Privacy Policy

1. Who is responsible

Cowtalk Inc, an Iowa, United States corporation, operates CowTalk. This policy covers our app, cowtalk.xyz, account services, communication features and wallet-related interfaces. Contact cow@cowplatform.com or write to our registered address below for privacy matters.

2. Information we process

Account information includes your email, verified Apple subject and email-sharing preference when you use Apple sign-in, CowTalk ID, nickname, avatar, biography, account settings and authentication/session records. Apple may provide a private relay email instead of your personal email. If you set an account password, we store a salted password hash, not the password itself, to verify sign-in and manage password resets.

Communication information includes messages, images, videos, files, voice messages, group membership, contacts you add in CowTalk, meeting/call metadata and content you choose to transmit. Camera, microphone and selected media are used only for the features you invoke and the permissions you grant. Do not assume that all CowTalk communication is end-to-end encrypted.

Technical information may include network/IP address, device and installation identifiers, app/OS version, push notification tokens, connection diagnostics and security logs. We also process referral credentials, invitation relationships, reward/activity records, membership and points orders, reports and support requests. A deletion/support form collects a contact email, optional account/target reference and the description you provide.

3. Why we use information

We use information to verify and operate accounts; deliver and synchronize communications; provide meetings, notifications and wallet interfaces; administer orders and rewards; respond to support and deletion requests; and detect abuse, fraud and security incidents. Where applicable, processing is based on performing the service you request, your consent, legal obligations, or legitimate operational and safety interests subject to your rights.

Declining an optional permission may prevent the associated feature from working. You can change permissions in device settings. Necessary authentication, security and transaction processing cannot be disabled while continuing to use the corresponding feature.

4. Wallets and public blockchains

Wallet addresses, token balances, transaction hashes, contract interactions, quotes and order/transaction status may be read from public chains, indexed, cached and associated with the wallet or account you choose. RPC and market providers receive addresses, token/pool identifiers and transaction requests needed to answer your request. Public addresses are pseudonymous, not necessarily anonymous.

Local-wallet signing keys and recovery phrases are managed on your device by the local wallet. They are not required in support or deletion forms: never send us a recovery phrase, private key, OTP or wallet password. Connecting an external wallet is also subject to that wallet's policy.

Deleting CowTalk does not reverse blockchain transactions, erase records from a public blockchain or delete copies held by independent parties. Export and securely back up your local wallet before removing its local data. CowTalk cannot recover a lost recovery phrase or reverse a transaction.

5. Storage and international transfers

Our operator-designated application servers and backups are in Hong Kong. Your device also stores local account preferences, cached conversations/media and locally managed wallets. Infrastructure or service providers may process delivery, authentication, push or network data in other locations, including the United States and Singapore; Hong Kong hosting does not mean that every third-party processing operation stays in Hong Kong.

When information crosses borders, we assess applicable transfer requirements and use appropriate contractual, organizational and technical safeguards where required. Contact us for the safeguards relevant to your data. No claim of a particular certification or transfer framework is made by this policy.

6. Sharing and third-party SDKs

Recipients of your communications receive the content you send. Group and meeting participants may save their own copies. We also use infrastructure/storage and email providers (including AWS and SMTP delivery services), Google Firebase Cloud Messaging for Android push, Apple sign-in/APNs/TestFlight where used, and LiveKit/WebRTC for audio/video transport. Their processing depends on the feature, platform and current deployment.

Wallet and market features can contact configured RPC node operators, Jupiter/Pump.fun-related services, CoinGecko/GeckoTerminal, DexScreener and other enabled market/indexing providers. Wallet connection libraries and providers such as Reown/WalletConnect may process connection and wallet identifiers when those features are used. The backend mediates market requests where implemented; it is not a promise that no third party receives data.

We may disclose limited information to service providers acting for us, to enforce rules, protect rights and safety, comply with valid legal requests, or support a lawful business transfer with appropriate notice. We do not sell personal information. This policy does not authorize advertising or unrelated uses that would require additional notice or consent.

7. Retention and deletion periods

Account and service data are retained while your account is active and needed to provide the service. Server chat history is retrieved through bounded pagination and is not limited to a fixed seven-day access window. Retention of server records, media files and backups follows the applicable service and legal requirements. Local conversation copies remain until you remove them or the local app data.

Our operator's deletion policy is manual handling within 24 hours of receiving a request, including contacting you for proportionate identity verification. A request that needs more information is not shown as completed. After verification, we remove or irreversibly de-identify associated account/profile data, authentication/session and push records, contacts and memberships, and content/files under our control that are in scope of the request.

Backups are cleared within 90 days of deletion. Restricted records genuinely needed for fraud prevention, security, dispute handling or transaction accountability may be retained for up to 90 days. If a specific law or preservation order requires a different period, we explain the categories, reason and applicable period unless legally prohibited. These records must not be reused for ordinary service or marketing. Public blockchain records and other users' independent copies are outside our ability to erase.

Support request retention

Open support, deletion and safety requests remain available while they need handling. Closed requests and their internal review notes are removed after 90 days; their receipt codes then stop working. A restricted, separately documented legal preservation requirement is handled separately rather than silently extending all requests. Public forms use a temporary, necessary anti-forgery cookie. Network rate counters use hourly pseudonymous hashes and are cleared after expiry.

8. Your choices and rights

You can update available profile fields and permissions in the app. Request access, correction, export, deletion, restriction, withdrawal of consent or an objection to processing at cow@cowplatform.com or through /support. Available rights depend on applicable law; you may also contact the competent privacy regulator. We use proportionate identity checks, not a requirement to reinstall the app or provide wallet secrets.

An external deletion request is available at /account-deletion. A receipt code allows you to check the request's status without revealing account details. Keep it private. Revoking optional permissions or uninstalling the app alone does not submit an account deletion request.

9. Adults only and child safety

CowTalk is for people aged 18 or older and is not directed at children. Do not create an account if you are under 18. If we learn of an underage account or inappropriate collection of a child's data, we restrict access and address deletion subject to applicable preservation duties. Parents or guardians may contact cow@cowplatform.com. Our child-safety standards apply even though the service is adults-only.

10. Security, cookies and updates

We use transport encryption, access controls, verification challenges, scoped session handling, restricted administrative access and abuse controls. Local wallet protection depends on the device and wallet implementation. No system is completely secure; protect your device, receipt codes and recovery information. Notify us promptly about suspected compromise.

The website uses necessary session, language and anti-forgery state. Public policy text can be read without signing in. We do not place advertising or analytics scripts on these policy/request pages. Material changes to this policy will be posted with an updated date and additional notice when required.