Privacy Policy

Effective August 15, 2026

This Privacy Policy explains how Deep State Incorporated (“Deepstate,” “we,” “us,” or “our”) collects, uses, discloses, and retains information when you use deepstate.sh, the Deepstate web interface, documentation, data services, APIs, and other company-operated services that link to this policy (collectively, the “Services”).

The Deepstate Protocol is deployed on a public blockchain. Public blockchain activity is not private and is not controlled by Deepstate. We may index and display that activity as part of the Services.

1. Information we collect

Public blockchain data

When you connect a wallet or interact with the Protocol, we may process public data associated with the wallet, including:

• wallet and contract addresses;
• token balances, allowances, approvals, signatures, and transaction identifiers;
• orders, prices, quantities, fills, cancellations, claims, rewards, vault activity, and governance activity; and
• block numbers, timestamps, event logs, transaction status, and other public network data.

We index portions of this data to operate order, market, chart, reward, leaderboard, and governance views. A wallet address may be personal data under some laws when it can be associated with an individual.

Wallet and connection data

The Services may receive the wallet address, selected network, wallet type, connection status, and information necessary to prepare an RPC request or transaction. If you use WalletConnect or another wallet service, that provider separately processes information under its own privacy policy.

We do not receive or store your private key or seed phrase. Transaction signing occurs in your wallet.

Network and device data

Our hosting and infrastructure providers may process technical data automatically when your browser requests the Services, such as:

• internet protocol address;
• request time, requested URL, referring page, and response status;
• browser, device, operating system, language, and similar request-header information; and
• diagnostic, availability, security, and error information.

For application rate limiting, Deepstate derives a secret-salted SHA-256 value from the requesting IP address and stores the resulting pseudonymous key in Redis for the applicable rate-limit window. The raw address may still be processed in transient request handling or retained in provider security logs under the provider's own settings.

Cookies and local storage

When password access protection is enabled, the Services use an HttpOnly deepstate_access cookie to remember that the supplied site password was accepted. The cookie contains a signed expiration value, not the password, and is configured to expire after seven days.

The Services and wallet libraries may use browser storage or similar technologies to maintain wallet connection state, application settings, or other functionality across sessions. You can clear this data through your browser, although doing so may disconnect your wallet or reset preferences.

We do not currently use behavioral advertising cookies or sell data for targeted advertising.

Information you provide

If you contact us, report a bug, make a legal or privacy request, participate in research, or otherwise communicate with us, we receive the information you choose to provide, such as your email address, wallet address, message, and attachments. Do not send a private key, seed phrase, or other wallet credential.

The ordinary Interface does not require a Deepstate account, legal name, mailing address, or email address.

2. Sources of information

We obtain information:

• directly from you and your browser or wallet;
• from public blockchain networks and Protocol events;
• from RPC, hosting, infrastructure, database, cache, wallet-connectivity, market-data, and security providers; and
• from public sources or third parties when needed to investigate fraud, abuse, sanctions, or legal compliance.

3. How we use information

We use information to:

• provide the Interface and display balances, orders, execution history, charts, rewards, leaderboards, and governance data;
• prepare transaction requests, retrieve quotes, connect wallets, and communicate with the configured blockchain network;
• operate indexers, databases, caches, rate limits, access controls, and other infrastructure;
• diagnose errors, maintain reliability, secure the Services, prevent fraud and abuse, and enforce our Terms of Use;
• respond to support, security, legal, and privacy requests;
• understand aggregate service performance and improve functionality; and
• comply with law, legal process, sanctions obligations, and valid governmental requests.

Where applicable law requires a legal basis, we rely on performance of our contract with you, our legitimate interests in operating and securing the Services, compliance with legal obligations, and consent where we specifically request it. You may withdraw consent at any time, but withdrawal does not affect processing already completed or processing supported by another lawful basis.

4. How we disclose information

We may disclose information in the following circumstances.

Service providers

We use vendors to provide hosting, infrastructure, databases, caching, RPC access, wallet connectivity, and related technical services. Current providers may include Vercel, Railway, Neon, Redis service providers, Alchemy or another configured RPC provider, and WalletConnect. These providers process information under their own terms and privacy policies and may receive IP addresses, wallet addresses, RPC payloads, request metadata, or indexed public blockchain data as needed to provide their services.

