Privacy Policy

Last updated: 12 October 2026

1. Introduction

Undersigned ("the App") is developed by MidMightBit Games, trading as ADappvark ("we", "us"). This policy explains what the App does and does not do with data. The short version: there is no account and no advertising. The App talks to public blockchain infrastructure and the Solana dApp Store's own public feed directly from your device. Two things do reach servers we run, and both are described below: anonymous usage counts (one event name per action, no identifier of any kind, switchable off in Settings, section 5B), and a few features that read from our own website API (section 5A).

2. Information We Do Not Collect

No name, email address, phone number or account
No private keys or seed phrases — the App never asks for them and cannot see them
No device identifier, advertising identifier, install id or session id
No location data — region screening (section 12) runs on-device and sends nothing
No crash reports, and no personally identifiable usage analytics. The App sends only anonymous aggregate event counts, with no identifier attached, and you can switch them off in Settings (section 5B)

3. On-Device Data Storage

The App stores, in its private app storage on your device only:

Your wallet's public address after you sign in, so you can browse without signing in again
Your signed consent record (section 4)
Your locally hidden-review list (reviews you have reported or hidden) and your follow list (apps you follow for alerts)
A cache of the public review ledger and dApp Store catalogue data you have read, so reopening the App does not require re-fetching everything, and the on-device installed-app safety-fact snapshots (certificate hash, permission set, version) used to show what changed since you last checked
Your notification preference and the timestamp of the last local ledger check, if you have opted in to alerts
A cached copy of any .skr domain name resolved for a signer, and a cache of any publisher-verification result
An install history for dApp Store apps on this device — when each was seen installed, and how many times it was reinstalled — built from the same snapshots and used only to work out how long an app has been on this phone in total
Daily snapshots of the dApp Store's own public star counts for apps you follow or open — and, only if you switch on Store watch, for every app in the store, kept for 60 days — used to show bursts of ratings; and a cache of public payments read for the payments board

Nothing is backed up to any cloud by the App (Android backup is disabled). Settings > Delete all app data erases all of it. Uninstalling the App does the same. None of this affects any review your wallet has already signed and published to the chain; see section 10.

3A. Permissions and What They Can See

The App requests four permissions of its own: INTERNET, to read the public ledger, the dApp Store's public feed and the publisher verification file; QUERY_ALL_PACKAGES, to read which apps are installed on this device together with their version, first-install time, signing certificate hash and requested dangerous permissions; only if you switch alerts on, POST_NOTIFICATIONS; and, only if you switch it on yourself in Android's settings, PACKAGE_USAGE_STATS ("usage access").

Usage access is optional and off until you turn it on in Android's system settings; the App never turns it on for you. With it on, the App reads Android's own count of how long you have used ONE app, only when you are writing a review of that app, so it can offer to add that time, rounded, to your review. It reads nothing in the background and keeps no usage record. You can turn it off again in the same settings at any time.

The installed-app information read under QUERY_ALL_PACKAGES never leaves your device, except the one rounded install-age fact you may choose to add to a review (section 4A). It is compared with an earlier snapshot held in the App's own private storage so the App can show you what changed between versions, and it is not uploaded, transmitted, sold, shared with us, or included in anything you publish. Uninstalling the App deletes it.

Five further permissions (ACCESS_NETWORK_STATE, WAKE_LOCK, RECEIVE_BOOT_COMPLETED, FOREGROUND_SERVICE, REORDER_TASKS) are contributed by the Android libraries the App uses and appear on its store listing; each is explained in the Terms. The App requests no location, camera, microphone, contacts, storage, phone or SMS permission.

4. Sign In With Solana (SIWS)

Signing in asks your wallet to sign a short consent statement. The signature, the statement, your wallet's public address and a timestamp are stored on your device as proof that you accepted the Terms. They are not sent to us. You can export this record as JSON from Settings, and delete it there.

4A. What You Publish Is Public

The App charges nothing to read or sign. If you buy the optional Pro licence, the payment and the licence record are written by your wallet to the public Solana blockchain; we hold no record of you beyond what is public there, and we cannot see who you are from it. If you choose to sign and publish a review, revocation, or reply, that record is written directly by your wallet to the public Solana blockchain, and is not something we hold or can withdraw for you.

