Privacy Policy

1.1 Who We Are

This Privacy Policy explains how Akashi (“Akashi”, “we”, “us” and “our”) collects, uses, shares and protects information when you use the Akashi website and application, the curator app, the Telegram bot, the AI assistant, the vaults and the programmatic interfaces (together the “Interface”). Capitalized terms that this Policy does not define have the meaning given to them in the Terms & Conditions, of which this Policy forms part.

1.2 Scope

This Policy applies to information we process when you access or use the Interface, whether through a browser, through Telegram or through software acting for you. It does not apply to third-party protocols, wallets, websites or services that we do not operate, each of which has its own privacy practices, nor to information recorded on a public blockchain, which no one controls.

1.3 Personal Data

“Personal Data” means information that identifies, or could reasonably be linked to, an identified or identifiable natural person. A public wallet address is Personal Data when it can be linked to you, and we treat it as such. Aggregated or de-identified information that cannot reasonably be linked to you is not Personal Data.

1.4 What We Never Hold

The Interface is non-custodial. We never receive, store or have access to your private keys, seed phrase or funds, and we never sign a transaction for your wallet. If you give the Telegram bot your own key for an AI provider, we store that key encrypted so that the bot can use it for you; it is not a key to any funds.

2.1 Information by Part of the Interface

The table below lists, for each part of the Interface, the information we collect, why, the legal basis we rely on where the law requires one, and how long we keep it.

• Website, wallet connection

  Information
  Your public wallet address; balances and positions read from the chain; the version and time of your acceptance of the Terms, stored in your browser.

  Purpose
  Display your portfolio and build the transactions you request; prove acceptance of the Terms.

  Legal basis
  Contract; legitimate interests.

  Retention
  The acceptance record stays in your browser until you clear it. Chain data is public and permanent.

• Portfolio and transaction history

  Information
  For each address that uses the Interface: positions and their value over time, deposit and withdrawal events, cost basis, protocol points and rewards, and each transaction the Interface built with its intent, amount, estimated and realised value, signature and outcome.

  Purpose
  Show history and performance; measure whether built transactions land; detect abuse.

  Legal basis
  Contract; legitimate interests.

  Retention
  Detailed transaction rows are aggregated into daily totals after 30 days. Position history is kept while the address is tracked.

• Telegram bot

  Information
  Telegram user ID, chat ID and username; the wallet you link or paste; your messages, session summaries and the facts the bot keeps to continue a task; workflows you start; preferences (risk tolerance, tokens, protocols, slippage, alerts, quiet hours); usage counts; and, if you choose, your own AI-provider key, encrypted.

  Purpose
  Answer you, continue a task across messages, prepare the transactions you ask for, deliver alerts, apply usage limits.

  Legal basis
  Contract; consent for an AI-provider key and for alerts.

  Retention
  While your bot account exists; the reset command erases your conversation, memories and preferences.

• AI assistant

  Information
  Your questions and the page context needed to answer them; a hashed form of your IP address; a log of each interaction (time, token counts, outcome). Message text is kept only when message logging is on for diagnosis.

  Purpose
  Generate answers; apply a daily budget; diagnose faults.

  Legal basis
  Contract; legitimate interests.

  Retention
  Interaction logs are kept for service statistics; message text, when logged, only for diagnosis.

• Curator app

  Information
  A signature from your wallet to sign in and a hashed session token; the vault records you create, including the disclosures you publish (name, entity, website, team, conflicts of interest, audit claims) and your change log.

  Purpose
  Authenticate you; show your vault to depositors; keep a record of changes.

  Legal basis
  Contract; legitimate interests of depositors.

  Retention
  While the vault or its record exists, and afterwards as a record.

• Feedback form

  Information
  What you write, the contact details you choose to give, your wallet address if connected, any screenshot you attach, your browser type and a hashed form of your IP address.

  Purpose
  Read and act on your report; prevent abuse of the form.

  Legal basis
  Consent; legitimate interests.

  Retention
  Delivered reports are deleted after 30 days, undelivered ones after 90 days.

• Alerts and notifications

  Information
  Your alert preferences; the link between your wallet and your Telegram account (a signed request that lasts ten minutes, then a session of thirty days); the messages queued for you.

  Purpose
  Deliver the alerts you opted in to.

  Legal basis
  Consent.

  Retention
  Queued messages are deleted after 14 days. Preferences stay until you change them.

