Privacy Policy

Last updated: October 22, 2026

TokenPool (“we”, “us”) operates the websites, APIs, desktop client and seller client at tokenpool.cc and its subdomains (together, the “Service”). This policy explains what information we collect when you use the Service, how we use it, who we share it with, and your rights.

1. Information we collect

Account and sign-in

• Wallet sign-in: your wallet address and the message you sign to log in. The signature only proves your identity; it does not create an on-chain transaction.
• Google sign-in: Google provides us with your account’s unique identifier, email address, name and profile picture. We store only the unique identifier, to recognize your TokenPool account. We do not store your email address, name or picture.
• Sign-in sessions, devices you register, and the settings you enter in your profile.

Transactions and funds

• Deposit addresses assigned to you, on-chain transaction hashes, deposit and withdrawal records, and withdrawal destination addresses.
• Balances, ledger entries, orders, settlements, refunds and appeal records.

API usage

• API keys you create and their settings, such as budgets.
• Metering data for each request: time, model, token counts, cost, status and error codes.
• Request content: by default we do not store the prompts, responses, images or other content you send through the API, nor the authentication headers or keys in requests. To fulfil a request, its content is relayed in real time through our gateway to the seller node that runs it, which sends it to the corresponding model provider. See section 3.

Sellers

• Seller node and device information, channel configuration, capability verification results, reputation and earnings records.

Technical information

• Operational logs such as IP address, request time, client type and error details, used for security, rate limiting and troubleshooting. Sign-in rate-limit counters store only one-way hashed digests, never raw IP or wallet addresses.

Cookies

• We use only cookies strictly needed to sign in, such as a temporary cookie that lasts 5 minutes during Google sign-in. We do not use advertising cookies or any third-party analytics or tracking tools.

2. How we use information

• To provide and maintain the Service: authentication, request matching, metering and billing, settlement, and processing deposits and withdrawals.
• For security and risk control: preventing fraud, abuse and attacks, enforcing rate limits and investigating anomalies.
• To handle appeals, disputes and support requests.
• To meet legal obligations and send necessary service notices.

We do not sell your personal information or use it for advertising.

3. Sharing

We share information only in these cases:

• Seller nodes and model providers: to run your API requests, their content is relayed to the seller node that runs the request and to the upstream model provider that node uses. They handle that content under their own policies.
• Blockchain networks: deposits and withdrawals happen on a public blockchain (BNB Smart Chain). Transaction addresses, amounts and times are recorded publicly and permanently. Anyone can see them and we cannot delete them.
• Infrastructure providers: for example, blockchain node providers we use to read on-chain data, and server and network providers. They process only the data needed to provide their services to us.
• Google: the authentication exchange with Google when you use Google sign-in.
• Legal requirements: when required by applicable law, court order or a lawful request from authorities, or to protect the safety and rights of the Service, our users or the public.
• Business transfers: in a merger, acquisition or asset transfer, information may be transferred as part of the transaction. We will require the recipient to keep honoring this policy.

4. Google user data

TokenPool uses Google sign-in only to verify your identity. Of the information Google provides, we store only your account’s unique identifier, to link your Google account to your TokenPool account. We do not access any other data in your Google account. We do not transfer or sell Google user data to third parties, use it for advertising, or use it to train artificial intelligence or machine learning models.

TokenPool’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke TokenPool’s access at any time on your Google Account third-party connections page. After that you can no longer sign in with that Google account, but other sign-in methods you have linked keep working.

5. Retention

• Operational logs: kept online for 90 days, then in an encrypted archive for 1 year.
• Bills, ledger entries, on-chain transaction links, settlement and refund records: kept permanently, and moved to an encrypted archive two years after creation. They are needed to reconcile balances, resolve disputes and prevent duplicate payments.
• Fund approvals, usage reviews and audit evidence: kept for at least 7 years.
• Data related to a dispute, recovery claim or legal hold is kept until the matter ends.
• Account information is kept while your account exists.
• Records on a blockchain are kept permanently by the network and are outside our control.

6. Security

We protect your information with HTTPS encryption in transit, access controls, multi-factor authentication for administrators and audit logs of operations. Archived data is stored encrypted. Our servers hold no wallet private keys for custody of funds. No system is perfectly secure, so please keep your wallet, API keys and sign-in credentials safe.

7. Your rights

Depending on the laws where you live, you may have the right to:

• access and obtain a copy of your personal information;
• correct inaccurate information;
• link or unlink sign-in methods on your account page;
• ask us to delete your account and personal information, except records we must keep by law or to reconcile funds (see section 5);
• object to or restrict certain processing.

To exercise these rights, email support@casualmine.com. We may need to verify your identity first, and we will reply within a reasonable time.

8. Children

The Service is not intended for anyone under 18. If we learn we have collected a minor’s information, we will delete it.

9. International transfers

Our servers and providers may be located outside your country or region, and your information may be processed there. We take reasonable steps to protect it.

10. Changes

We may update this policy from time to time and will announce material changes on the website. Continuing to use the Service after an update means you accept the updated policy.

11. Contact

Email: support@casualmine.com