamps. Used for security, abuse prevention, and keeping the Service running.
- Approximate location (country) derived from your IP address, only to block access from sanctioned regions.
2. Cookies and similar technology
We use only what the Service needs to work: a sign-in session cookie for Creators once they sign in, and temporary security cookies. We don't use advertising or cross-site tracking cookies. If we add analytics later, we will update this policy first and choose a privacy-respecting option.
Embeds: if a website embeds our badge or script, your browser loads an image or script from our servers when you visit that site, which lets us see standard request data (such as your IP address) as in the logs described above. The script doesn't set cookies or track you across sites.
3. Why we use it
- To run the Service: sign you in, show your page, generate share cards and embeds.
- To keep it safe: prevent scams, abuse, impersonation, and sanctions violations; review reports.
- To communicate with you: a welcome email, an email when you receive a confirmed payment, security notices, and important changes to the Service or these documents.
- To confirm payments: we check public blockchain records to see that the right amount reached the right wallet, and never count a payment twice.
- To improve and fix the Service, using aggregated or de-identified information where possible.
- To meet legal obligations and respond to lawful requests.
Where the law requires a legal basis (for example under the GDPR), we rely on: performing our agreement with you (running your page), our legitimate interests (security, abuse prevention, keeping the Service working), your consent where we ask for it, and legal obligations.
4. What is public
Your page is public by design. Anyone on the internet, and search engines, can see your display name, photo, bio, tagline, page name, links, and the payment destinations you add. Don't add anything you don't want public. Wallet addresses and blockchain transactions are also public and cannot be deleted from the blockchain, even if we remove your page. We never publish your email address.
5. Who we share it with
We don't sell or rent your personal information. We share it only with:
- Service providers that process data for us: Railway (website hosting), Neon (database), Google and GitHub (sign-in, only the one you choose), Resend (email delivery), and blockchain data providers we use to read public transactions. They may only use it to provide their service to us.
- Authorities and others when the law requires it, to enforce our Terms, or to protect people from fraud, abuse, or harm.
- A successor if we merge, sell, or reorganize the business (we would tell you).
- Third parties you choose to visit: when you click a payment or free-support link, you go to a site we don't control. Their privacy practices apply there.
6. International transfers
Our providers may process data in countries other than yours, including the United States. Where required, we rely on safeguards such as standard contractual clauses so your data stays protected.
7. How long we keep it
- Account and page data: until you delete your account, then removed within a reasonable period (up to 30 days), except what we must keep by law or for abuse prevention.
- Payment records: for as long as needed to show your history, prevent fraud and meet legal obligations. The transactions themselves stay on the public blockchain permanently, which nobody can change.
- Reports: as long as needed to handle them and prevent repeat abuse.
- Server logs: a limited period (typically up to 90 days) unless needed longer for security.
8. Your choices and rights
Depending on where you live (for example the EU/UK under the GDPR, or California under the CCPA/CPRA), you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, to withdraw consent, and to complain to your data protection authority. You can edit your page yourself. To exercise any right, or to delete your account, email hello@buymetokens.xyz from the address on your account. We may need to verify it's you. We won't discriminate against you for using your rights. We don't "sell" or "share" personal information as those terms are defined in California law.
9. Security
We use reasonable measures to protect your information, including encryption in transit and restricted access to our systems. No service is perfectly secure, so we can't guarantee absolute security. Protect your own account, and remember that anything on your public page is visible to everyone.
10. Children
The Service is for people 18 or older. We don't knowingly collect information from anyone under 18. If you think a child has given us information, contact us and we will delete it.
11. Changes
We may update this policy. If a change is significant, we will notify you on the site or by email before it takes effect. The "last updated" date above shows the current version.
12. Contact
Buy Me Tokens · hello@buymetokens.xyz