Privacy Policy

DRAFT — NOT LEGAL ADVICE. HAVE A LAWYER REVIEW BEFORE PUBLISHING OR RELYING ON THIS. Placeholders like [ENTITY] must be completed, and the policy must be checked against the laws that apply to you and your users (e.g. GDPR/UK GDPR, CCPA/CPRA). It is not in force.

Last updated: [DATE] · Draft v0.1

This policy explains what information [ENTITY NAME] ("Milestone", "we") collects when you use the Milestone website and app (the "Interface"), and how we use it. Short version: we don't have accounts, we don't take custody of funds, and we collect as little as we can.

1. Information we collect

You give us:

Waitlist email. If you join the waitlist, we store your email address (and, if you choose one, whether you're a freelancer or a client) and the time you signed up.
Messages. If you email us (for example usemilestone@gmail.com), we receive your email and what you send.

Public blockchain data (not collected by us, but visible to everyone):

When you create, fund, deliver, approve, dispute or withdraw from a deal, your wallet address, the counterparty and referee addresses, amounts and timestamps are recorded permanently on a public blockchain. Anyone can see them, and neither we nor anyone else can delete them. Consider this before linking a wallet to your real identity.

Stored only in your browser:

Deal titles and milestone names you type, your theme preference and whether you joined the waitlist are stored in your browser's local storage and in the share links you create. They are not sent to our servers. Anyone you send a share link to can read the titles inside it.

Collected automatically:

Server logs. Our hosting provider ([HOSTING PROVIDER, e.g. Vercel/Cloudflare]) processes your IP address, browser user-agent and requested pages to deliver and protect the site (for example rate limiting abuse). We don't log raw waitlist emails.
Sanctions screening. Before you create a deal, the Interface checks the wallet addresses involved against a public sanctions oracle run by Chainalysis on the Ethereum blockchain. This check is a read-only query made from your browser through a public RPC provider.
Wallet and RPC providers. To read the blockchain and send your transactions, your browser connects to blockchain RPC providers and, if you use it, WalletConnect/Reown, Coinbase Wallet or MetaMask services. These providers can see your IP address and wallet address under their own privacy policies.
No advertising trackers. We don't use advertising cookies or sell personal information. [If analytics are added later, list the provider and whether it uses cookies.]

2. How we use information

to operate, secure and improve the Interface (including preventing spam, fraud and abuse);
to send you launch updates if you joined the waitlist (you can unsubscribe at any time);
to respond to your messages and security reports;
to comply with law, including sanctions laws.

Legal bases (EEA/UK): legitimate interests (security, running the Interface), consent (waitlist emails; withdraw any time), and legal obligation (sanctions compliance). [COUNSEL: confirm.]

We share personal information only with service providers who help us run the Interface (hosting, email/waitlist tooling such as [PROVIDER, e.g. Google Workspace]), when required by law, or in connection with a merger or acquisition. We don't sell or rent personal information and don't "share" it for cross-context behavioural advertising.

4. Retention

Waitlist emails are kept until launch communications end or you ask us to delete them. Server logs are kept for up to [30] days unless needed to investigate abuse. Blockchain data can't be deleted by anyone.

5. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict processing, and to withdraw consent. Email usemilestone@gmail.com. You may also complain to your local data-protection authority. We will not discriminate against you for exercising your rights.

6. Security

We use HTTPS, strict security headers, rate limiting and least-privilege access to the waitlist. No system is perfectly secure. Never share your seed phrase — we will never ask for it.

7. International transfers

We and our providers may process information in the United States and other countries. Where required, we rely on appropriate safeguards (e.g. Standard Contractual Clauses). [COUNSEL: confirm.]

8. Children

The Interface is not for anyone under 18, and we don't knowingly collect their information.

9. Changes

We'll update the "Last updated" date when this policy changes, and notify waitlist members of material changes.

10. Contact

[ENTITY NAME], [ADDRESS] — usemilestone@gmail.com.