Privacy Policy

Effective date: May 25, 2026 · Last updated: August 9, 2026

Plain-English summary: Blackwing is built to not collect personal data wherever possible. We never store your wallet passphrase, your seed phrase, your private keys, your encrypted contacts, the contents of your IPFS files, or anything you sign on your droplet. We do receive a DigitalOcean OAuth token (encrypted at rest, used only to provision and manage your droplets at your instruction), an email/display name from DigitalOcean, a session cookie, and an audit log of platform actions you take. If you opt in to the encrypted recovery-phrase backup, we also store an opaque encrypted blob that we cannot decrypt. One thing we disclose plainly rather than glossing over: your wallet passphrase. On current nodes, your browser derives the needed authentication key itself and encrypts the passphrase so that only your droplet can read it — the passphrase never reaches our servers in readable form. On nodes running older sidecar software (until you update them), the passphrase you type still passes through our servers in flight — never written to our database and never logged (Section 2.10). That’s essentially it.

This Privacy Policy describes how Blackwing (“we,” “us,” “our”) collects, uses, and discloses information about you when you use the Blackwing web application, APIs, command-line interface, sidecar binary, cloud-init scripts, and related services (the “Service”). It should be read together with the Terms of Service.

1. What We Do Not Collect

By design, Blackwing does not receive, store, log, escrow, transmit to any third party, or have any technical means of recovering:

  • your wallet passphrase (used to derive the sidecar’s sign-tier HMAC key via Argon2id) — we never store, log, or retain it. On current nodes it never reaches our servers in readable form at all (your browser derives the key and end-to-end encrypts the passphrase to your droplet); see Section 2.10 for the legacy in-flight relay that still applies to nodes running older sidecar software;
  • your seed phrase (mnemonic) — generated and displayed only in your browser during the wizard (if you opt in to the encrypted backup described in Section 2.9, we store only ciphertext we cannot decrypt);
  • any wallet private keys or signing keys derived from them;
  • your encrypted contacts — encryption and decryption happen entirely in your browser using a key derived from your wallet passphrase via PBKDF2-SHA256; we see only opaque ciphertext;
  • the contents of files, folders, NFT metadata, ballots, on-chain message payloads, or other artefacts you pin to or serve from your droplet’s IPFS node;
  • your droplet’s root SSH keys, if you supplied your own; if we generated one for you, we transmit it once in the provisioning response and do not retain it; and
  • the plaintext of any signed partial-transaction blob, bid, service offer, or other artefact you produce on your droplet.

2. What We Do Collect

2.1 DigitalOcean account information (from you, via OAuth)

When you sign in with DigitalOcean, we receive from DigitalOcean: your DigitalOcean user ID, email address, and display name. We use this to create and maintain your Blackwing account.

2.2 DigitalOcean OAuth token (from DigitalOcean, with your consent)

We receive a DigitalOcean OAuth access token and refresh token with read write scope, which we use solely to provision, query, and (at your instruction) destroy droplets on your DigitalOcean account. The token is encrypted at rest using a Fernet (AES-128-CBC + HMAC-SHA256) key held only by our platform process, and is never exposed to any third party. You can revoke this token at any time in your DigitalOcean dashboard, which immediately ends our ability to act on your DO account.

2.3 Node metadata (from you, when you provision)

For each droplet you provision through the Service we store: the node’s chain (Ravencoin or Kaspa), your chosen region, size, label, snapshot mode, pruned mode preference, the droplet’s public IPv4 (or Tailscale IP, if applicable), the SHA-256 fingerprint of the sidecar’s TLS certificate (so we can pin it for subsequent calls), the wallet_initialized_at timestamp, sync progress counters reported by the chain daemon (ravend / kaspad), the status lifecycle field, and timestamps for creation, readiness, and last heartbeat. We do not store any wallet content, RVN or KAS balances, asset balances, or contact data — those live on your droplet.

2.4 Session cookie

When you sign in, we set an HTTP-only, Secure, SameSite cookie containing a signed JWT identifying your Blackwing account. It is used solely to authenticate your subsequent requests to our platform API.

2.5 Audit log of platform actions

We maintain an append-only audit_events table recording the platform-side actions you take through the Service — for example, “provisioned node,” “accepted Terms of Service,” “destroyed node,” “updated sidecar binary,” and similar lifecycle events. Each event records the action name, the affected resource identifier, a UTC timestamp, and the requesting user’s ID. We do not log wallet, asset, IPFS, contacts, or marketplace blob payloads — those operations execute on your droplet and are not visible to us.

2.6 Server logs and operational telemetry

Our platform API may, like any web service, log standard request metadata for operational purposes: HTTP method, request path, response status, latency, error stack traces, and the requesting user ID or IP address. We rotate these logs and retain them only as long as reasonably needed for security and reliability investigations.

