Privacy Policy
Last updated 5 November 2026
What we collect
| Data | Why |
|---|---|
| Your wallet address on Base | To sign you in and show you your plans and balances |
| What you enter for a vault: amounts held, fuel spend, share protected, leverage and similar | To size the hedge and show you what it protects |
| Vault records: status, positions, prices, margin readings, alerts, deposits and transaction ids | To run and monitor your protection and show you its history |
| Your acknowledgement of the risks before protection opens | To record that you were told |
| If you turn on "Protect as you get paid": the spend permission your Base Account signed (its cap, period and signature), and the USDC transfers into that account on Base, which Locke reads to work out your chosen share | To move that share into your vault, never more than your cap. Stops when you turn it off or revoke it |
| If you or your agent pay for Locke's agent API: the paying address and the payment authorization (amount and nonce) | To take each payment once and settle it on Base |
| If you turn on alerts: the email address you confirm, and the Telegram chat and username you link through Locke's bot | To send you alerts about your plans. Removed when you turn that alert off in your account, or send /stop to the bot |
| Your network (the first three parts of an IPv4 address, or an IPv6 /64), kept for about 10 minutes | To limit sign-in attempts and stop abuse |
| Technical logs kept by our hosting providers, which include IP addresses and browser details | To keep the service running and secure |
We don't collect names or identity documents, we only have an email address or Telegram chat if you add one for alerts, and we don't use analytics or advertising trackers. When you sign in, your wallet signs a one-time message; we check it and keep only the result.
Blockchains are public
Your wallet address, deposits, vault and trades are recorded on the Base blockchain and in Veranta's public data. Anyone can see them, and nobody, including us, can delete them. While a hedge is open, its Protected by Locke attestation on Base is public too.
Who else sees data
- Trading venue: Veranta sees your vault's trades on Base, and uses data under its own privacy policy.
- Your browser talks directly to your wallet, a Base RPC provider and, if you sign in with Base Account, Coinbase's Base Account service. They see your IP address.
- Our providers: hosting (Netlify), database (Supabase), background workers (Railway), alert delivery (Resend for email, Telegram for Telegram messages), and blockchain data and price services (such as Base RPC providers and Pyth through Veranta). They process data only to provide their service to us.
- When the law requires it: to comply with a valid legal request, or to protect users and Locke from fraud or abuse.
We don't sell your data and we don't share it for advertising.
How long we keep it
- Sign-in sessions last 24 hours. Sign-in challenges and network records are deleted within about 10 minutes.
- Vaults, alerts and deposit records are kept while you use Locke and for as long as we need them for records, disputes or the law. You can ask us to delete them sooner (see below).
Security
Sessions use signed, HTTP-only cookies; the database has row-level security and its public access roles have no access to tables; requests that change anything must come from Locke's own site. No system is perfectly secure, but even a leaked keeper key could not move your money out: only your own wallet can withdraw from your vault.
Your rights
Depending on where you live (for example under the GDPR, the UK GDPR or Nigeria's Data Protection Act), you can ask us to access, correct or delete your data, to restrict or object to how we use it, or to give you a copy. Write to alemzdelight@gmail.com with the wallet address it concerns; we may ask you to sign a message to show it's yours. We'll answer within 30 days. Data on public blockchains can't be deleted. You can also complain to your data protection authority.
We rely on: performing our agreement with you (running your plans), our legitimate interests (security, preventing abuse, improving Locke), legal obligations, and, for optional browser storage, your consent (see the Cookie Policy).
International transfers
Our providers may process data outside your country, including in the United States and the European Union. Where the law requires it, we rely on safeguards such as standard contractual clauses.
Children
Locke is for businesses and adults. It is not meant for anyone under 18, and we don't knowingly collect their data.
Changes
We'll update this policy when what we collect or how we use it changes. The date at the top shows the current version.
Questions about this document: alemzdelight@gmail.com.