This Privacy Policy explains what information Onchain Drive ("the Platform", "we" or "us") collects when you use the onchaindrive.app website and related services, how we use and share it, and what choices you have. This Policy applies together with our Terms of Service.
In short: your files are encrypted in your browser before they leave your device, so we cannot see their contents or names. We do not ask for your name, email, phone number or other identity information; your wallet address is your account on the Platform.
1. Information we collect
1.1 Wallet address: when you sign in with your wallet, we record your wallet address, the time you first used the Platform, your most recent sign-in time and the number of sign-ins.
1.2 Orders and payments: when you place an order, we record its details (number of files, total size, storage period, each fee and the payment method), the quote and the order status. After payment, we record the paying wallet address, the transaction hash and the payment time. If a refund is made, we also record the refund transaction.
1.3 Encrypted files and metadata: file contents and file names are encrypted in your browser before upload. Our servers store the encrypted file name, file size, upload time, expiry, blobId, storage object ID, the related order and similar information. For large files uploaded in chunks, we also store the file key encrypted with your key, which our servers cannot decrypt. We cannot see file contents or plaintext file names.
1.4 Key check value: the first time you unlock, your browser derives a check value from your key and sends it to our server, so we can confirm that later unlocks use the same key. This value cannot be used to recover your key or decrypt your files.
1.5 Share records: when you create a share link, we record the share ID, the file it points to, the encrypted file name, the creation time, the expiry, the revocation time and the download count. The decryption key after the "#" in a share link is never sent to our servers.
1.6 Reports: when someone reports a share through the share page, we record the reason and any description the reporter provides. The reporter may choose to attach the share link's decryption key, which lets an administrator decrypt and review the reported file. To prevent duplicate reports, we store an irreversible digest derived from the reporter's IP address, not the IP address itself.
1.7 IP addresses and request information: all traffic passes through Cloudflare, which processes your IP address, browser type and other request information. We limit request rates by IP address or wallet address to prevent abuse; the counting is done by Cloudflare and is not written to our database. Our service logs may contain technical information such as request times, URLs and error messages, which we use for troubleshooting.
1.8 Operational records: actions taken by administrators on accounts, files, reports and orders (such as bans, takedowns and refund records) are written to an audit log, which may include the related wallet addresses and the reasons for the action.
2. Cookies and browser storage
2.1 Sign-in cookies: after you sign in, we set a session cookie valid for 7 days that contains your wallet address and keeps you signed in. During sign-in we also set a one-time verification cookie valid for 10 minutes. These cookies are necessary for the service, cannot be read by page scripts, and are not used for advertising or cross-site tracking. Signing out ends the session immediately.
2.2 Local storage (localStorage): stores your chosen language, the wallet you last used, and whether you agreed to analytics. This stays in your browser.
2.3 Session storage (sessionStorage): when you open a share link, the decryption key in the link is moved from the address bar into this tab's session storage so it does not stay in your browsing history. It is cleared when you close the tab and is never sent to our servers.
2.4 When analytics is on, Google Analytics stores cookies and other identifiers in your browser to distinguish visitors. See Section 3.
2.5 Your encryption key is derived in your browser from a wallet signature. It is kept only in the page's memory, never written to any storage and never uploaded.
3. Analytics
3.1 We use Google's Firebase Analytics (data is held in Google Analytics) to understand how the website is used and improve the product. We record which pages are viewed, which buttons are clicked, language switches, and whether steps such as connecting a wallet, signing in, unlocking, selecting files, ordering, paying, uploading, downloading, sharing and renewing succeed or fail. Event parameters are limited to numbers such as counts and file size ranges, and short fixed labels; a successful payment also records the Platform's internal order number and the amount.
3.2 We never send wallet addresses, file contents, file names or the keys in share links to the analytics service: page addresses always have everything after "#" and "?" removed, and share IDs are replaced. We have turned off Google signals and ad personalization. As with any web request, Google receives your IP address and browser information and processes them under Google's privacy policy.
3.3 Analytics is not loaded on share download pages or the admin console. If your browser sends a Global Privacy Control or Do Not Track signal, we do not collect analytics.
3.4 You can opt out: click "Decline" on the notice when you first visit, or click "Turn off analytics" in the footer at any time. Once turned off, no new analytics data is collected; you can turn it back on at any time.
4. How we use information
4.1 To provide the service: sign-in, showing your file list, downloads, sharing, calculating quotes, verifying payments, and carrying out uploads and renewals.
