Privacy Policy

Effective date: May 25, 2026 · Last updated: May 25, 2026

Plain-English summary: Blackwing is built to not collect personal data wherever possible. We never see your wallet passphrase, your seed phrase, your private keys, your encrypted contacts, the contents of your IPFS files, or anything you sign on your droplet. We do receive a DigitalOcean OAuth token (encrypted at rest, used only to provision and manage your droplets at your instruction), an email/display name from DigitalOcean, a session cookie, and an audit log of platform actions you take. That’s essentially it.

This Privacy Policy describes how Blackwing (“we,” “us,” “our”) collects, uses, and discloses information about you when you use the Blackwing web application, APIs, command-line interface, sidecar binary, cloud-init scripts, and related services (the “Service”). It should be read together with the Terms of Service.

1. What We Do Not Collect

By design, Blackwing does not receive, store, log, escrow, transmit to any third party, or have any technical means of recovering:

  • your wallet passphrase (used to derive the sidecar’s sign-tier HMAC key on your droplet via Argon2id);
  • your seed phrase (mnemonic) — generated and displayed only in your browser during the wizard;
  • any wallet private keys or signing keys derived from them;
  • your encrypted contacts — encryption and decryption happen entirely in your browser using a key derived from your wallet passphrase via PBKDF2-SHA256; we see only opaque ciphertext;
  • the contents of files, folders, NFT metadata, ballots, on-chain message payloads, or other artefacts you pin to or serve from your droplet’s IPFS node;
  • your droplet’s root SSH keys, if you supplied your own; if we generated one for you, we transmit it once in the provisioning response and do not retain it; and
  • the plaintext of any signed partial-transaction blob, bid, service offer, or other artefact you produce on your droplet.

2. What We Do Collect

2.1 DigitalOcean account information (from you, via OAuth)

When you sign in with DigitalOcean, we receive from DigitalOcean: your DigitalOcean user ID, email address, and display name. We use this to create and maintain your Blackwing account.

2.2 DigitalOcean OAuth token (from DigitalOcean, with your consent)

We receive a DigitalOcean OAuth access token and refresh token with read write scope, which we use solely to provision, query, and (at your instruction) destroy droplets on your DigitalOcean account. The token is encrypted at rest using a Fernet (AES-128-CBC + HMAC-SHA256) key held only by our platform process, and is never exposed to any third party. You can revoke this token at any time in your DigitalOcean dashboard, which immediately ends our ability to act on your DO account.

2.3 Node metadata (from you, when you provision)

For each droplet you provision through the Service we store: your chosen region, size, label, snapshot mode, pruned mode preference, the droplet’s public IPv4 (or Tailscale IP, if applicable), the SHA-256 fingerprint of the sidecar’s TLS certificate (so we can pin it for subsequent calls), the wallet_initialized_at timestamp, sync progress counters reported by ravend, the status lifecycle field, and timestamps for creation, readiness, and last heartbeat. We do not store any wallet content, RVN balances, asset balances, or contact data — those live on your droplet.

2.4 Session cookie

When you sign in, we set an HTTP-only, Secure, SameSite cookie containing a signed JWT identifying your Blackwing account. It is used solely to authenticate your subsequent requests to our platform API.

2.5 Audit log of platform actions

We maintain an append-only audit_events table recording the platform-side actions you take through the Service — for example, “provisioned node,” “accepted Terms of Service,” “destroyed node,” “updated sidecar binary,” and similar lifecycle events. Each event records the action name, the affected resource identifier, a UTC timestamp, and the requesting user’s ID. We do not log wallet, asset, IPFS, contacts, or marketplace blob payloads — those operations execute on your droplet and are not visible to us.

2.6 Server logs and operational telemetry

Our platform API may, like any web service, log standard request metadata for operational purposes: HTTP method, request path, response status, latency, error stack traces, and the requesting user ID or IP address. We rotate these logs and retain them only as long as reasonably needed for security and reliability investigations.

2.7 Cookies and similar technologies

We use a small number of strictly necessary cookies: the session JWT cookie (Section 2.4) and any short-lived state cookies required for the OAuth flow (e.g., the OAuth state value used to defend against CSRF). We do not use third-party advertising cookies, behavioural-tracking pixels, fingerprinting, or cross-site analytics that profile you.

2.8 What lives on your droplet, not with us

Everything else — your wallet, your seed phrase, your passphrase-derived keys, your assets, your IPFS pins, your encrypted contacts, your snapshot exports, your on-chain message inbox, your local address book, your marketplace blob storage, your droplet’s audit log, your droplet’s logs, your droplet’s disks — lives on your DigitalOcean droplet, under your sole control. DigitalOcean’s own privacy practices govern that data; please consult DigitalOcean’s privacy policy for details.

