Privacy Policy

• We sell digital access keys for filehosts and email them to you once your crypto payment confirms on-chain.
• We collect the email you provide and order metadata (pack, host, amount, asset, network, tx hash/ID, status).
• We do not collect private keys, seed phrases, or card data (we don’t accept cards).
• Support messages are sent via EmailJS; keys and receipts are sent via our email provider.
• We don’t sell personal data. Limited cookies/analytics help us operate and protect the site.

• Order data: email, selected host & pack, amount/asset, network, payment address, tx hash/ID, confirmations, and delivery status.
• Support data: your contact email and any info you include (e.g., transaction link, refund address, screenshots) via our support form.
• Basic device data: IP address, approximate location, user agent, and similar technical logs (standard server/infra logging).

• Deliver keys: email your premium key when the blockchain shows the required confirmations.
• Support: look up orders, resolve payment mismatches, verify TX hashes, and issue adjustments/refunds where applicable.
• Security & fraud prevention: detect abuse (e.g., repeated charge abuse, suspicious traffic) and keep our infrastructure stable.
• Legal compliance: respond to lawful requests and meet regulatory and accounting obligations.

• Crypto payments are processed directly on public blockchains. We store payment addresses and tx hashes to match transactions to your order.
• We never request or store your wallet’s private keys or seed phrases. You stay in control of your wallet.
• Blockchain transactions are public by design; anyone (including us) can view them via block explorers.

• Essential: session/basic cookies that help the site function (e.g., remembering filters or basic state).
• Analytics: privacy-respecting analytics to understand traffic, detect downtime, and improve performance. We don’t use ad networks for retargeting.
• You can block cookies in your browser, but some functionality may degrade or stop working.

• Email delivery: we use an email service to send keys, receipts, and some notifications.
• Support (EmailJS): support form submissions are processed by EmailJS and forwarded to our support inbox.
• Hosting & infrastructure: cloud providers host the app, databases, and logs.
• We don’t sell your personal data to third parties.

• Order and support records are retained for as long as needed for operations, accounting, dispute handling, and legal compliance.
• You can request deletion of personal data that we’re not required by law or legitimate interest to keep; see “Your Rights & Choices.”

• Depending on your location, you may have rights to access, correct, delete, or receive a copy of your personal data.
• You may also have rights to object to or restrict certain processing under GDPR, UK GDPR, or similar laws.
• We do not “sell” personal data as defined by CCPA/CPRA; “Do Not Sell/Share” is not applicable to our use of data.
• To exercise rights, contact support from the email address tied to your order so we can verify you.

• We use industry-standard safeguards, limited data retention, and access controls to protect stored data.
• No online service is perfectly secure. Keep your email account and crypto wallets secure, and never share your keys or seed phrases.

Only.Exchange is not intended for children under 13, or any higher age where local law requires parental consent. Do not use the service if you are under the applicable age.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change. Your continued use of Only.Exchange means you accept the updated policy.

Data controller: Only.Exchange. For privacy questions, rights requests, or complaints, contact support or email support@only.exchange.