Effective: 3 November 2026 · Version: pp-2026-11-03.2
Waitlist on this website (12 November 2026)
This website (clipdotfun.com) is the pre-mainnet waitlist. The sections below were written for the CLIP.FUN trading app, which is not yet on this domain. For the waitlist, the following applies instead of any conflicting statements about emails or cookies:
When you join, we store your email address; an optional role (Creator, Trader, or Both); whether you asked for product updates; the time you agreed to the Terms and this Privacy Policy; a unique invite code; and, if you arrived through a friend’s link, that referral. We also set a session cookie named cfwl_s (HttpOnly, limited to our API) so you can see your invite link and referral counts when you come back. This data is stored in the European Union by Cloudflare, Inc., on our behalf (Cloudflare Workers and D1). We use it to hold your place on the list, issue your invite link, count referrals, prevent abuse (we keep only a short-lived salted hash of your IP and browser, deleted after 30 days), and — once email sending is turned on — to send a confirmation email, a welcome email, and a notice when Clip.fun goes live on mainnet. We send product-update emails only if you opted in. Every email includes an unsubscribe link. You can ask us to delete your waitlist entry by writing to privacy@clipdotfun.com.
1. Controller
Dem's Empire, based in Slovenia, is the controller under the GDPR (Regulation (EU) 2016/679) and the Slovenian ZVOP-2. Contact: privacy@clipdotfun.com or a Discord support ticket. We have not appointed a DPO because our core activities do not involve large-scale regular and systematic monitoring (GDPR Art. 37).
2. What we process, why, legal basis and how long
| Data | Source | Purpose | Legal basis | Kept for |
|---|---|---|---|---|
| Sign-in details: your email address (email sign-in); or what Google, X or GitHub shares when you sign in with them, usually your email, name, profile picture and account ID (and your GitHub username); from X: your username, name, profile picture and account ID | you, Google, X, GitHub (through Privy) | Sign you in and keep your logins linked to one account | Contract, Art. 6(1)(b) | Held by Privy while your account exists. Our own servers do not store your email, name or profile picture from Google or GitHub; the Interface only shows them to you in your browser (for example a masked email in Profile → Security) |
| Privy account data: Privy user ID, list of linked logins and linked wallet addresses, account creation date, whether 2FA is on | Privy | Open the right account and wallet, show your linked logins and security settings | Contract, 6(1)(b) | Held by Privy while your account exists; read in your browser only |
| Wallet public addresses (your CLIP.FUN wallet and any external wallet you connect) | you, Privy | Show balances, build transactions, attribute clips, fees, points and profiles | Contract, 6(1)(b) | While your profile is active (and permanently on the blockchain, see Section 4) |
| Clips (video, title, caption, thumbnail) | you | Host and stream your clip | Contract, 6(1)(b) | Until you or we delete it, plus up to 30 days in backups |
| Profile and activity in our database: display name, profile image, X link, followers and following, likes, shares, points, quests, referral link and who referred you, boosts you bought, and launch and trade records used for points and stats | you | Social features, leaderboard, points, referral attribution, boosts | Contract, 6(1)(b) | While your profile is active; deleted within 30 days of a deletion request |
| Terms-acceptance record (Terms and Privacy Policy versions, timestamp, the boxes you ticked, a random consent ID, and your wallet address once you sign in). It contains no IP address and no browser details | your browser | Proof that you accepted the Terms | Legitimate interests (proof of contract, 6(1)(f)) and legal claims | Up to 5 years after last use |
| Random device ID, anonymous like ID | your browser | Count views and likes once, prevent fake engagement | Legitimate interests, 6(1)(f); storage strictly necessary for a service you asked for (ePrivacy Art. 5(3), ZEKom-2) | Until you clear browser storage; server copy 90 days |
| Daily-rotating one-way hash of your IP address | server | Rate limiting and abuse prevention | Legitimate interests, 6(1)(f) | 24 hours (rotates daily), aggregate counters up to 30 days |
| IP address and request logs | hosting, API and sign-in providers | Deliver the site, security | Legitimate interests, 6(1)(f) | Per provider, usually ≤ 30 days |
| Reports, notices, appeals, support tickets | you | Handle DSA notices, takedowns, complaints | Legal obligation, 6(1)(c) (DSA Arts 16, 17, 20) and legitimate interests | 2 years after closing |
| Sanctions-screening result for a wallet (match / no match), when screening is switched on: the creator wallet of a new launch is checked against public sanctions lists through Chainalysis' sanctions screening service | public lists, Chainalysis | Comply with EU sanctions | Legal obligation, 6(1)(c) | Only as long as needed for compliance, max 5 years |
We do not use advertising cookies, analytics trackers, fingerprinting or profiling for ads, and we do not run a captcha of our own. Privy may show a short Cloudflare Turnstile bot check during sign-in when its bot protection is switched on; Cloudflare then processes technical data such as your IP address and browser details only to tell people from bots. We do not sell personal data. If we add analytics or our own captcha, we will update this policy first.