3. What Becomes Public On-Chain or On IPFS

Anything you do on the Ravencoin blockchain — issuing an asset, transferring, freezing, tagging, broadcasting an on-chain message, listing for atomic swap, accepting a bid, minting an NFT, casting a vote token — is public, permanent, and pseudonymous on the Ravencoin chain. Anyone can inspect it. Similarly, any CID you pin and announce on IPFS becomes retrievable by anyone who learns the CID. We have no ability to redact, delete, censor, or anonymise on-chain or IPFS content. If you encode personal data, contact information, identifiers, or anything else sensitive into an asset, a transaction, a message broadcast, a qualifier tag, a service offer, an NFT, or an IPFS pin, it is published by you, and you are responsible for the privacy consequences.

4. How We Use the Information We Collect

We use the information described in Section 2 solely to:

  • authenticate you and provide the Service;
  • provision, query, and (at your instruction) destroy droplets on your DigitalOcean account;
  • pin the sidecar’s TLS certificate fingerprint and route subsequent calls to the correct droplet;
  • maintain the audit log required for security investigations and to evidence your acceptance of these Terms;
  • monitor and improve the reliability and security of the Service; and
  • comply with our legal obligations and enforce our Terms.

We do not sell, rent, or trade your personal information. We do not use it for advertising. We do not combine it with data brokers’ profiles. We do not train AI models on your data.

5. Who We Share Information With

We share information only as follows:

  • DigitalOcean receives the OAuth requests we make on your behalf at your instruction (to create, list, or destroy droplets). This is intrinsic to the Service.
  • Your droplet’s sidecar receives the requests you initiate from the front-end (e.g., to perform a wallet, asset, IPFS, or marketplace operation), authenticated over pinned TLS with HMAC.
  • Service providers strictly necessary to run the platform itself (for example, our database host, our log host, the Replit hosting environment) receive only the information needed to perform their function, under contractual confidentiality obligations.
  • Legal obligations. We may disclose information if required to do so by valid legal process or by a competent governmental authority, or if we believe in good faith that disclosure is reasonably necessary to protect our rights, the safety of users or the public, or to investigate fraud or violations of our Terms. We will challenge overbroad or unlawful demands where reasonably possible. We cannot disclose what we do not have.
  • Successor in interest. If Blackwing is involved in a merger, acquisition, or asset sale, your information may be transferred to the successor entity, subject to the same protections described here.

6. Data Retention

We retain account data, node metadata, the encrypted DigitalOcean OAuth token, and audit-log entries for as long as your account is active and for a reasonable period thereafter to comply with our legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your account by following the process in Section 7. On-chain artefacts, IPFS pins, and anything else that lives on your droplet are not within our retention scope.

7. Your Rights and Choices

Depending on your jurisdiction, you may have rights to:

  • access the personal information we hold about you;
  • correct inaccurate information;
  • delete your account information (subject to our right to retain limited records as required by law or for legitimate operational reasons such as fraud prevention);
  • object to or restrict certain processing;
  • port your information in a structured, machine-readable format; and
  • withdraw consent at any time where processing is based on consent (including by revoking our DigitalOcean OAuth token in your DO dashboard).

To exercise any of these rights, contact us through the contact channel surfaced in the Service. We will respond within the time required by applicable law. You may also have the right to lodge a complaint with your local data-protection authority.

Because the architecture is non-custodial, deleting your Blackwing account does not delete your droplet, your wallet, your assets, your IPFS pins, or any on-chain transaction. To take action on those, you must use your droplet directly, the open-source CLI, or your DigitalOcean dashboard.

8. Security

We protect the limited information we hold using industry-standard measures: TLS in transit, encryption at rest for the DigitalOcean OAuth token (Fernet, with the key never persisted to disk in plaintext), HTTP-only Secure SameSite session cookies, pinned self-signed TLS plus two-tier HMAC for sidecar communication, append-only audit logging, principle-of-least-privilege access to production systems, and regular security review. No system is perfectly secure, however, and you should follow the security guidance in our Terms of Service §3 — most importantly, never share your wallet passphrase or seed phrase with anyone, including us. We will never ask for them.

9. International Transfers

The Service is operated from the United States. If you access the Service from outside the United States, you understand that the information described in Section 2 may be transferred to, stored, and processed in the United States and in any other country where our service providers operate. By using the Service, you consent to such transfer.

10. Children

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from children. If we learn that we have inadvertently collected personal information from a child, we will delete it.

11. Third-Party Links and Services

The Service may link to or interoperate with third-party websites and services (DigitalOcean, the Ravencoin network, the IPFS network, optional integrations you enable). Their privacy practices are governed by their own policies, and we are not responsible for them.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be surfaced in the Service. Your continued use of the Service after a revised Privacy Policy takes effect constitutes your acceptance of the revision.

13. Contact

For privacy questions, complaints, or to exercise your rights, contact us through the contact channel surfaced in the Service.

Bottom line: the more sovereign and non-custodial the architecture, the less data exists to misuse. Blackwing is designed so that even if we wanted to compromise your wallet, your assets, or your content — and we don’t — we would not have the technical means to do so. The trade-off is that you must safeguard your own keys and your own droplet.