1. Who We Are
Rug Cleaner is an independently operated project based in Switzerland. For this beta, Rug Cleaner determines why and how the personal data described in this Policy is processed. In data-protection terminology, Rug Cleaner is the controller.
Privacy requests: support@rugcleaner.io. General and legal enquiries: info@rugcleaner.io.
2. Information We Process
Submitted blockchain data
- Token mints, wallet or pool addresses, transaction signatures, and search terms
- Requested analysis settings, scan identifiers, and generated risk or status labels
- Public token, transaction, holder, liquidity, and wallet-pattern data
Blockchain addresses and transactions are publicly available, but they may constitute personal data when reasonably linked to an identifiable person. Rug Cleaner analyzes addresses and transactional patterns without claiming the natural-person identity or legal ownership behind an address.
Technical and usage data
- Request time, route, status, latency, cache, degradation, and service-health events
- Short-lived request, trace, rate-limit, and diagnostics identifiers
- IP address, browser or device information, referrer, and coarse network signals where available
- Page, feature, and performance events needed to operate and debug the Service
Information not collected at launch
At launch, Rug Cleaner does not create user accounts, collect payment credentials, build marketing profiles, maintain persistent user portfolios, or create customer-specific identity, ownership, compliance, or investigation dossiers. We do not request private keys, seed phrases, wallet passwords, or custody credentials. We may retain privacy or support correspondence and deliberately isolated security-incident records for the periods described in this Policy.
3. How We Use Information
- Provide token analysis, market intelligence, reports, and visualizations you request
- Retrieve current public blockchain, market, liquidity, and macroeconomic data
- Secure the Service, enforce rate limits, investigate incidents, and prevent abuse
- Diagnose failures, validate models, improve reliability, and reduce false results
- Meet applicable legal obligations and respond to lawful requests
Depending on applicable law, these purposes rely on service delivery, our legitimate interests in operating and protecting the beta, legal obligations, or consent where it is specifically required. Rug Cleaner does not sell personal data or use it for cross-site advertising.
4. Providers and Sharing
Rug Cleaner uses a small number of material services to operate the beta: infrastructure hosted in Germany; Cloudflare for delivery, security, performance, and network-error reporting; and server-side blockchain and market-data services to provide the analysis you request. These services receive only the technical information or public blockchain identifiers needed for their function. A visitor's browser normally communicates only with Rug Cleaner and Cloudflare; scan enrichment happens server-to-server.
Macroeconomic and reference sources, such as FRED, central banks, agencies, exchanges, and public market endpoints, receive server requests for general series, symbols, or market observations. Rug Cleaner does not send them a submitted wallet address merely because they supply macro or reference data.
Messages sent to Rug Cleaner addresses are processed by the email service used for those mailboxes.
Rug Cleaner maintains an internal provider and transfer register and reviews a material recipient before enabling it for public use. We will update this Policy before materially changing a recipient category or international destination. Information may also be disclosed to advisers, authorities, or other parties where reasonably necessary to protect the Service, enforce terms, or comply with law.
5. Retention
| Rug Cleaner-controlled data | Retention |
|---|---|
| Successful raw scan context | 7 days |
| Failed or aborted scan context | 24 hours |
| Granular wallet, transaction, holder, creator, and holder-snapshot evidence | 30 days |
| Minimized token-level analysis and token or market snapshots | 365 days |
| Ordinary application, nginx, Docker, Loki, and tracing logs | 14 days |
| Evidence isolated for a security incident | Up to 90 days after incident closure |
| Encrypted backups | 14 days in staging; 30 days in production; restore-test workspaces 24 hours |
| Completed and failed queue records | 1 hour for completed; 24 hours for failed |
| Genuinely de-identified aggregate or research evidence | Indefinite, with an annual necessity and linkability review |
Data may be retained longer when preservation is legally required or reasonably necessary for an active security investigation. Expired live data ages out of encrypted backups through the normal backup-rotation period.
These periods govern copies controlled by Rug Cleaner. Cloudflare, Helius, and other providers may retain their own operational records under their contracts and policies; Rug Cleaner cannot directly delete those provider-controlled copies.
6. Security and Tracking
- Encrypted transport, access controls, secret management, and bounded/redacted logs
- Application-layer encrypted backups and tested restore procedures
- Security monitoring, dependency checks, incident handling, and release gates
First-party rc_trace_id and rate-limit identifiers may last up to 24 hours. Production cookies use Secure and SameSite=Lax; server-only rate-limit cookies also use HttpOnly. Rug Cleaner does not use marketing cookies or cross-site advertising trackers at launch.
Cloudflare's edge security, Web Analytics/RUM, and Network Error Logging are separate from Rug Cleaner's first-party application telemetry. Details are in the Operational Analytics Notice.
7. Your Rights and Choices
Subject to applicable law, you may request access, correction, deletion, restriction, objection, or a portable copy, and may complain to a competent data-protection authority. You may also ask for information about recipients and cross-border safeguards.
Because the beta is anonymous, Rug Cleaner may be unable to connect a person to a record. For an address-specific request, we may ask for proportionate proof of control, such as a signed message, only where reasonably necessary. We do not request a passport by default, and signed-message verification material is not retained beyond verification unless a documented legal or security need requires it. Control of an address does not prove the natural person's identity or legal ownership.
Rug Cleaner does not sell or share personal information for cross-context behavioural advertising. Because browsers do not implement Do Not Track consistently, the Service does not treat that signal as a universal deletion request. We honor Global Privacy Control and comparable legally recognized opt-out signals where applicable. Browser privacy settings may also reduce optional browser analytics.
8. International Transfers
Rug Cleaner is operated from Switzerland and its primary application server is in Germany. Cloudflare operates a global network, including in the United States. Server-side blockchain and market-data services may also process the public identifiers needed for an analysis in the United States. A service is not enabled for public use until its relevant destination and transfer position have been reviewed. If that review identifies another destination, this Policy will be updated before the service is enabled. Rug Cleaner does not treat provider terms alone as a transfer safeguard or claim Data Privacy Framework or standard-contractual-clause coverage unless the applicable entity and mechanism have been verified.
Deleting Rug Cleaner's copy does not delete information recorded on a public blockchain or information independently retained by a third-party provider under its own legal duties, contracts, or policies.
9. Automated Analysis
Rug Cleaner automatically scores tokens and market conditions. Outputs may be automated, statistical, heuristic, or deterministic; they can be wrong and are not decisions that produce legal or similarly significant effects about a natural person. A token, wallet, address, or cluster label is not a claim about a person's identity, intent, legal ownership, guilt, or compliance status.
10. Children and Changes
The Service is intended for adults aged 18 or older and is not directed to children. If you believe a child has submitted personal data, contact us so we can assess and respond.
We may update this Policy as the beta changes. For a material change, we will publish a conspicuous notice in the Service before or when the change takes effect and update the last-updated date above.
11. Contact Us
For privacy-related requests, contact support@rugcleaner.io with the subject Privacy Request. Information requests under Swiss law are generally answered within 30 days; other requests are handled within the period required by applicable law, including any lawful extension or reason we cannot act.
For general and legal enquiries, contact info@rugcleaner.io.
Where Swiss data-protection law applies, you may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC). Other competent authorities may apply depending on your location and the law governing the processing.