Privacy Policy

1. Scope

This Privacy Policy is part of the Parchment Terms of Service. All terms, conditions and terminology are consistent with the Terms of Service, which are incorporated into this policy by reference. The website at parchment.trade and the associated tools and services, including the public API, the keepers, gas sponsorship and the stop-loss and take-profit service, are referred to as the “Services” in this policy.

Parchment operates the Services. In this policy, Parchment and its affiliates are also referred to as “we” or “us.”

The Services connect to smart contracts on the Sui blockchain (the “Parchment protocol”). That on-chain functionality is not part of the Services. The Services also use third-party services, such as Sui wallets, Sui full nodes and swap routers, which have their own privacy policies. Parchment is not responsible for how those services handle your data.

2. The Blockchain

Blockchain technology, also known as distributed ledger technology, is at the core of the Services. A blockchain is a decentralized record of digitally recorded data in a chain of packages called “blocks”. The blocks are linked chronologically, so the data is very difficult to alter once recorded, and because the ledger is replicated across many nodes around the world, no single person administers it and there is no single place where it is located.

By design, a blockchain's records cannot be changed or deleted. This may affect your ability to exercise your rights, such as your right to erasure (“right to be forgotten”) or your rights to object to or restrict processing of your personal data.

Using the Parchment protocol writes data to the Sui blockchain, including your wallet address, your Parchment account, your deposits and withdrawals, your orders, positions, fills and liquidations, the session keys you register for one-click trading, your referral and builder-code relationships, your PARCHMENT mints, locks and stakes, and your game progress, achievements and cosmetics. You sign these transactions with your wallet's private key, and the decision to transact on the blockchain, and to share your wallet address with anyone (including us), rests with you.

The blockchain is public. Anyone can read data written to it, including your trading history, and link it to your wallet address and any name registered to that address (for example a SuiNS name). The Services also display this public data, for example on leaderboards and public trader profiles. If you want to make sure your privacy rights are not affected in any way, you should not transact on blockchains.

3. Individuals under the Age of 18

As set out in the Terms of Service, individuals under the age of 18 are not permitted to use the Services. We do not knowingly collect, solicit or maintain personal data from anyone under the age of 18.

If we learn that we have collected personal data from an individual under the age of 18, we will use commercially reasonable efforts to delete it. If you are a parent or guardian and you are aware that your child has provided personal data to the Services, please contact us so that we may remove it. We cannot delete information stored on the blockchain.

4. Collecting

The Services do not ask you to create an account, and do not ask for your name, email address or phone number; we only receive your email address if you email us. We collect the following:

When you connect a wallet and transact

• your wallet address, and the transactions you ask the Services to build, simulate, sponsor or relay;
• for one-click trading, the address of your session key and the signed proofs it sends to request gas sponsorship, together with records of sponsored transactions used to apply sponsorship limits;
• for stop-loss and take-profit orders, your wallet address, the account and position or order they apply to, the trigger prices and your signed proof, kept until the trigger fires, is cancelled or expires; and
• public blockchain data about your wallet address and Parchment account, which our indexer reads from the Sui blockchain to show balances, positions, history, leaderboards and profiles.

Log data

• when your browser calls our servers, our hosting providers and servers record request data such as your IP address, the time and the requested path, and transaction digests.

When you email us

• your email address and the content of your message, used only to respond to you and held only for as long as necessary for that purpose, as set out in Retention.

Usage and error data

• if analytics is enabled, the pages you view, how you arrived (referrer), your browser, device type, operating system, screen size, language and approximate location derived from your IP address, and reports of errors in the app. Wallet addresses, profile names and referral codes are removed from page addresses, page titles and error reports in your browser before they are sent. See Third-Party Data Collection.

5. Cookies and Browser Storage

The Services store data in your browser (cookies and local storage) to work. This includes:

• display and trading preferences, such as theme, layout, sound and order-ticket settings, favorite and recent markets;
• a referral code or builder code from a link you opened, so it can be applied when you trade;
• the state of onboarding, pending actions and failed requests shown in your history;
• the transfers you started with the cross-chain bridge (chains, addresses, amounts and transaction hashes), so they can be followed after a reload, and the wallet you last connected on another chain;
• for one-click trading, the session key: a browser-held, non-extractable key that can sign trades (but not withdrawals) for your account until you turn it off (revoke it); a session key created before November 4, 2026 may instead end on a set date unless it is extended. It never leaves your browser except as signatures; and
• if analytics is enabled, a random identifier set by our analytics provider to count visits and sessions.

You can clear this data in your browser settings at any time. Clearing it resets your preferences and ends one-click trading on that browser. Because recognition of the Do Not Track browser signal is not standardized, the Services do not respond to it.

