Privacy Policy
LAST UPDATED: 2026-10-07 · v1.1-privacy-rewrite
1. Controller
The data controller is MacroSynchronicity Labs, operator of Rebel Terminal. Privacy inquiries: privacy@rebelterminal.com. There is no appointed EU representative; EU/EEA users exercise the rights in section 7 through the same address.
2. Information We Collect
Account data: email address (encrypted at rest with Fernet, looked up by SHA-256 hash — never stored in plaintext), bcrypt password hash for email signups, display name, and avatar URL. Auth events record SHA-256 hashes of IP address and user agent, never the raw values. Wallet data: Sui wallet address, NFT tier, and holder-since timestamp when you connect a wallet. We never see, transmit, or store private keys or seed phrases — signing happens in your wallet. Product data: alerts, watchlists, formulas, workspace files, and research questions you create. We do not sell personal data.
3. zkLogin Disclosure
Sui zkLogin signs you in with an OAuth identity (Google) plus a zero-knowledge proof generated in your browser. What our backend receives and stores: the OAuth sub claim, your email address (encrypted, as above), and your display name — used only to find or create your account and to derive your deterministic Sui address salt. What we never receive: your OAuth password, your ephemeral private key, or anything that would let us sign transactions as you. The ZK proof is verified against the Sui network; address derivation is deterministic from provider + sub + salt.
5. Data Security
TLS in transit. Email encrypted at rest (Fernet with a dedicated PII key, separate from the JWT secret). Passwords hashed with bcrypt. JWTs expire (15 min access / 7 day refresh). Sui wallet signatures carry a 5-minute replay window. Auth endpoints are rate limited (10/min). No system is perfectly secure; we disclose breaches affecting account data by on-platform notice.
6. Data Retention
Account data lives as long as your account. Deleting your account (section 7) removes the user row and every user-owned row — alerts, holdings, charts, formulas, files, workspaces, sessions, command logs, XP events, story progress, notifications, console usage, auth events, Express records, research questions, and alert history — immediately, not within 30 days. Backups, if any, age out on the host's schedule. Anonymized aggregate metrics carry no identifiers.
7. Your Rights (Including Deletion)
Access, correction, portability, and restriction: email privacy@rebelterminal.com from your account address. Deletion is self-service and immediate: Settings → Danger Zone, or DELETE /api/auth/account with body {"confirm": "DELETE"} while signed in. EU/EEA users hold the same rights under GDPR; there is no automated decision-making with legal effect on this service.
8. Third-Party Services
Hosting (Railway), payments (Stripe — card data goes to Stripe, we keep only the customer binding and tier), OAuth (Google — ID token verification only), Sui RPC/GraphQL (public chain reads for NFT tiers; your address is public on-chain by design). Each has its own policy. We share nothing beyond what each integration needs.
9. Changes to This Policy
Material changes ship with a new version tag above and an on-platform notice. Continued use after a change constitutes acceptance.