01
who this covers
this policy covers the ondisplay.app website and the on display. collector app provided to invited testers. the app is in development, with no public download yet. features and sign-in methods may be available only to selected testers.
on display. operates this service and handles privacy requests at support@ondisplay.app.
02
visiting the website
you can visit the website without an account or wallet. the website currently uses no analytics scripts, advertising pixels, embedded social feeds or non-essential cookies. its display preview runs in your browser.
cloudflare delivers and protects the website. it processes connection and request information such as your ip address, browser information, requested pages and request times. links to x and other external sites open those services, whose own privacy notices apply.
if you email us, we receive your email address, message and any attachments you choose to send. proton mail provides our support inbox. do not send recovery phrases, private wallet keys or sign-in codes.
03
accounts and sign-in
an account is not required for public collection browsing. if you create an account or link a sign-in method, supabase provides authentication and stores your account identifier, connected provider identities and the email address or phone number supplied through that method. verification and security records may include sign-in times, ip addresses and delivery or error information.
email codes are delivered through resend. phone verification, where enabled for testing, uses twilio verify and mobile carriers. these services receive the destination and information needed to deliver and protect the verification process.
apple sign-in can provide your apple account identifier and your chosen real or relay email address. google sign-in, when available to you, can provide a google account identifier, email address and basic profile information such as a name or profile image. this is used to authenticate you, link sign-in methods and maintain your account. we do not request gmail, drive or contacts access.
x sign-in and linking, where enabled, use your x identifier, username, basic profile information and email where you authorize access. the authentication provider can also request read-post and offline-access permissions as part of its default scope. on display. does not use those permissions to read or analyze your timeline. it does not request posting or direct-message permissions.
provider identity data is stored with the account in supabase. account sessions and any provider tokens returned as part of those sessions are handled by the authentication service and may be retained in the app’s protected device session storage. we do not use google or x account data for advertising, sale, timeline analysis or ai model training. access is limited to account operation, service providers supporting that operation, necessary support and security, and legal obligations.
you can revoke a social provider’s access in that provider’s account settings. revoking provider access does not itself delete an on display. account or its saved content. account removal is a separate request.
04
wallets, collectibles and public data
when you look up a public wallet or collectible, the app sends the relevant public address, asset identifier and network request to blockchain nodes, indexers, metadata hosts or marketplaces. these include helius, supported solana rpc services, publicnode, blockscout, opensea and magic eden. artwork may load directly from its creator’s host or an ipfs or arweave gateway. these services can receive your ip address and request information even if you have not created an account.
wallet connection and proof features use public addresses, connection sessions and signed messages to check control of a wallet. the app does not ask for or collect recovery phrases or private wallet keys. wallet connection session secrets are different from the keys that control your assets and are stored on the device for the connection.
supported marketplace, minting, storage-payment and transfer features process the relevant public wallet, asset, proposed action, quote and transaction details through our backend and the selected provider. pricing and routing may use jupiter or other providers identified in the transaction review. your external wallet must approve the transaction. submitted transactions and signatures are visible on the relevant public blockchain and may also be indexed by other services.
public blockchain data can be linked to a person when combined with an account or other identifying information. disconnecting a wallet or deleting an account cannot erase blockchain history or copies maintained independently by other services.
06
device storage and account sync
when signed in, supported displays, favorites, saved collections, collection-page drafts and curation settings synchronize through your private account workspace. saved activity, mint reminders and private acquisition or sale records you choose to enter are stored with your account. guest work, unuploaded source files, exports and some pending wallet operations remain on the device. ordinary image and video exports are rendered locally, without sending the display to a rendering service; sharing sends the export to the destination you choose.
account and connected-wallet sessions use protected storage on supported native devices and have expiry checks. local curation and selected media use app storage. synchronization status distinguishes pending local work from confirmed online saves; an unsynchronized draft or local file is not an online backup.
the app uses system media pickers for content you select and requests photo-library access when needed to save an export. permissions can be managed in your device settings. local files, exports and device backups can have different lifetimes from an online account.
