Privacy policy

What the service stores, and why.

Account information

Sidewave stores your account name, email address or mobile number if supplied, password hash when you set a password, verification state, linked Google account identifier, linked public wallet addresses and policy acceptance. Google login shares your Google account identifier, verified email and basic profile with Sidewave; Sidewave does not request access to your Gmail, contacts or files. Phone login sends your mobile number and verification requests to Alibaba Cloud Phone Number Verification Service. Sidewave does not store SMS code values. Temporary SMS request metadata and keyed rate-limit records are used to prevent abuse and are removed after expiry; a verified phone identity is retained as part of your account. Session cookies keep you signed in and help protect requests against forgery. Sidewave does not request or store wallet recovery phrases or private keys.

Website and advertising data

The service stores website domains, ownership verification, ad placements, campaign creatives, destinations, budgets, delivery events and review decisions. Approved creative content is public when served as an advertisement.

Growth-network data

The service stores project details and owners, domain verification, participation controls, exclusions, review decisions, launch interests, applications and event schedules. Approved, verified, promotion-enabled project details are public in the network and eligible recommendation cards. Account email addresses, verification tokens, private review notes and participation controls are not included in the public project response.

Recommendation measurement

The website embed creates a random identifier in the source website’s sessionStorage, with a 24-hour expiry. It is local to that source origin and browser session. The embed sends it when requesting a recommendation. Application delivery records use a keyed daily hash scoped to the source origin for duplicate checks, alongside source and target project identifiers, origins, URLs, event times and validation state. This mechanism does not create a persistent cross-site user profile.

Recommendations use signed, short-lived delivery tokens; an unviewed reservation expires after 10 minutes. Clicking a recommendation records a click and adds a signed referral token to the destination URL. The optional arrival script removes that token from the visible URL and reports a page load and a subsequent visible-time signal. Arrival attribution expires 30 minutes after the click. Without the arrival script, Sidewave cannot record those destination signals. These view, click and arrival records describe observed events; they do not certify a real person, unique visitor, conversion or incremental customer.

Network requests also pass through the hosting infrastructure. IP addresses are used for request rate limits, and infrastructure logs may retain request URLs and other operational information. Network project, delivery and audit records remain in the service database for operation and review; token expiry stops attribution or delivery validity and does not itself delete historical event records.

Advertising traffic quality

The application uses the requesting IP address and browser user agent to make a daily keyed fingerprint for basic duplicate-event detection. Ad records store that fingerprint, the verified website origin and event timing. This implementation does not use cross-site advertising identifiers or behavioral audience profiles. Hosting and payment providers may separately retain operational logs.

Payment records

Wallet addresses, selected networks, invoices, conversion evidence, ledger entries and withdrawal records are needed to process and reconcile payments. Payment information is shared with the configured crypto payment provider when you use that service. Connecting through WalletConnect also communicates with its wallet connection infrastructure.

Retention and access

Expired sessions and authentication tokens are removed by scheduled maintenance. Account, campaign and financial records remain in the service database for operation, dispute handling and applicable recordkeeping. Contact the operator to request access, correction or deletion. Records that must be retained for financial or legal obligations may be excluded from deletion.

Service providers

The operator uses infrastructure and payment providers to run the service. Provider locations and availability depend on the operator’s deployment and merchant configuration. Contact the operator for the list that applies to your account.