• Analytics and logs

  Information
  Pages viewed, actions taken, errors your browser reports, page-performance measurements, approximate region, browser and device type, referring source; once you connect, your wallet address as the identifier of your session; server logs with request metadata.

  Purpose
  Understand use, find faults, secure the service.

  Legal basis
  Legitimate interests.

  Retention
  Per the analytics provider's settings; server logs for a short rolling window.

2.2 Sources

We obtain information:

1. from you, when you connect or paste a wallet, accept the Terms, write to the bot or the assistant, submit feedback, set preferences, or publish a curator disclosure;
2. from your browser and device automatically, as described in Part 4;
3. from the Solana blockchain, which records every wallet address and transaction publicly; and
4. from Telegram, when you use the bot.

2.3 Information About Others

If you paste a wallet address that is not yours, or name another person in a message or a disclosure, we process that information as described in this Policy. You must have the right to share it.

3.1 Purposes

We use the information described above to:

1. operate, maintain, secure and improve the Interface;
2. display your portfolio, balances, positions and their history, and yield data;
3. build the unsigned transactions and workflows you request, and continue a task across messages;
4. deliver the alerts and digests you opt in to;
5. apply usage budgets and rate limits;
6. publish a curator's disclosures to depositors;
7. understand how the Interface is used, in aggregate and by session;
8. detect, prevent and investigate fraud, abuse, sanctions exposure and security incidents, including by screening wallet and IP addresses;
9. respond to your requests and feedback; and
10. comply with the law and enforce the Terms.

3.2 Legal Bases

Where the law requires a legal basis, such as under the General Data Protection Regulation of the European Union or the United Kingdom, we rely on:

1. contract, to provide the Interface you asked for;
2. consent, for alerts, for an AI-provider key you give the bot, and for feedback you send; you may withdraw consent at any time, which does not affect processing before withdrawal;
3. legitimate interests, in operating, securing and improving the Interface, in measuring its use, in preventing abuse and in giving depositors the information a curator publishes; and
4. legal obligation, where the law requires us to keep, disclose or restrict information.

3.3 Automated Screening

We may screen wallet addresses, IP addresses and transactions automatically against sanctions lists and risk indicators, and may block or disconnect an address or a session as a result. These measures protect the Interface and are required by the Terms; you may contact us if you believe a measure was applied to you in error.

4.1 Local Storage

The website keeps a small number of values in your browser's local storage so that it works as you left it: your theme, the wallet you last connected, the version and time of your acceptance of the Terms, dismissed notices, column settings and slippage. Nothing in local storage identifies you to us, and you can clear it in your browser at any time; clearing it will ask you to accept the Terms again at your next connection.

4.2 Analytics

We use PostHog for product analytics and error reporting, and Vercel Analytics and Speed Insights for aggregate usage and performance. PostHog records the pages you view, the actions you take, errors your browser reports, performance measurements, approximate region, browser type and referring source. Once you connect, your public wallet address becomes the identifier of your session, and if you link that wallet to the Telegram bot the two are associated. We do not sell analytics data and do not use it for advertising.

4.3 Your Controls

You can block analytics with a browser setting or extension, and the Interface keeps working. You can control cookies and local storage through your browser; blocking them may degrade functionality, and the acceptance of the Terms cannot be remembered without local storage.

5.1 Service Providers

We share information with providers that process it on our behalf under confidentiality obligations. They are:

• Anthropic

  What it does for us
  Language model behind the assistant and, by default, the bot.

  Information it receives
  Your questions and the context sent with them.

• The AI provider you choose in the bot

  What it does for us
  Language model, when you bring your own key (OpenAI, Google, OpenRouter, Ollama or Anthropic).

  Information it receives
  Your bot conversation, under that provider's own terms.

• Helius

  What it does for us
  Solana RPC: reads chain data and relays signed transactions.

  Information it receives
  Wallet addresses and transaction contents, which are public on chain.

• PostHog

  What it does for us
  Product analytics and error reporting.

  Information it receives
  The analytics data above, keyed by wallet address once you connect.

• Vercel

  What it does for us
  Hosting of the website; aggregate analytics and performance measurement.

  Information it receives
  Request metadata and aggregate usage.

• Railway

  What it does for us
  Hosting of the backend, the bot and the database.

  Information it receives
  Everything the backend stores.

• Telegram

  What it does for us
  Delivery of bot messages and alerts.