2.7 Cookies and similar technologies

We use three strictly necessary cookies: the session JWT cookie (Section 2.4) and two short-lived cookies that protect the DigitalOcean OAuth sign-in flow (the state value used to defend against CSRF, and the PKCE verifier). All three are first-party, HttpOnly, Secure in production, and SameSite=Lax. We do not use third-party advertising cookies, behavioural-tracking pixels, fingerprinting, or cross-site analytics that profile you, and we do not sell or share personal information as those terms are defined under California and other US state privacy laws.

The application also stores interface state in your browser’s local storage (your selected node, your local-only address book, onboarding progress markers, mining display state). That data never leaves your device and is not used to identify or profile you.

Any future non-essential storage — such as aggregate usage measurement — is off by default in every jurisdiction and requires your opt-in; we do not rely on the weaker opt-out standard that some jurisdictions permit. We honour Global Privacy Control signals automatically. You can review or withdraw your choice at any time using Cookie Preferences in the footer of any page. A complete inventory, and the jurisdiction-by-jurisdiction detail, is in the Cookie Policy.

2.8 What lives on your droplet, not with us

Everything else — your wallet, your seed phrase, your passphrase-derived keys, your assets, your IPFS pins, your encrypted contacts, your snapshot exports, your on-chain message inbox, your local address book, your marketplace blob storage, your droplet’s audit log, your droplet’s logs, your droplet’s disks — lives on your DigitalOcean droplet, under your sole control. DigitalOcean’s own privacy practices govern that data; please consult DigitalOcean’s privacy policy for details.

2.9 Optional encrypted recovery-phrase backup (opt-in)

During onboarding you may optionally store an encrypted backup of your wallet recovery phrase with us. If you do: the phrase is encrypted in your browser using a key derived from a backup passphrase that only you know, and what reaches our servers is an opaque ciphertext blob plus the non-secret parameters your browser needs to decrypt it later. We cannot read the phrase, cannot reset or recover the backup passphrase, and cannot open the blob for anyone — including you — without that passphrase. If you forget the backup passphrase, the backup is useless; if you lose both the passphrase and your own offline copy of the phrase, your funds are unrecoverable and we cannot help. You may skip this step entirely, and you may request deletion of the stored blob at any time (Section 7).

2.10 Your wallet passphrase: end-to-end protection, and the legacy relay on older nodes

By default, your wallet passphrase no longer passes through our servers in readable form:

  • At provisioning. Your browser derives your droplet’s sidecar signing key itself (Argon2id, run locally in your browser) and sends us only that derived key for inclusion in the DigitalOcean user-data that creates your droplet. The derived key authenticates requests to your one droplet; it cannot reveal your passphrase and cannot decrypt your wallet. Your passphrase itself never leaves your browser at this step. (The user-data is transmitted to DigitalOcean’s API over TLS and handled by DigitalOcean under its privacy policy; we do not store a copy.)
  • When you authorise a signed action. For actions your node must perform with the passphrase (for example, creating a wallet, sending a transaction, or issuing an asset), your browser derives the authentication key locally and encrypts the passphrase end-to-end to your droplet using a public key your droplet publishes. What passes through our platform is an opaque encrypted envelope that only your droplet can open — we hold no key that can decrypt it.

Legacy relay (older sidecar software). Nodes provisioned before this protection shipped run sidecar software that cannot open the encrypted envelope. For those nodes — until you apply the one-click sidecar update — the passphrase you type is still sent over TLS to our platform, used in memory to derive the HMAC key that authenticates the request to your droplet, forwarded to your droplet as part of that request, and then discarded when the request ends. The same applies in your browser as a fallback if local key derivation is unavailable (for example, WebAssembly is blocked).

In every case the passphrase is never written to our database, never written to our logs, never cached, and never shared with any third party other than DigitalOcean’s API in the provisioning case described above. Our logging explicitly redacts passphrase-derived material. We cannot reproduce, recover, or reset your passphrase. Separately, if you import an existing wallet from a seed phrase through the web application, the seed words are relayed in flight to your droplet in the same never-stored, never-logged manner.

If you would prefer that no wallet secret ever transit our servers under any circumstance, you can operate your node entirely without the web application, using the open-source command-line interface or direct calls to your droplet’s sidecar, as described in Section 2A of the Terms of Service.

3. What Becomes Public On-Chain or On IPFS

Anything you do on the Ravencoin blockchain — issuing an asset, transferring, freezing, tagging, broadcasting an on-chain message, listing for atomic swap, accepting a bid, minting an NFT, casting a vote token — and anything you do on the Kaspa network — sending KAS, broadcasting payload messages or encrypted-DM envelopes, interacting with KRC-20/KRC-721 entries — is public, permanent, and pseudonymous on that chain. Anyone can inspect it. Similarly, any CID you pin and announce on IPFS becomes retrievable by anyone who learns the CID. We have no ability to redact, delete, censor, or anonymise on-chain or IPFS content. If you encode personal data, contact information, identifiers, or anything else sensitive into an asset, a transaction, a message broadcast, a qualifier tag, a service offer, an NFT, or an IPFS pin, it is published by you, and you are responsible for the privacy consequences.

