Privacy Policy

Last updated:

1. Controller

2. General information & hosting

This website (pestdao.xyz) and the member app (app.pestdao.xyz) are operated on a third-party web host. Each request processes technically necessary connection data (see section 3). The member app's data is stored on our self-operated Nextcloud instance in Germany (cloud.schaefer-betz.de). No data is shared with third parties for advertising or tracking purposes.

3. Server logs

When you access the site, the hosting provider automatically stores information in so-called server log files that your browser transmits:

• IP address (truncated/anonymised after a short period)
• Date and time of access
• Requested URL and HTTP status code
• Browser type and operating system
• Referrer (previously visited page, if transmitted)

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in stable, secure operation of the website). Retention: typically 7 days, then automatically deleted. No merging with other data sources takes place.

4. Cookies & session

The landing page (pestdao.xyz) sets no cookies. The member app uses exclusively a strictly necessary session cookie (PEST_SESSION), which keeps you logged in after authentication. The cookie is HttpOnly, SameSite=Lax and only valid over HTTPS. It contains no personal data, only a random session identifier. It is removed on logout or, at the latest, when you close your browser.

Legal basis: § 25 (2) (2) TDDDG (technically required for a service explicitly requested by the user) in conjunction with Art. 6 (1) (b) GDPR (contractual necessity).

5. Member app (login, account, content)

The member app is only accessible with credentials issued by an administrator. We process:

• Username (freely chosen) and password (stored only as a bcrypt hash — we cannot see your plaintext password)
• Community nickname (visible to other members inside the app)
• Self-entered content: referral links, pinned projects, token watchlist, votes cast in in-app polls

This data is stored on the Nextcloud instance mentioned above as a JSON database. An automated backup is created weekly and retained as needed. No data is shared with third parties.

Legal basis: Art. 6 (1) (b) GDPR (contractual necessity — providing the app to registered members).

6. Fonts (self-hosted)

We use the typefaces "Chakra Petch" and "JetBrains Mono". These are served exclusively from our own server and are not loaded from external providers (in particular, not from Google Fonts). No connection to Google or any other third-party font CDN is established when you visit the site. Your IP address is not transmitted to Google in connection with fonts.

7. External APIs (CoinGecko)

To display current token prices inside the member app, our server pulls aggregated price data from the CoinGecko API once every 5 minutes. Your browser does not communicate directly with CoinGecko — it only requests our cached dataset. Your IP address is therefore not transmitted to CoinGecko during normal use of the app.

8. Embedded content / external links

On the website and inside the app, we link to external sites (e.g. X/Twitter, Discord, Telegram, project websites). Clicking such links transmits data to the operators of those services. Those providers are responsible for that data processing. We do not embed third-party content (videos, iframes) on our website.

9. Your rights

Under GDPR you have, at any time, the right to:

• Access the data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data ("right to be forgotten", Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)

For any of these requests, an informal email to info@pestdao.xyz is sufficient.

10. Data deletion & retention

Server logs are deleted after a maximum of 7 days. Member data (account, content) is stored as long as your access is active. On request, we delete your account and all linked data within 30 days — a short email is enough. Backups are deleted as part of their rolling lifecycle.

11. Right to complain

You have the right to lodge a complaint with your local data-protection authority if you believe the processing of your data violates the GDPR. The authority responsible for us is: