Privacy Policy

1. Who is responsible

UrDefi is operated by Stinky Cheese IP LLC, based in Delaware, USA. This operator is responsible for the personal information described here. Contact legal@urdefi.com with privacy questions or requests.

This policy covers urdefi.com and UrDefi-operated interfaces that link to it, including the independent Aave interface. Features marked coming soon are not promises of current availability. External protocols, wallets, publishers, and service providers have their own privacy notices.

2. Information we handle

What we handle depends on the features you use. You can browse public content without creating an UrDefi account.

• Account information: an account identifier, display name, avatar choices, preferences, linked sign-in identifiers, connected interfaces, saved wallet addresses and labels, and account creation information.
• Sign-in information: wallet addresses and verification messages or signatures; provider identifiers and verification information from Google/Firebase or an enabled organization sign-in provider. Email or phone sign-in also involves the email address or phone number you give that provider.
• Wallet research: addresses you enter or connect, public balances, positions, transactions, and related market data used to answer your request. Watching or saving an address does not prove that you own it.
• Account access records: the observed IP address, browser user agent, connected client, session hash, access times, and request counts for signed-in requests. A connected server may appear with its server address. Raw session cookie values are not stored in the account database.
• Optional personalization: followed or muted sources and daily visit counts for supported sources when you enable feed personalization.
• AI information: your questions, relevant conversation and page context, supplied wallet or market information, generated answers, source references, and usage and credit records. Connected interfaces can save question and answer records to your account even where a history viewer is unavailable.
• Purchases and support: plan and subscription status, order and payment references, amounts, credit balances and usage, refund status, and information you send when contacting us. Card details are entered with Stripe rather than in UrDefi's account forms.
• Technical information: request and error information processed to deliver pages, prevent abuse, and operate hosting and network services. Providers may maintain additional technical logs under their own arrangements.

3. Why we use information

We use information to deliver requested content and wallet research; create and secure accounts; verify sign-in; connect interfaces you authorize; maintain saved settings and wallets; answer AI questions; account for plans, payments, and credits; provide support; prevent abuse; resolve disputes; and meet legal obligations.

Feed personalization starts off. If you enable it, supported source visits and your source preferences help tailor your feed. You can turn it off and clear reading activity in your account. This feature is separate from security logging and the records needed to deliver or bill a requested service.

Where European or UK data protection law applies, the legal basis depends on the purpose: performing a contract or taking steps you request before one; complying with legal obligations; our legitimate interests in proportionate service security, fraud prevention, support, and administration; or consent for optional processing where required. You may object to processing based on legitimate interests and withdraw consent without affecting earlier lawful processing.

4. Providers and other recipients

We disclose information needed to provide the feature you request to the relevant providers. These include hosting and database infrastructure used through Sites and Cloudflare; Google/Firebase and enabled organization providers for sign-in and verification; Stripe for card purchases and subscriptions; OpenAI for AI requests where that feature uses its models; blockchain RPC, indexing, and data providers for wallet and market lookups; and enabled wallet-connection providers such as WalletConnect/Reown when you choose that connector.

Aave news pages offer optional X and Instagram embeds. If you choose to load them, your browser connects to X or Meta. These providers can receive your IP address, browser information, and interactions and use cookies or similar technology under their own policies. You can leave embeds unloaded and use direct external links instead.

An AI request can disclose your question and the relevant conversation, wallet address, position, or page context to the model provider. Avoid entering passwords, seed phrases, private keys, or information about another person that you are not entitled to share. Provider security, abuse monitoring, retention, and other handling are governed by the applicable provider arrangements; an API setting is not a promise of zero provider retention.

An interface you connect can receive the limited account information needed for that connection, such as account ID, display name, and avatar, and can use supported account services. Where enabled, verified provider identifiers can support existing organization access. Revoking an interface stops its account grant; it does not erase records it already holds separately.

We may also disclose information when legally required, to protect rights or investigate abuse, to professional advisers under appropriate confidentiality arrangements, or in connection with a lawful business transfer with applicable safeguards. Public blockchain transactions are visible to others independently of UrDefi.

5. Cookies and browser storage

UrDefi uses the __Host-urdefi cookie to maintain an account session, normally for up to seven days, and the __Host-urdefi-wallet cookie for a wallet sign-in challenge, normally for up to five minutes. Signing out or expiry ends the relevant session. Blocking these cookies can prevent sign-in. The Aave interface also uses the __Host-urdefi-interface cookie for its connected account session and the __Host-urdefi-flow cookie for the temporary sign-in flow. Disconnecting or signing out ends the relevant account grant or session; clearing a browser cookie alone does not erase stored account records.

Interfaces may use session storage or local storage for connection state, preferences, local learning or practice records, and recovery of an existing wallet-payment flow. Local records belong to that browser and are not necessarily included in an account export or deletion. Browser settings let you inspect and remove local storage; doing so can remove progress or recovery information.

Sign-in, verification, wallet, and payment providers may use their own storage when you invoke their features. Any optional storage or tracking requiring permission must be handled through the applicable choice before it operates. UrDefi does not currently interpret the legacy browser Do Not Track signal. That does not replace any privacy choice required by applicable law.

6. Retention and deletion

Account profile, linked identities, preferences, saved wallets, and service records are kept while needed to operate your account or resolve the relevant request. Optional source-visit records and signed-in account-access records use a rolling 30-day window, with older records removed when the relevant cleanup runs.

Saved AI records do not currently have a fixed automatic expiry. They remain until deleted through the supported deletion process or account deletion, subject to applicable legal requirements. The current account export does not include saved AI conversations, and the retired AI-history viewing and export endpoints are unavailable. Contact us for an applicable access or deletion request covering records outside the self-service export.

Deleting an account removes its linked UrDefi account records and sessions under the service's deletion process. Payment order records can remain after the account link is removed. Order references may still be linkable to a purchase through payment-provider records. Payment, dispute, security, legal, and backup records may be retained for the period needed for their purpose or required by law; account deletion is not a promise that all copies at all providers disappear immediately.

UrDefi cannot erase a public blockchain, your wallet, a Firebase or organization identity held by its provider, or information held independently by another app. Contact those providers about their records.

7. Your controls and rights

In Account you can change your profile and source preferences, manage saved wallets and interface connections, turn personalization off, clear reading activity, export the account data covered by that export, sign out sessions, and request account deletion. Export before deleting anything you wish to keep.

Depending on applicable law, you may have rights to access, correct, delete, or obtain a portable copy of personal information; restrict or object to processing; withdraw consent; and complain to a competent privacy regulator. These rights have legal exceptions. Contact legal@urdefi.com to make a request or ask about a response. We may need proportionate information to verify your identity. Do not send private keys or seed phrases.

Availability of a website alone does not determine which regional privacy laws apply. This policy does not limit rights you have under applicable law.

8. International processing and security

UrDefi and its providers can process information in countries other than where you live. Where European or UK transfer restrictions apply, transfers must rely on an applicable adequacy decision or other lawful safeguard, such as approved contractual clauses. Contact us for information about safeguards relevant to your information.

We use access restrictions, authenticated account operations, and protected session mechanisms to reduce risk. No website, wallet connection, or transmission method can guarantee absolute security. Keep sign-in methods secure, review wallet prompts, and contact us if you suspect account misuse.

9. Children

UrDefi's account, paid, and transaction services are intended for adults. Do not create an account or submit personal information through these services if you are under 18. Contact us if you believe a child has supplied personal information so we can assess and address it.

10. Policy updates and contact

We will update this policy when practices change and show the applicable date at the top. We will provide additional notice or request new permission where required. A policy update does not by itself authorize a new use requiring consent. Privacy questions and requests: legal@urdefi.com.