Privacy Policy

DRAFT — NOT LEGAL ADVICE. HAVE A LAWYER REVIEW BEFORE PUBLISHING OR RELYING ON THIS. Placeholders like [ENTITY] must be completed, and the policy must be checked against the laws that apply to you and your users (e.g. GDPR/UK GDPR, CCPA/CPRA). It is not in force.

Last updated: [DATE] · Draft v0.2

This policy explains what information Fairstep's founder, until Milestone Labs LLC (formation pending) is formed, and Milestone Labs LLC after that ("Fairstep", "we") [COUNSEL: no entity formed yet; confirm the controller wording once Milestone Labs LLC exists] collects when you use the Fairstep website and app (the "Interface"), and how we use it. Short version: we don't have accounts, we don't take custody of funds, and we collect as little as we can.

1. Information we collect

You give us:

Waitlist email. If you join the waitlist, we store your email address, whether you're a freelancer or a client (only if you choose one), the page you signed up from, and the time you signed up. We store this in a private Google Sheet (via Google Apps Script) in our Google account. Google processes it for us as a service provider. We don't ask for your wallet address on the waitlist. If a future airdrop needs wallet addresses, we'll update this policy first.
Messages. If you email us (for example usemilestone@gmail.com), we receive your email and what you send.

Public blockchain data (not collected by us, but visible to everyone):

When you create, fund, deliver, approve, dispute or withdraw from a deal, your wallet address, the counterparty and referee addresses, amounts and timestamps are recorded permanently on a public blockchain. Anyone can see them, and neither we nor anyone else can delete them. Consider this before linking a wallet to your real identity.

Stored only in your browser:

Deal titles and milestone names you type, your theme preference and whether you joined the waitlist are stored in your browser's local storage and in the share links you create. They are not sent to our servers. Anyone you send a share link to can read the titles inside it.

Collected automatically:

Server logs. Our hosting provider (Vercel) processes your IP address, browser user-agent and requested pages to deliver and protect the site. We use your IP address briefly, in memory, to rate-limit waitlist spam. We don't log raw waitlist emails (only a short one-way hash).
Sanctions screening. Before you create a deal, the Interface checks the wallet addresses involved against a public sanctions oracle run by Chainalysis on the Ethereum blockchain. This check is a read-only query made from your browser through a public RPC provider.
Wallet and RPC providers. To read the blockchain and send your transactions, your browser connects to blockchain RPC providers and, if you use it, WalletConnect/Reown, Coinbase Wallet or MetaMask services. These providers can see your IP address and wallet address under their own privacy policies.
Analytics. We use Vercel Web Analytics and Vercel Speed Insights (provided by our host, Vercel, as a service provider) to understand how many people visit the site, which pages they view, where visits come from (referrer), their country, browser, device type and operating system, how fast pages load, and how many people join the waitlist (with the role you picked, if any). These tools are cookieless: they don't set cookies or store identifiers in your browser. Vercel says it identifies a visit with a hash of the incoming request that is discarded after 24 hours, so we can't use it to recognise you across days or sites. We only see aggregated statistics, never individual visitors. We don't build personal profiles, don't send your email or wallet address to analytics, and don't use advertising or cross-site tracking tools.
Cookies. We don't set cookies. Fonts are served from our own domain. The site uses your browser's local storage for your theme, your deal labels and your waitlist status. If you connect a wallet, the wallet libraries (RainbowKit, WalletConnect/Reown, Coinbase Wallet, MetaMask) may store connection data in your browser. If we add any other analytics or tracking tools, we'll update this policy first and ask for consent where the law requires it.

2. How we use information

to operate, secure and improve the Interface (including preventing spam, fraud and abuse);
if you joined the waitlist: to send you testnet beta and launch updates, and news about the planned $FSTP token and any airdrop (you can unsubscribe at any time);
to respond to your messages and security reports;
to comply with law, including sanctions laws.

Legal bases (EEA/UK): legitimate interests (security, running the Interface), consent (waitlist emails; withdraw any time), and legal obligation (sanctions compliance). [COUNSEL: confirm.]

Emails we send (CAN-SPAM). Every marketing email will say it's from Fairstep, use an honest subject line, include our postal address and a working unsubscribe link, and we'll honour unsubscribe requests within 10 business days. We don't buy or rent email lists. [COUNSEL: confirm the postal address to use, e.g. a PO box or registered agent.]

We share personal information only with service providers who help us run the Interface (hosting, cookieless web analytics and Speed Insights by Vercel; waitlist storage by Google; an email-sending provider if we use one, which we'll name here), when required by law, or in connection with a merger or acquisition. We don't sell or rent personal information and don't "share" it for cross-context behavioural advertising.

4. Retention

Waitlist entries are kept until you unsubscribe or ask us to delete them, or until [12] months after mainnet launch and any airdrop communications end, whichever comes first. We then delete them from the Google Sheet. Server logs are kept according to Vercel's retention settings (typically [1–30] days) unless we need them to investigate abuse. Blockchain data can't be deleted by anyone.

5. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict processing, and to withdraw consent. To delete your waitlist entry or make any other request, email usemilestone@gmail.com from the address you signed up with (or reply to any of our emails). We'll act on requests within 30 days. You may also complain to your local data-protection authority. We will not discriminate against you for exercising your rights.

6. Security

We use HTTPS, strict security headers, rate limiting and least-privilege access to the waitlist (the Google Sheet is private to our account). No system is perfectly secure. Never share your seed phrase — we will never ask for it.

7. International transfers

We and our providers may process information in the United States and other countries. Where required, we rely on appropriate safeguards (e.g. Standard Contractual Clauses). [COUNSEL: confirm.]

8. Children

The Interface is not for anyone under 18, and we don't knowingly collect their information.

9. Changes

We'll update the "Last updated" date when this policy changes, and notify waitlist members of material changes.

10. Contact

Fairstep (Milestone Labs LLC, formation pending), [ADDRESS] — usemilestone@gmail.com.