4.2 For security and abuse prevention: rate limiting, handling reports, banning accounts or taking down files, and investigating failures and anomalies.
4.3 To improve the product, based on anonymous analytics.
4.4 To comply with the law: meeting legal obligations or responding to lawful requests from competent authorities.
4.5 We do not sell your personal information and do not use it for advertising.
5. Third-party services and sharing
5.1 The Platform relies on the following third-party services, which process the information needed to provide their services under their own privacy policies:
Cloudflare: website hosting, server code, database, rate limiting and network connections.
Walrus storage network: encrypted files are stored on independent nodes in the Walrus network operated by third parties. Uploads normally go through our own upload node (running on a cloud server we rent); on testnet, if that fails, uploads may fall back to public upload nodes run by the community. When you pay with SUI to upload large files, your browser sends the encrypted data directly to the official Walrus upload relay and connects to a Sui full node. These nodes and the relay only see encrypted data.
Blockchains and node providers: payments and storage registrations take place on the Base and Sui blockchains. Our servers read onchain transactions and contract state through public or paid RPC node providers.
Wallet software: sign-in signatures, unlock signatures and payment transactions are completed in your own wallet, which handles the related information under its own policies.
Google: analytics, see Section 3.
5.2 Apart from the above, we disclose information only when required by law, when cooperating with lawful investigations by competent authorities, or when necessary to protect the security of the Platform and its users.
5.3 The servers of these services are located in many countries and regions, so your information may be processed outside the country or region where you live.
6. Data on blockchains and Walrus is public
6.1 Blockchain transactions are public and permanent, and anyone can view them. When you pay, the paying wallet address, the amount, the time and the order's billing information (such as the number of files and the product of file size and storage period) are recorded onchain.
6.2 Encrypted data stored on Walrus, together with its blobId, size and storage period, is public. Anyone can download the encrypted data, but it cannot be decrypted without the key.
6.3 This data is outside our control. We cannot delete transactions from a blockchain or delete stored encrypted data from the Walrus network; the encrypted data remains until the end of its storage period.
7. Retention
7.1 We keep account, order, file, share and report records for as long as needed to provide the service, resolve disputes, carry out security reviews and meet legal obligations. When you remove a file from your list, the related records are kept for operational review.
7.2 Our database has automatic point-in-time backups, which are kept for up to 30 days.
7.3 Encrypted data on Walrus is kept until the end of its storage period; blockchain transactions are kept permanently.
7.4 Analytics data is kept for the retention period we have set in Google Analytics.
8. Security
8.1 Files are encrypted in your browser with AES-256-GCM, each with its own random key. Your master key is derived in your browser from a wallet signature, kept only in the page's memory and never uploaded. Our servers, our upload node and the Walrus nodes only ever handle encrypted data.
8.2 The website uses HTTPS throughout, with a content security policy and other security headers. Sign-in signatures expire and can be used only once, session cookies cannot be read by page scripts, and the admin console requires administrators to sign in with their wallets.
8.3 No system can guarantee absolute security. Keep your wallet safe, only sign on onchaindrive.app, and be careful when forwarding share links: anyone with the complete link can decrypt the file.
9. Your choices and rights
9.1 Access: after signing in, you can view your files, share links and orders in "My files".
9.2 Revoking shares and removing files: you can revoke share links or remove files from your list at any time. A removed file no longer appears and its share links stop working, but the Platform keeps the related records (see Section 7), the encrypted data stays on Walrus until the end of its storage period, and onchain records cannot be deleted.
9.3 Analytics: you can turn it off or back on at any time, see Section 3.
9.4 Browser data: you can sign out, or clear this site's cookies and local storage in your browser settings.
9.5 Stopping use: you can stop using the Platform at any time. During the storage period, you can retrieve and decrypt your files directly from the Walrus network with the blobId and your original wallet, without going through the Platform.
9.6 If the laws where you live give you other rights, such as to access, correct or delete personal information, we will handle your request to the extent technically feasible and required by law.
10. Minors
The Platform is not intended for minors. We do not collect age or other identity information and do not knowingly collect personal information from minors. If you have not reached the age of majority in your country or region, do not use the Platform.
11. Changes to this Policy
We may update this Policy. Updates will be posted on this page with a new date. Continuing to use the Platform after an update means you accept the updated Policy.
12. General
12.1 This Policy is available in Chinese and English. In case of any inconsistency, the Chinese version prevails.
12.2 Please submit content complaints and reports of unlawful content through the "Report" option on the file share page.