07
why we use this information
we use account and profile information to provide the features you request, authenticate access, save published content and respond to support requests. where european data-protection law applies, our basis is performance of our agreement with you, or steps you request before that agreement.
we use necessary connection, verification and operational records to prevent abuse, investigate errors and protect accounts and the service. our basis is our legitimate interest in a secure, reliable service, balanced against your rights. legal obligations can require specific records to be retained or disclosed. where a feature requires consent under applicable law, you can withdraw that consent without affecting earlier lawful processing.
providing account or publication information is optional, but we cannot provide the corresponding account or sharing feature without the information it needs. public browsing remains available without an account. we do not make solely automated decisions with legal or similarly significant effects about you.
08
service providers and international processing
we use cloudflare for website delivery and protection, supabase for authentication, database and media storage, resend for account email, proton mail for correspondence, and twilio verify for enabled phone verification. apple, google, x and external wallet providers operate the sign-in or wallet service you choose. blockchain nodes, indexers, marketplaces and media hosts process the collection requests described above. stripe processes supported card payments, while apple or google processes purchases made through its enabled in-app checkout. we receive purchase identifiers, plan, payment status and entitlement records needed to provide access, reconcile refunds and prevent duplicate claims; full card details are handled by the payment provider.
information is shared with service providers to operate these functions, with other people when you publish content, and where required by applicable law. we do not sell account information or use google or x user data for targeted advertising.
our providers may process information outside your country. processing locations and applicable safeguards depend on the service involved. contact support@ondisplay.app for information about the providers, processing locations and transfer arrangements relevant to your information.
if you enable notifications, we store a device push token or browser push subscription with your account and notification preferences. delivery uses apple push notifications, firebase cloud messaging where configured on android, or your browser’s push service. you can turn notifications off in the app and device settings. notification content may appear on a lock screen.
permanent artwork storage is a separate, explicit action. selected artwork and metadata are sent through ardrive turbo to arweave, together with upload identifiers and payment or credit records. permanent public storage cannot be removed by closing an on display. account. do not submit private information for permanent publication.
09
retention and removal
account and published-profile information is kept while your account remains open and needed to provide the service. after a verified closure request, we remove personal account and profile data and owned uploaded media that are no longer needed, except identified records required by law or needed for an active dispute or security investigation.
we keep ordinary support correspondence for up to 12 months after the request is resolved, then delete it unless a specific legal obligation or active dispute requires longer retention.
operational, authentication, delivery and security records are used to operate the service, investigate faults and protect accounts. provider log and backup retention periods vary by service and plan. removing live account data does not necessarily remove it immediately from these records or backups; those copies remain until the applicable rotation or deletion process completes. account deletion follows a verified request and may pause for unresolved financial operations or records that must be retained. the account screen shows progress and any action needed. there is no automatic inactive-account purge.
public blockchain records cannot be deleted by us. local files and exports remain on your device or chosen destination until removed there. public-media caching and independent copies are described above.
10
your choices and privacy requests
you can edit supported profile fields, change profile visibility, disconnect a wallet and revoke social-provider access. account settings provide data export and a verified account-deletion request. you can also contact support@ondisplay.app for access, correction, deletion or help with a request. deleting your on display. account does not delete your external wallet, blockchain records or another provider’s account. apple or google subscriptions must also be managed in the relevant store account settings.
we may ask for proportionate information to confirm that a request is yours. we will never ask for a recovery phrase, private wallet key or sign-in code. where applicable, you can also request restricted processing, object to processing based on legitimate interests, withdraw consent or request data portability.
where european data-protection law applies, we respond without undue delay and normally within one month; if a lawful extension is necessary, we explain it within that first month. you can complain to the data-protection authority where you live, work or believe an infringement occurred. these rights can have legal exceptions, which we will explain when relevant.
11
children and policy changes
if you have a concern about a child’s personal information in the service, contact support@ondisplay.app so it can be reviewed and appropriate action taken.
we will date revisions to this policy and explain material changes before applying them where required. new features or new uses of provider data may require additional notice or permission. this policy does not announce a public app release.