  Information it receives
  Your Telegram identifiers and the messages exchanged.

Rate and risk data come from protocol programs and public APIs such as DefiLlama; those requests carry no Personal Data.

5.2 Other Disclosures

We do not sell Personal Data. Beyond the providers above, we may disclose information:

1. to depositors and the public, when you are a curator: the disclosures you publish are shown on your vault's pages and may be quoted in our documentation;
2. to comply with a law, a regulation, a legal process, a sanctions obligation or a lawful request of a public authority;
3. to protect the rights, property, safety or security of users, the public or Akashi, including to investigate a security incident or a breach of the Terms;
4. to a successor in connection with a merger, acquisition, financing, reorganization or sale of all or part of the operation of the Interface; and
5. with your consent or at your direction.

5.3 Public Blockchains

Every wallet address and transaction you broadcast is recorded permanently on the Solana blockchain, which is public and which we do not control. We cannot change, erase or anonymize on-chain information, and anyone can read it, link addresses together or associate them with other information. Consider this before using an address that is linked to your identity.

6.1 Retention

We keep Personal Data only as long as needed for the purposes in this Policy or as the law requires, after which we delete or de-identify it. The retention column of the table in clause 2.1 states the windows the Interface applies today. Information needed to resolve a dispute, to comply with a legal obligation or to enforce the Terms may be kept for as long as that need lasts. Aggregated statistics may be kept indefinitely.

6.2 Security

We apply administrative and technical measures appropriate to the information we hold: session tokens and IP addresses are stored hashed, an AI-provider key you give the bot is stored encrypted, access to systems is restricted, and wallet-scoped actions require a signature from the wallet. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for the security of your wallet, your devices and any key you share with us.

6.3 International Transfers

The providers named above process information in the United States and in other countries whose data-protection laws may differ from those of your country. Where the law requires, we rely on appropriate safeguards for such transfers, such as standard contractual clauses, and you may ask us for information about them.

7.1 Rights Available to Everyone

Whatever your location, you can disconnect your wallet, clear your browser's local storage, turn off alerts in the notification settings, erase your Telegram bot conversation, memories and preferences with the bot's reset command, and stop using the Interface. You can also ask us what information we hold about a wallet address or a Telegram account you control, and ask us to correct or delete it.

7.2 European Economic Area, United Kingdom and Switzerland

If you are in one of these territories you have, subject to the law's conditions and exceptions, the right to:

1. access the Personal Data we hold about you and receive a copy;
2. have inaccurate Personal Data corrected and incomplete Personal Data completed;
3. have your Personal Data erased;
4. restrict or object to our processing, including processing based on legitimate interests;
5. receive the Personal Data you provided in a portable format;
6. withdraw consent at any time where processing is based on consent; and
7. lodge a complaint with a supervisory authority.

7.3 California and Other United States Jurisdictions

If you are a resident of California or of another state with a comprehensive privacy law, you may have the right to know what Personal Data we collect, use and disclose, to access and delete it, to correct it, and to opt out of its sale or sharing. We do not sell Personal Data and do not share it for cross-context behavioral advertising, and we do not discriminate against you for exercising a right. An authorized agent may act for you if you give them written permission.

7.4 How to Exercise a Right

Write to us at the address in clause 8.4. Because we identify you by wallet address or Telegram account rather than by name, we may ask you to prove control of the address or account, for example by signing a message, before we act. We respond within the period the applicable law allows, and we may decline a request the law permits us to decline, in which case we will tell you why.

8.1 Children

The Interface is not directed at, and is not intended for use by, anyone under eighteen or under the age of majority in their jurisdiction. We do not knowingly collect Personal Data from such a person, and we will delete it if we learn we have done so.

8.2 Third-Party Links

The Interface links to protocols, wallets, block explorers, documentation and other sites that we do not control. Their privacy practices are their own, and we are not responsible for them. The Swap page embeds Jupiter's interface, which is governed by Jupiter's privacy practices.

8.3 Changes to this Policy

We may update this Policy from time to time. A change takes effect when it is posted on the website with a new “Last updated” date. Where a change materially reduces your rights, we will take reasonable steps to bring it to your attention, such as a notice in the Interface. Your continued use after a change takes effect is acceptance of the updated Policy.

8.4 Contact

Questions about this Policy, and requests to exercise your rights, can be sent to contact@akashi.finance. Public announcements are made on X at @akashi_finance.