6. Tracking and Uses

We use the information we have as described below and to provide and support the Services:

• Provide the Services: to build, simulate, sponsor and relay your transactions, fill your orders, execute your stop-loss and take-profit triggers, and show your balances, positions, history and rewards.
• Improve the Services: to understand which features are used, measure performance, and find and fix errors.
• Promote safety, integrity and security: to apply rate and sponsorship limits, detect and prevent abuse such as spam requests or manipulation, and keep the Services and the Parchment protocol secure.
• Communicate with you: to respond when you contact us.

We do not use your information for advertising, and we do not sell it.

7. Third-Party Data Collection

Using the Services involves third parties who receive some of your data to provide their part of the Services:

• Analytics and error tracking: if enabled, PostHog receives the usage and error data described in Collecting. The Services never record your session.
• Hosting: our hosting providers (such as Vercel for the website) process log data when they serve the Services.
• Sui network: your browser sends requests, including your wallet address, to a Sui full node (by default, a public full node operated by a third party) to read balances and send transactions.
• Your wallet: your wallet provider handles your keys and the transactions you sign under its own privacy policy.
• Cross-chain bridge: if you move funds between another blockchain and Sui, the third-party bridge Mayan receives your Sui wallet address, your address on the other chain, the amounts and the transaction hashes, to quote, route and track the transfer; the other chain's public RPC nodes and your wallet on that chain receive requests from your browser, including your address there.
• Other providers: swap routing for deposits from other coins, token icons and image resizing, and name lookup services (SuiNS) may receive requests from your browser, including your IP address and, for swaps and name lookups, your wallet address.

8. Retention

We hold your personal data only for as long as it is necessary for the purposes described in this policy and our legal and regulatory requirements. Log data is kept indefinitely. Stop-loss and take-profit records and sponsorship records are kept while needed to run those features and apply their limits. We cannot delete information stored on the blockchain.

9. Sharing

We do not share information about you with advertisers, marketing companies, or anyone else, except with the service providers described in this policy as necessary to run the Services, or when required by law.

10. Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. You are responsible for the security of your wallet, your private keys and the browser that holds your session keys.

11. Contact

If you have comments or questions about this policy, email us at parchment-trade@protonmail.com. You can also reach us on X (@tradeparchment).

12. Changes

We may change this policy at any time. We will post the new version here and change the “Last updated” date above.

13. GDPR / EU Addendum

Transferring your data outside of the EU

The data described in this policy is stored and processed on servers in the United States and in Tokyo, Japan, and by the service providers described in Third-Party Data Collection, which may process it outside the European Economic Area. Where we transfer personal data outside the EEA, we rely on the safeguards required by applicable law. Data written to the blockchain is replicated across a global decentralized network and may be stored anywhere in the world.

Your rights as a data subject

You have certain rights under applicable legislation, and in particular under Regulation (EU) 2016/679 (General Data Protection Regulation or “GDPR”). Because the Services do not identify you by name, we may ask you to prove that you control a wallet address, for example by signing a message, before acting on a request about data linked to it.

• Information and access: you have a right to be informed about the processing of your personal data and to access the personal data we hold about you. This policy provides that information, and you may contact us for more.
• Rectification: you have the right to have inaccurate personal data about you rectified and incomplete personal data completed.
• Erasure (“right to be forgotten”): you may request the erasure of your personal data where it is no longer necessary for the purpose for which it was collected, you withdraw your consent and no other legal ground applies, you object to the processing and there is no overriding legitimate ground, the data was unlawfully processed, or erasure is required to comply with a legal obligation. We will comply without delay unless continued retention is necessary for exercising the right of freedom of expression and information, complying with a legal obligation, the performance of a task carried out in the public interest, archiving, research or statistical purposes, or the establishment, exercise or defense of legal claims. We cannot erase data written to the blockchain; we can only delete the personal data we hold ourselves.
• Restriction and objection: you have a right to restrict processing of your personal data, for example where you contest its accuracy, where processing is unlawful, or where we no longer need it but you need it for legal claims. You also have the right to object to processing in certain circumstances. We cannot prevent others from processing data written to the blockchain.
• Data portability: where processing is based on your consent or on a contract, you have a right to receive the personal data you provided to us in a structured, commonly used and machine-readable format, or to ask us to send it to another controller.
• Automated decision-making: we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Fills, liquidations and payouts are carried out by the Parchment protocol's smart contracts under rules that apply to everyone.
• Direct marketing: we do not send marketing communications.
• Withdrawing consent: where processing is based on your consent, you may withdraw it at any time, for example by clearing browser storage or contacting us.
• Complaints: if you wish to raise a complaint about how we have handled your personal data, contact us and we will investigate. You may also contact the data protection authority in your jurisdiction.

The controller of your personal data is Parchment. For data protection matters, email us at parchment-trade@protonmail.com.