A review can carry two optional facts from your phone, each shown to you before you sign and each one a box you can untick: how long the reviewed app has been installed on this phone in total, rounded (under a day, 1–6 days, 1–4 weeks, 1–3 months, or 3+ months); and, only if you turned on usage access, how long you have used it, rounded (under 10 minutes, 10–60 minutes, 1–5 hours, 5–20 hours, or 20+ hours). Once signed, they are public and permanent like the rest of the review. They are your phone's report, shown to readers as such; they change no score. If you are a verified publisher and sign a note on a dApp Store review of your app, that note is public and permanent in the same way. See the Terms, section 9A, and the Disclaimer, before you publish anything.

5. Network Requests and Endpoints

The App contacts these hosts, directly from your device:

Solana RPC providers — mainnet.helius-rpc.com (Helius), api.mainnet-beta.solana.com (Solana Foundation) and solana-rpc.publicnode.com (PublicNode), tried in that order. They receive the review-ledger reference address being read, the transaction signatures and transactions being fetched and decoded, the Genesis Token and staked-SKR account lookups for wallets whose reviews you are viewing, .skr domain-name lookups, and the transactions the App simulates and submits on your behalf. This is public blockchain data; the requests are how the App reads and writes it.
dappstore.solanamobile.com — the Solana dApp Store's public GraphQL feed, queried for app catalogue metadata, the store's own star-rating summary, and the store's own reviews for an app; and, only if you switch on Store watch, once a day for the star counts of every app in the store, twenty apps per request. Read-only: the App holds no store credentials and never writes to the store. The request carries the package name being looked up and nothing about you.
api.trmlabs.com — TRM Labs' public sanctions screening service, sent the connected wallet's public address before the App accepts it and before any review transaction, to check it against sanctions lists. A local copy of the OFAC SDN address list is checked first, on the device.
The website a store listing names for a publisher — when verifying a publisher's right to reply, the App fetches /.well-known/undersigned.txt from the website the dApp Store lists for that app. This request carries no data about you.
lite-api.jup.ag — Jupiter's public price feed, asked for today's price of SOL, SKR and USDC when you open the payments board. The request carries those three token addresses and nothing about you.
api.coingecko.com — CoinGecko's public price history, asked for the last year of daily SOL and SKR prices when you open the payments board, so each payment can be valued on the day it was made. The request carries only the two coin names.
arweave.net — the public Arweave gateway, asked when the dApp list is updated (when you tap Update, or on Monday mornings with Pro) for the package names the dApp Store's publisher portal has recorded there, so apps that sit in no store category are listed too. The request carries no information about you.
aardappvark.github.io — hosts these legal pages and the App's icon for the wallet approval sheet; contacted when you open a legal link or when your wallet fetches the icon.

solanaappstore.com — the dApp Store's own download host, contacted only when you tap “Check the store's build” on an app's page: the App downloads that app's install file, reads the publisher line and signing certificate from it on your device, and deletes the file.

undersigned.provenby.dev — our own website API (section 5A), used by the App for a few features only: the store-wide payments analytics on the Payments tab (the request carries the window or package being looked at and nothing about you); Suggested translation, for Pro (the record id, your App language and your wallet address, to check Pro on the public ledger); and the weekly digest, for Pro with alerts on (your wallet address, to check Pro). Everything else the App shows is read from the chain and the store directly, as listed above.
undersigned-analytics.aardappvark.workers.dev — our anonymous usage counter (section 5B). Each request carries one event name and nothing else; your IP address is seen at the edge to derive a country and is not stored.

Apart from the two hosts just named, none of these requests pass through any server we operate.
Every host you contact necessarily receives your IP address. See each provider's own privacy policy for how it handles requests.
Your wallet app (for example the Seeker's built-in wallet) makes its own network requests when it simulates and submits a transaction; those are governed by its privacy policy.

5A. The Website and API

What the App sends to our API, exactly. (a) Suggested translations and reply translations: the text to translate and the language, nothing else. (b) The docs helper in Settings: the question you type. (c) Payments analytics and review analytics: the request carries no phone fact and no identifier. (d) Quick reviews (no wallet): the signed record bytes and the quick key's public address; the server pays the network fee and keeps, for two days, a keyed daily hash of your network (never the address itself) and the quick key's address, to limit how many it relays. No request from the App carries a device identifier, your wallet's private material, or any phone fact beyond what you chose to sign.