Providers and deployment architecture may change. We require service providers to process information for authorized purposes, subject to their contractual obligations and applicable law.

Public blockchain and user-directed transactions

When you submit a transaction, the wallet and RPC provider transmit it to a public network. The resulting address, calldata, amount, asset, event, and transaction history may become permanently visible to anyone. Blockchain validators, sequencers, indexers, analytics providers, token issuers, and other network participants may independently collect and use that data.

Legal, safety, and enforcement reasons

We may disclose information when we reasonably believe disclosure is required by law, subpoena, court order, sanctions obligation, or other valid legal process; necessary to protect users, Deepstate, or others; or appropriate to investigate fraud, security incidents, unlawful conduct, or violations of our Terms.

Business transfers

Information may be disclosed or transferred in connection with a financing, audit, merger, acquisition, reorganization, bankruptcy, sale of assets, or similar corporate transaction, subject to applicable law.

At your direction

We may disclose information when you direct us to do so or provide informed consent.

We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising and do not use it to serve targeted advertisements.

5. Third-party services and issuer data

The Services connect to or display information from third-party wallets, networks, RPC endpoints, Stock Token issuers, market-data sources, block explorers, and documentation sites. Those parties may collect information independently, and their privacy policies govern their practices.

In particular, transactions involving Robinhood Stock Tokens may be visible to or processed by the token issuer, its service providers, network participants, and parties involved in eligibility, transfer controls, corporate actions, pricing, or legal compliance. Deepstate does not control those practices.

6. Data retention

We retain information only for as long as reasonably necessary for the purpose for which it was collected, including to operate and secure the Services, maintain accurate protocol views, resolve disputes, enforce agreements, and meet legal obligations.

• Rate-limit keys based on hashed IP addresses are configured to expire after the relevant rate-limit window.
• The site-access cookie expires after seven days unless you clear it sooner.
• Indexed public blockchain data may be retained for the life of the Services because historical orders, fills, rewards, charts, and governance activity depend on it.
• Security, provider, and diagnostic logs are retained according to operational needs and provider settings.
• Correspondence and legal records may be retained as needed to respond, document resolution, and comply with law.

Public blockchain records are maintained by independent network participants and generally cannot be altered or deleted by Deepstate.

7. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information processed through the Services. No internet transmission, wallet, smart contract, database, or storage system is completely secure, and we cannot guarantee absolute security.

You are responsible for securing your wallet, devices, private keys, and seed phrase. Deepstate cannot restore a wallet or reverse a blockchain transaction.

8. Your privacy rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, or a copy of personal information; to object to or restrict processing; to request portability; to withdraw consent; or to appeal a denied request. You may also have the right not to receive discriminatory treatment for exercising a privacy right.

We will respond to verified requests as required by applicable law. We may ask for information reasonably necessary to confirm your identity and authority. Because the Services generally do not maintain named user accounts, we may be unable to associate a request with technical or wallet data unless you provide the relevant wallet address or other verifiable details.

These rights are subject to legal exceptions. Deepstate cannot edit or erase data stored on a public blockchain, and deleting an indexed copy does not remove the underlying public record or copies maintained by others.

California and other U.S. state residents may request the categories and specific pieces of personal information we maintain, correction, or deletion where applicable. Deepstate does not sell personal information or share it for cross-context behavioral advertising, so there is no sale or targeted-advertising opt-out needed for our current practices.

Residents of the European Economic Area, United Kingdom, or Switzerland may also object to processing based on legitimate interests and lodge a complaint with their local data-protection authority.

To exercise a privacy right, email privacy@deepstate.sh with the subject Privacy Request.

9. Children

The Services are not directed to children. You must be at least the age of majority required to enter into the Terms of Use, and in all cases at least 18, to use the Services. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact privacy@deepstate.sh.

10. International data transfers

Deepstate and its service providers may process information in countries other than the country where you live. Those countries may have different data-protection laws. Where required, we use recognized legal mechanisms for international transfers and require appropriate safeguards from service providers.

11. Changes to this policy

We may update this policy as the Services, providers, or legal requirements change. We will post the revised policy and update the effective date. If a change materially affects how we use personal information, we will provide additional notice when required by law.

12. Contact

Questions or requests about this policy may be sent to privacy@deepstate.sh.

For other legal matters, contact legal@deepstate.sh.