Privacy Policy

The Switchyard team runs Switchyard and is responsible for the personal data described here.

This policy covers the website, sign-in and the dashboard. When request routing goes live, we will update it to describe how requests are handled before any are processed.

We do not ask for your name, email address or payment card. Here is everything we keep:

• Workspace: a random workspace id and the time it was created.
• Wallet: the public address of the Solana wallet you sign in with or link, and when you linked it. Public addresses are visible on-chain to anyone. We never receive your private key or seed phrase.
• API keys: a SHA-256 hash of each key, the key's prefix (its first 12 characters, so you can tell keys apart), and when it was created, last used and revoked. We never store the full key.
• Sign-in challenges: a random one-time value for each wallet sign-in. It contains nothing about you, works once and expires after 10 minutes.
• IP addresses: used to rate-limit the sign-in endpoints. We store them only as a salted hash inside short-lived counters.
• Email: if you write to us, we keep your email address and message so we can reply.

We set one cookie, sy_session. It is strictly necessary: it keeps you signed in to your workspace.

• It holds your workspace id and the time you signed in, signed with HMAC so it cannot be forged.
• It is httpOnly, so scripts on the page cannot read it.
• It lasts 30 days, or until you sign out.

We use no analytics cookies, no advertising cookies and no third-party trackers.

Our fonts are served from our own domain. Loading a page does not send a request to Google or any other font service.

Wallet apps such as Phantom, Solflare and Backpack run in your browser and are made by other companies. What they collect is covered by their own privacy policies, not this one.

• To create your workspace, sign you in and let you manage your keys. Legal basis: performing our contract with you.
• To keep Switchyard secure and stop abuse, including rate-limiting sign-in. Legal basis: our legitimate interest in running a safe service.
• To answer you when you contact us. Legal basis: our legitimate interest, or steps you asked for before a contract.
• To meet legal obligations, where the law requires us to keep or disclose data. Legal basis: legal obligation.

We do not sell your data and we do not use it for advertising.

Our hosting and database providers process this data on our behalf, under contract, only to run Switchyard. Like any host, they handle technical data such as IP addresses to deliver requests.

We disclose data to authorities only when the law requires it.

• Workspace data, wallet address and key records: for as long as the workspace exists.
• Rate-limit counters: removed automatically once they are more than 24 hours old, usually within a day.
• Sign-in challenges: 10 minutes at most.
• The session cookie: 30 days, or until you sign out.
• Emails: as long as needed to handle your request.

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to how we use it, and receive a copy of it. You may also complain to your data protection authority.

To use any of these rights, write to us through the official Switchyard channels and include your workspace id from the dashboard. Do not send us an API key. We may ask you to prove you control the workspace, for example by signing a message with its linked wallet.

Ask us through the official Switchyard channels to delete your workspace. We delete the workspace, its wallet link and its key records. On-chain data, such as $YARD burns, is public and permanent, and nobody can delete it.

Switchyard is a developer tool and is not meant for children. We do not knowingly collect data from anyone under 16. If you think a child has used it, contact us and we will delete the workspace.

Our providers may process data in other countries than yours. Where the law requires it, we use appropriate safeguards for those transfers, such as standard contractual clauses.

When what we collect or how we use it changes, we update this page and its effective date. For significant changes, we will also give notice on the site or in the dashboard.

Privacy questions can be sent to us through the official Switchyard channels.