The website and API also publish review analytics: aggregate statistics (counts, means and shares) of the dApp Store's public reviews, read from the store's public lists, and of the signed reviews on the ledger. No store review text and no wallet address is republished in those figures; the raw rows we offer carry only the app, the stars, the date, a word count and whether a .skr name was shown. If you visit the Undersigned website or call its API, a server we operate answers. The App itself calls this API only for the features named in section 5 (payments analytics, Suggested translation and the weekly digest). This is what the server holds and sees:

Public data it copies: the ledger's records (which include wallet addresses and any text their authors signed), on-chain facts about those wallets (Genesis Token, staked SKR, .skr name), the dApp Store's public catalogue, star counts and listing details, and payments received by treasuries that publishers listed. All of it is public elsewhere; the server only indexes it.
Your IP address is used to count requests against the rate limits and is held in memory only, for at most a day; it is not written to disk or to logs.
If you buy an API pass: the paying wallet's address, the payment's transaction signature, the pass key, how many requests remain and when it ends. If you create webhooks: the addresses you ask us to call, the apps you watch, and a log of deliveries kept for 30 days.
If you sign from the website: the server receives your wallet's public address to build the transaction and sends it to TRM Labs' sanctions screening, as the App does. Your wallet, not the server, signs and submits.
No cookies, no advertising, and no analytics on the website itself. (The App's anonymous counts go to a separate counter, section 5B, never to this server.) The signing pages load the wallet libraries from cdn.jsdelivr.net, which therefore sees your IP address when you open those pages.
Hidden text: where we stop the website showing a record's text, we keep the record's identifier and the reason.

Legal basis (GDPR): our legitimate interest in running and protecting the service (Article 6(1)(f)) for the public index and rate limiting; performance of a contract (Article 6(1)(b)) for API passes and webhooks. To ask about content shown on the website, use its “Report content” page.

5B. Anonymous Usage Counts

So that we can see whether the App is used at all, and roughly where, the App sends an anonymous event to a Cloudflare Worker we run (undersigned-analytics.aardappvark.workers.dev) when certain things happen: the App is opened, onboarding or the terms are completed, a wallet is connected or disconnected, a Genesis Token is found for the connected wallet, a review is signed or promoted, a review is copied for the dApp Store, a publisher claim verifies, Settings or the Pro screen is opened, a Pro licence, listing or promotion is paid (which rail, never the amount or the wallet), or the App refuses to run in a restricted region.

What is sent: the event name, and nothing else. No wallet address, no device or install identifier, no session id, no fingerprint, no app contents.
What is stored: one count per day, per event name, per country. The country is derived at Cloudflare's edge from the connecting IP address; the IP address itself is never written down. City is not recorded. Because no record relates to an identifiable person, this is anonymous data outside the GDPR (Recital 26); to the extent any processing occurs at the edge, our legal basis is legitimate interest, Article 6(1)(f).
Switching it off: Settings → “Anonymous usage analytics”. Off means nothing is sent, from the next action onward. The choice is stored on your device only.
Verification: the same aggregate totals are published at https://undersigned-analytics.aardappvark.workers.dev/public-stats, so anyone can see exactly what is counted.

6. Reading Public Data

The review ledger, the dApp Store's public catalogue, and on-chain facts such as Genesis Token ownership, staked SKR, and .skr names are all public blockchain or public API data. Reading them — including data about wallets other than your own — does not require your own wallet's involvement and reveals nothing about you beyond the network requests described in section 5.

7. Third-Party Services

Undersigned integrates no third-party analytics SDK, advertising network, crash reporter or tracking service. We do not use:

Google Analytics, Firebase, or similar analytics platforms
Advertising networks or ad SDKs
Crash reporting services (such as Crashlytics or Sentry)
Social media SDKs or login services (other than SIWS)
Push notification services — ledger alerts are local notifications scheduled on the device, triggered by the App's own periodic on-device ledger re-read; no notification service or server is involved

The only third-party code that runs in the App is the Solana Mobile Wallet Adapter client library and the seeker-verify library, both of which talk to your wallet app or to public Solana infrastructure directly.

8. Children's Privacy

The App is not directed to anyone under 18 and we do not knowingly collect information from children. It requires a Solana wallet, which itself requires adulthood.

9. Data Security

Data stays in the App's private storage on your device, protected by Android's application sandbox. Network requests use HTTPS only; cleartext traffic is disabled in the App's network security configuration.

10. Your Rights

Because we hold no personal data about you on any server, there is nothing for us to access, correct, port or erase on our side. Everything the App stores on your device is under your control: export it or delete it from Settings.

If you have signed and published a review, note, or reply, that record includes your wallet's public address — pseudonymous personal data that you chose to publish, by your own act, to a public, permanent ledger the Developer does not host or control. We can honour your right to have the App stop counting and displaying it (a revocation you sign, and a local hide), but we cannot erase the underlying chain record, and no request to us can do so. If you believe we hold personal data about you beyond what is described in this policy, contact us and we will respond within 30 days.