4. How We Use the Information We Collect

We use the information described in Section 2 solely to:

  • authenticate you and provide the Service;
  • provision, query, and (at your instruction) destroy droplets on your DigitalOcean account;
  • pin the sidecar’s TLS certificate fingerprint and route subsequent calls to the correct droplet;
  • maintain the audit log required for security investigations and to evidence your acceptance of these Terms;
  • monitor and improve the reliability and security of the Service; and
  • comply with our legal obligations and enforce our Terms.

We do not sell, rent, or trade your personal information. We do not use it for advertising. We do not combine it with data brokers’ profiles. We do not train AI models on your data.

5. Who We Share Information With

We share information only as follows:

  • DigitalOcean receives the OAuth requests we make on your behalf at your instruction (to create, list, or destroy droplets). This is intrinsic to the Service.
  • Your droplet’s sidecar receives the requests you initiate from the front-end (e.g., to perform a wallet, asset, IPFS, or marketplace operation), authenticated over pinned TLS with HMAC.
  • Service providers strictly necessary to run the platform itself (for example, our database host, our log host, the Replit hosting environment) receive only the information needed to perform their function, under contractual confidentiality obligations.
  • Legal obligations. We may disclose information if required to do so by valid legal process or by a competent governmental authority, or if we believe in good faith that disclosure is reasonably necessary to protect our rights, the safety of users or the public, or to investigate fraud or violations of our Terms. We will challenge overbroad or unlawful demands where reasonably possible. We cannot disclose what we do not have.
  • Successor in interest. If Blackwing is involved in a merger, acquisition, or asset sale, your information may be transferred to the successor entity, subject to the same protections described here.

6. Data Retention

We retain account data, node metadata, the encrypted DigitalOcean OAuth token, and audit-log entries for as long as your account is active and for a reasonable period thereafter to comply with our legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your account by following the process in Section 7. On-chain artefacts, IPFS pins, and anything else that lives on your droplet are not within our retention scope.

7. Your Rights and Choices

Depending on your jurisdiction, you may have rights to:

  • access the personal information we hold about you;
  • correct inaccurate information;
  • delete your account information (subject to our right to retain limited records as required by law or for legitimate operational reasons such as fraud prevention);
  • object to or restrict certain processing;
  • port your information in a structured, machine-readable format; and
  • withdraw consent at any time where processing is based on consent (including by revoking our DigitalOcean OAuth token in your DO dashboard).

To exercise any of these rights, contact us through the contact channel surfaced in the Service. We will respond within the time required by applicable law. You may also have the right to lodge a complaint with your local data-protection authority.

Because the architecture is non-custodial, deleting your Blackwing account does not delete your droplet, your wallet, your assets, your IPFS pins, or any on-chain transaction. To take action on those, you must use your droplet directly, the open-source CLI, or your DigitalOcean dashboard.

8. Security

We protect the limited information we hold using industry-standard measures: TLS in transit, encryption at rest for the DigitalOcean OAuth token (Fernet, with the key never persisted to disk in plaintext), HTTP-only Secure SameSite session cookies, pinned self-signed TLS plus two-tier HMAC for sidecar communication, append-only audit logging, principle-of-least-privilege access to production systems, and regular security review. No system is perfectly secure, however, and you should follow the security guidance in our Terms of Service §3 — most importantly, never share your wallet passphrase or seed phrase with anyone, including us. We will never ask for them.

9. International Transfers

The Service is operated from the United States. If you access the Service from outside the United States, you understand that the information described in Section 2 may be transferred to, stored, and processed in the United States and in any other country where our service providers operate. By using the Service, you consent to such transfer.

10. Children

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from children. If we learn that we have inadvertently collected personal information from a child, we will delete it.

11. Third-Party Links and Services

The Service may link to or interoperate with third-party websites and services (DigitalOcean, the Ravencoin and Kaspa networks, the IPFS network, optional integrations you enable). Their privacy practices are governed by their own policies, and we are not responsible for them.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be surfaced in the Service. Your continued use of the Service after a revised Privacy Policy takes effect constitutes your acceptance of the revision.

13. Contact

For privacy questions, complaints, or to exercise your rights, contact us through the contact channel surfaced in the Service.

Bottom line: the more sovereign and non-custodial the architecture, the less data exists to misuse. Blackwing is designed so that even if we wanted to compromise your wallet, your assets, or your content — and we don’t — we would not have the technical means to do so. The trade-off is that you must safeguard your own keys and your own droplet.