QuantumPoolsLegal
Privacy Policy
What QuantumPools collects when you use our sites and apps, why we collect it, and the choices you have. We never collect private keys or seed phrases, and we do not sell your data.
This Privacy Policy covers quantumpools.io, app.quantumpools.io, the QuantumPools Xaman xApp, and any wallet or directory listing that links here (together, the “Services”).
QuantumPools is owner-operated by Sky (Andrew), Houston, Texas, USA. Contact: [email protected] · X: @QuantumPoolsIO. See also our Terms of Service.
1. The short version
In plain words
- QuantumPools is non-custodial. We never collect private keys, seed phrases, or wallet passwords.
- Mostly we see public blockchain data, the wallet addresses you connect or paste, and standard technical logs.
- Anything else, such as a profile handle or an alert email, is optional and only stored if you give it to us.
- We do not sell your personal data and do not run ad networks.
2. What we collect
Information you provide or connect
| Category | Examples | Why |
|---|---|---|
| Public wallet addresses | EVM 0x…, Solana, and XRPL classic addresses | To show positions and bookkeeping, and to run the vault and XRPL AMM flows you start |
| Wallet sign-in proofs | Signed login messages and nonces (EVM, SIWE-style); Xaman OAuth2 / SDK sign-in | To prove you control an address. We never receive your seed or private key |
| Optional profile | A display handle and its type (username, Telegram, Discord, WhatsApp) | Stored only if you set up a profile |
| Optional email | An address for DePeg or similar alerts | Stored only if you turn alerts on |
| Support messages | Emails you send to [email protected] | To answer you |
| Saved bookkeeping | Portfolio snapshots and Rangebook state you sync while signed in | Tied to your account so it follows you across devices |
There is no username-and-password sign-up for regular users. Accounts are created by connecting a wallet.
Information collected automatically
| Category | Details |
|---|---|
| On-chain data | Balances, LP NFTs, pool positions, transactions, and fees. This data is already public on the blockchain; we index and display it when you use Metrics, the scanners, or vaults. |
| Technical logs | IP address, timestamps, request paths, browser user-agent, and response codes, including wallet sign-in attempts. Our web server writes access logs, and Cloudflare sees client IPs for traffic it proxies. |
| Cookies | qp_sess (keeps you signed in across *.quantumpools.io) and qp_wallet (remembers your public address). Set as Secure and SameSite=Lax. We use no advertising cookies. |
| Browser storage | localStorage / sessionStorage for session tokens, your remembered wallet, bookkeeping drafts, display preferences, and WalletConnect/Reown session keys. This stays on your device unless you sync it. |
| Xaman identifiers | When you sign in with Xaman, Xaman’s SDK may link your session to a Xaman account identifier (such as a user token). We use it only to keep your wallet connected. We never receive your Xaman password or XRPL secret. |
What we do not collect
- Private keys, seed phrases, or wallet passwords
- Payment card numbers (there is no card checkout)
- Precise location (we never ask for geolocation permission)
- Government ID (not required to use the Services)
3. How we use information
- To provide, run, and secure the Services: show metrics, sync your books, and process the vault and XRPL actions you start
- To authenticate wallet sessions and prevent abuse (rate limits and origin checks)
- To keep things reliable: debugging from logs and performance tuning
- To send alerts you asked for, such as DePeg emails
- To answer support requests and security reports
- To comply with the law and enforce our Terms
Legal bases (EEA/UK, where applicable): performing our contract with you (providing the Services you request); our legitimate interests (security, abuse prevention, and product improvement); your consent (optional email alerts); and legal obligations where they apply.
4. Service providers we rely on
These providers help run the Services. Some of them receive your IP address or the requests your browser makes when you use the features they power. We will update this list when we add a material new provider.
| Provider | Role |
|---|---|
| Cloudflare | DNS, CDN, and proxy for site traffic; cookieless Cloudflare Web Analytics where enabled; edge workers for market data and DePeg helpers |
| Our web server (Caddy) | TLS, routing, and access logs |
| Xaman / XRPL Labs | XRPL wallet sign-in and transaction signing |
| Reown / WalletConnect | Mobile and desktop wallet connections |
| Safe{Wallet} | Optional use of QuantumPools as a Safe App |
| CoinGecko, GeckoTerminal, DexScreener, DexPaprika, Mobula, GMGN, Uniswap APIs | Token prices, pool data, and charts (many requests are proxied through our server, so the provider sees our IP, not yours) |
| TradingView | Chart widgets on Metrics |
| jsDelivr, cdnjs, Google Fonts | Static libraries and fonts |
| Blockchain RPC and data providers | Reading and broadcasting chain data — including PublicNode, GetBlock, the Robinhood Chain RPC, Alchemy, Helius, and Birdeye |
| XPMarket, xrpscan, and XRPL nodes | XRPL AMM pool data and live ledger reads |
The wallet apps you choose (MetaMask, Rabby, Trust, Phantom, Solflare, Crossmark, GemWallet, Coinbase Wallet, and others) have their own privacy policies, which apply when you use them. Smart-contract interactions are public on the relevant chain explorers.
6. How long we keep it
| Data | Retention |
|---|---|
| Session tokens | About 30 days, or until you sign out |
| Account, linked wallets, and synced bookkeeping | While your account exists, or until you ask us to delete it |
| Access and application logs | Only as long as needed for security and operations — typically no more than 90 days, unless a specific log is needed longer to investigate abuse or meet a legal obligation |
| Support emails | As long as needed to resolve your request and keep a reasonable record |
| Alert email | Until you turn alerts off or ask us to delete it |
| On-chain data | Permanent on the public blockchain — no one, including us, can erase it |
7. Security
We use TLS everywhere, strict security headers, origin checks on sensitive API routes, and internal services that are reachable only from our own server. No system is perfectly secure, so we keep what we collect to a minimum.
Never send your seed phrase to anyone — including us. We will never ask for it. Report vulnerabilities to [email protected] with SECURITY in the subject line (see /.well-known/security.txt).
8. Your choices and rights
- Use Metrics and the scanners view-only by pasting a public address, with no wallet connection
- Disconnect your wallet and clear site data and cookies in your browser at any time
- Sign out, which clears your session
- Turn off DePeg emails and remove your email from your profile
- Ask us to access, correct, delete, or export the personal data we hold off-chain
EEA/UK residents (where GDPR applies) have the right to access, rectify, erase, restrict, and port their data, to object to certain processing, and to complain to their local data-protection authority.
California and other U.S. state residents (where applicable) have the right to know, delete, and correct their personal information, and to opt out of its sale or sharing — which we do not do. We will never treat you differently for exercising these rights.
To make a request, email [email protected] with enough detail for us to find your data (for example, your wallet address and approximate dates). We may ask you to prove you control that wallet. We cannot delete public blockchain records or data held only by third-party wallets such as Xaman.
9. Children
The Services are not meant for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us data, contact us and we will delete it.
10. International transfers
QuantumPools is operated from the United States. If you use the Services from elsewhere, your information may be processed in the U.S. and in other countries where our providers operate (for example, CDN and RPC regions), which may have different data-protection laws than your own. Where required, we rely on appropriate safeguards or on the transfer being necessary to provide the Services you request.
11. Changes to this Policy
We may update this Privacy Policy by posting a new version with a revised effective date. For material changes, we will also post a notice on the site where practical. Continued use after the effective date means you accept the updated Policy.
12. Contact
Privacy questions and data requests: [email protected]
Operator: Sky (Andrew), Houston, Texas, USA
Related: Terms of Service · Home · App