11. International Users

The App is developed in Australia and can be used anywhere the Sanctions policy allows. The RPC providers, the dApp Store's feed, and the sanctions-screening service listed in section 5 operate globally; your requests may be processed in the country where their servers are located.

12. On-Device Region Screening

To comply with sanctions law the App checks, on-device, the country of your SIM card, mobile network, time zone and, only if no telephony signal exists, device locale, against a list of restricted jurisdictions. The result is used only to show a block screen. No location data is stored or transmitted. See Sanctions & Restricted Regions.

13. Changes to This Privacy Policy

We may update this policy. The current version is published here with its date; a material change is presented in the App for acceptance.

14. Contact Us

MidMightBit Games, Melbourne, VIC, Australia — aardappvark@proton.me

European Union and EEA Users — GDPR

This section applies if you are in the European Union or the European Economic Area, and explains how Regulation (EU) 2016/679 (GDPR) applies to Undersigned.

Controller

MidMightBit Games, a sole trader established in Australia, is the data controller for the data described in this policy. Contact: aardappvark@proton.me. We have not appointed a Data Protection Officer; we are not required to.

Representative in the Union (Article 27)

We have not designated a representative in the Union. We rely on the exemption in Article 27(2)(a): our processing of EU personal data is occasional, does not include large-scale processing of special categories of data under Article 9 or data relating to criminal convictions under Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons. You can contact us directly at aardappvark@proton.me about any GDPR matter, and we answer in English.

What we process, and on what legal basis

Storage on and access to your device (ePrivacy, Article 5(3))

Undersigned stores settings on your device using Android's app-private storage. That storage is strictly necessary to provide the service you asked for, so it does not require separate consent. The App sets no cookies, uses no advertising identifier, no device fingerprinting and no third-party analytics SDK, and does not read information stored on your device for any purpose other than running the App.

Suggested translations and other AI suggestions

When a Pro member taps Suggested translation, the App sends Undersigned's server the review's or reply's record id, your App language and your wallet address (to check Pro on the public ledger). As with any web request, your IP address reaches the server. Nothing else is sent, and nothing is stored about you beyond ordinary server logs.

To make a suggested translation, a suggested summary of an app's reviews, a suggested note about an app update, or an answer from the developer docs helper, the server sends the relevant public text (review and reply text already public on the Solana blockchain, store release notes, our published docs, or a developer's question) to Anthropic, which runs the Claude model, and stores the answer so the same text is not sent again. Your wallet address and IP address are not sent to Anthropic. Every such output is labelled a suggestion made by AI, and none of it changes a review, a weight or a score.

Transfers outside the EEA

We are established in Australia, which is not the subject of an adequacy decision under Article 45. The App sends us data only when a Pro member asks for a suggested translation (the record id, the App language and the wallet address, above). Public text sent to make AI suggestions goes to Anthropic, established in the United States, which processes it for us under its commercial terms; it carries no wallet address or IP address. The RPC providers, the dApp Store's public feed, and the sanctions-screening service the App contacts directly (section 5) are independent controllers of the requests they receive; Helius Labs, Solana Mobile Inc. and TRM Labs are established outside the EEA and their own privacy policies describe the safeguards they apply. The requests carry a public wallet address or a public transaction, and your IP address, and nothing else.

Retention

Data on your device is kept until you delete it, clear the App's data, or uninstall the App. We operate no user accounts and hold no profile of you. Content you publish to the chain is retained by the Solana network indefinitely, independently of the App and of us.

Your rights

You have the rights of access (Article 15), rectification (16), erasure (17), restriction (18), data portability (20) and objection (21), and the right to withdraw consent at any time where consent is the basis. Because your data lives on your device and we hold no identifier for you, you exercise most of these directly: the data is visible in the App, and clearing the App's data or uninstalling it erases it. Content you have published to the public ledger is outside our custody or control, and the erasure right cannot compel its removal from the chain; the App instead offers the revocation and hide mechanisms described in section 10. For anything else, email aardappvark@proton.me — we respond within one month, free of charge.

There is no automated decision-making producing legal or similarly significant effects, and no profiling within the meaning of Article 22. Deterministic score ranking is not automated decision-making about you: it ranks apps, not people, from data anyone can independently verify on-chain.

Complaints

You have the right to lodge a complaint with the supervisory authority of your Member State of residence, place of work, or of the alleged infringement (Article 77). A list is published by the European Data Protection Board at edpb.europa.eu. We would appreciate the chance to resolve it first.