3. Cookies and storage on your device
3.1 Our own storage. CLIP.FUN sets no cookies of its own. We keep these items in your browser's localStorage or sessionStorage, and only for things you asked for: Terms acceptance (clipfun_tos), the 18+ confirmation, your settings (slippage, sound, volume, display), hints and banners you closed, the wallet app you last connected, liked clips, the device ID and anonymous like ID, the referral link you arrived with, the page to return to after signing in, a note that we already offered you 2FA (so we don't keep asking), the time you last entered your 2FA code when signing in (so we don't ask again for about 24 hours, removed when you log out), an unfinished launch draft (sessionStorage, cleared when you close the tab) and a cached SOL price.
3.2 Privy's storage. To keep you signed in, Privy stores your sign-in session in your browser (in local storage and inside its own secure window, which may use its own storage or cookies). Signing out removes your session from the browser.
3.3 All of this is strictly necessary for the service, so no cookie-consent banner is needed. You can clear it any time in your browser settings; you will then need to sign in and accept the Terms again.
4. Public blockchain data
Wallet addresses and transactions are public on Solana and cannot be changed or deleted by us or anyone. A wallet address can become personal data when it is linked to you. Your GDPR rights apply to the copies we and our providers hold, not to the blockchain.
5. How Privy protects your wallet
5.1 Privy (Horkos, Inc., d/b/a Privy) runs sign-in and the CLIP.FUN wallet for us as our processor. For its own account and security systems it may also act under its own Privacy Policy (https://www.privy.io/privacy-policy).
5.2 In plain words: when your wallet is created, its private key is split into encrypted pieces (this is called key sharding). The pieces are kept in separate places, and no single piece can open the wallet. When you approve a transaction, the pieces are put together for a moment inside a secure enclave, a sealed, isolated computer that nobody can log into, and the key is wiped straight after signing. According to Privy, neither Privy nor CLIP.FUN can rebuild your key or sign without your login.
5.3 We never receive your private key, your 2FA secret or your sign-in codes. If you export your key, it is shown to you in Privy's window, not to us.
6. Processors and recipients
| Provider | Role | Location / safeguard |
|---|---|---|
| Privy (Horkos, Inc.) | Sign-in (email codes, Google, X and GitHub login), account linking, 2FA, and the wallet key infrastructure described in Section 5 | USA; DPA + SCCs |
| Google, X, GitHub | Only if you choose to sign in with them; they confirm who you are to Privy (independent controllers under their own policies) | USA |
| Cloudflare Inc. (only when Privy's sign-in bot check is on) | Turnstile bot check during sign-in | USA; EU–US Data Privacy Framework / SCCs |
| Vercel Inc. | Hosting, serverless functions, request logs | USA; EU–US Data Privacy Framework / SCCs |
| Upstash Inc. | Database (profiles, names, followers, likes, points, quests, referrals, boosts, Terms-acceptance records, vanity-key ciphertext) | Choose an EU region (Frankfurt/Ireland); DPA + SCCs |
| Video hosting provider (EU) | Video storage, transcoding, streaming | EU (Slovenia-based provider); DPA |
| Helius Labs | Solana RPC (wallet address and transactions pass through) | USA; DPA + SCCs |
| Chainalysis (only when sanctions screening is on) | Sanctions screening; receives the wallet address only | USA; SCCs |
| Discord Inc. | Support tickets (independent controller under Discord's own policy) | USA |
| Sentry (if enabled) | Error monitoring, with IP storage turned off | EU data region available; DPA |
| Authorities | Only when legally required (court orders, police, sanctions authorities) | – |
We sign a data processing agreement (GDPR Art. 28) with each processor.
7. International transfers
Some providers above are in the USA. When personal data goes outside the EU/EEA, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the EU Standard Contractual Clauses (SCCs) with extra safeguards. You can ask us for a copy of the safeguards at privacy@clipdotfun.com.
8. How long we keep data
In short: sign-in and account data stays with Privy while your account exists; profile and activity data stays while your profile is active and is deleted within 30 days of a deletion request; Terms-acceptance records are kept up to 5 years after last use; logs usually up to 30 days; support and DSA records 2 years after closing. Blockchain data stays on Solana forever.
9. Your rights
9.1 You have the right to access, rectification, erasure, restriction, portability and objection (GDPR Arts 15–21), and to withdraw consent where we rely on it. Send requests to privacy@clipdotfun.com or a Discord ticket. We answer within one month.
9.2 Deleting your account. We delete your profile and activity from our database and ask Privy to delete your sign-in account. Before you ask, move your funds out or export your key: after deletion your logins can no longer open the CLIP.FUN wallet. We cannot delete anything already on the blockchain (wallet addresses, transactions, tokens).
9.3 You can complain to the Informacijski pooblaščenec (Dunajska 22, 1000 Ljubljana, https://www.ip-rs.si) or to your local EU authority.
10. Age
CLIP.FUN is for adults (18+) only. If we learn that a minor has uploaded content, we delete it.
11. Security
TLS encryption, IP hashing, encrypted vanity keys (AES-256-GCM), least-privilege API keys, a multisig admin, wallet keys protected by Privy's key sharding and secure enclaves (Section 5), and optional 2FA with an authenticator app. We report personal-data breaches to the Information Commissioner within 72 hours where required (Art. 33), and tell you directly when the law requires it.
12. Changes
We show the date and version at the top and ask you to read material changes when you next visit.