Privacy Policy

• We sell digital access keys and email them to you once your crypto payment confirms.
• We collect the email you provide and order metadata (pack, host, amount, tx hash/ID, network).
• We do not collect private keys or card data (we don’t take cards).
• Support messages are sent via EmailJS; keys are sent via our email provider.
• We don’t sell personal data. Limited cookies/analytics help us run the site.

• Order data: email, selected host & pack, amount/asset, network, tx hash/ID, confirmation status.
• Support data: your contact email and any info you include (e.g., tx link, refund address) via our form.
• Basic device data: IP, approximate location, user agent (standard server logs/analytics).

• Deliver keys: email your key when the blockchain confirms payment.
• Support: look up orders, fix payment mismatches, issue adjustments/refunds.
• Security & fraud prevention: detect abuse and keep systems stable.
• Legal compliance: respond to lawful requests and meet obligations.

• Crypto payments are processed on-chain. We store addresses and tx hashes to match payments to orders.
• We never control or collect your wallet’s private keys.
• Transactions are public by design; anyone can view them on block explorers.

• Essential: session/basic cookies to keep the site working.
• Analytics: privacy-respecting analytics to understand traffic and uptime (no ad tracking).
• You can block cookies in your browser, but some features may not work.

• Email delivery: we use an email provider to send keys and receipts.
• Support (EmailJS): support form submissions are sent via EmailJS to our support inbox.
• Hosting & infrastructure: cloud providers host the app and logs.
• We don’t sell personal data.

• Order and support records are kept for as long as needed for operations, accounting, and regulatory purposes.
• You can request deletion of personal data that we’re not required to keep; see “Your Rights.”

• Access, correction, deletion, and portability (where applicable: GDPR/UK GDPR/other local laws).
• Object or restrict certain processing where applicable.
• We do not sell personal data (CCPA/CPRA “Do Not Sell/Share” not applicable).
• To exercise rights, contact support from the email tied to your order.

• We use industry-standard safeguards and least-data practices.
• No system is perfectly secure; please keep your wallet and email secure.

Only.Exchange is not intended for children under 13 (or older, where local law requires). Do not use the service if you are under the applicable age.

We may update this Privacy Policy. The “Last updated” date will change. Your continued use of Only.Exchange means you accept the updated policy.

Data controller: Only.Exchange. For questions, requests, or complaints, contact support or email support@only.exchange.