Privacy Policy — ccprime

// 01 · Scope

What this policy covers.

This policy covers ccprime.xyz, operated by Blueprint Infrastructure, LLC ("Blueprint", "we", "us") — the wallet interface, the trading interface, the public market endpoints and the authenticated API.

It does not cover the Canton Network itself, which is a public ledger: anything settled on it is public by the network's design, readable by anyone, and beyond anyone's ability to delete. It also does not cover the third parties named in § 06, each of which has its own policy.

The controller of the data described here is Blueprint Infrastructure, LLC. [[OPERATOR: EU/UK representative and any DPO, if one is appointed]]

// 02 · What the platform stores

Every record, named.

This is the complete list of records the service keeps about an account. Each row names the fields actually stored.

Record	Fields stored	Why
Account	Email address (if you give one, and whether it is verified), display name, avatar image, plan, admin and suspension flags, creation timestamp	To have an account at all, and to bill the right plan
Passkey credentials	Credential id, public key, signature counter, transports, a nickname you choose, created and last-used timestamps	To recognise your passkey on sign-in
Sessions	A hash of the session token, the account it belongs to, creation / expiry / last-seen timestamps, the browser user-agent string, and the IP address the request arrived from	To keep you signed in, and to let you see and revoke your own sessions
Two-factor	TOTP secret and enabled flag; recovery codes stored only as hashes	Only if you enable two-factor authentication
Linked sign-ins	Provider name, the provider's user id, the email that provider reported, and an avatar image copied and re-hosted here	Only if you link Google, GitHub or Microsoft
API keys	A hash of the key, a short display fragment (prefix and last four characters), label, plan, active flag, created and last-used timestamps, and a request counter	To authenticate calls. The key itself is not recoverable from what is stored
Usage	Request counts per key, per account, per endpoint, per minute / hour / day. Counts only — never request bodies, parameters or responses	Rate limits, quotas, and the usage charts on your account page
Billing	Your Stripe customer, subscription and checkout-session identifiers, and the plan they correspond to	To keep your subscription and your plan in step
Wallet party	Your Canton party id, your wallet's public key in hex, onboarding status, and the topology hashes issued during onboarding	To bind one party to one account, and to verify that you hold the key you claim
Portable vault	Opaque ciphertext, its initialisation vector, which passkey credential wrapped it, a salt version, a version counter — plus one previous generation of the same	So you can restore your wallet on another device. See § 03
Sends	The prepared hash, your party, the receiving party, asset, amount, status, ledger update id, error text, timestamps	So a transfer whose outcome is unknown can be reconciled rather than guessed at
Orders	Side, instrument pair, price, amount, status, timestamps	The order journal
Outbound email	Recipient address, subject and body of account mail queued for sending (verification links, quota notices)	To send account mail reliably
Admin actions	An append-only trail: the acting administrator's id and email, the action, the affected account, and a detail string	So an administrative change to an account is never invisible

About IP addresses

Your IP address is used for rate limiting and is stored on your session record so you can recognise your own sessions. Before it is used or stored it is reduced to a rate-limit identity: an IPv6 address is collapsed to its /64 network, an IPv4 address is kept exact. The value taken is the one the fronting web server observed, not one a client can set for itself.

What is public regardless

A Canton party id, its transactions and its balances are public chain data. ccprime prints party ids in full and links records to a public explorer precisely so you can verify them independently. Anyone who learns your party id can read its history, from any explorer, whether or not they use ccprime.

// 03 · What the platform never receives

The list that matters most.

[ the vault, precisely ]

The wallet backup this service stores is your seed already encrypted in your browser, under a key derived from your passkey's WebAuthn PRF output. The PRF output never leaves your device, so the ciphertext is opaque to us by construction — not by policy, and not by a promise not to look.

The endpoint that receives it accepts only that form. A backup wrapped any other way is rejected outright, because any other wrapping would be one we could conceivably unwrap.

None of the following is ever sent to, derived by, or stored on our servers:

Your wallet seed or private key. The 32-byte Ed25519 seed is generated in your browser and is never transmitted in the clear.
The passkey PRF output — the key that unwraps the vault.
Your 24-word recovery phrase. It is displayed in your browser and nowhere else.
Your recovery passphrase, and the local backup it encrypts. Both stay in your browser's storage on the device that created them.
Your passkey, fingerprint, face or PIN. WebAuthn gives a server only a credential id and a public key; the authenticator keeps everything else.
Your account password — there is none.
Card or bank details. Payment happens on Stripe's own hosted surfaces; we keep only the identifiers listed in § 02.
Your Ethereum key or wallet contents. The USDC deposit route runs entirely through your own wallet software; this site makes no Ethereum network call.
A balance we hold. The platform holds none, of anything, for anyone.

There is also no analytics, advertising, fingerprinting, or cross-site tracking of any kind, and no data broker relationship. The page loads no third-party script origin at all — a constraint enforced by the site's Content-Security-Policy, because script execution on this origin would be equivalent to compromising every wallet on it.

// 04 · What your own browser stores

The wallet lives on your device.

Most of what makes ccprime work is held by your browser, not by us: the encrypted wallet seed in IndexedDB, the salt its wrapping key is derived from, your wallet's public key, your privacy-veil preference, and — only if you create one — a passphrase-encrypted backup of the seed.

Every item is listed by name, with what it holds and how to remove it, in the Cookies & Local Storage notice. Read it before you clear this site's data: doing so deletes the wallet from that browser.

// 05 · Why we process it

Each purpose, and nothing beyond it.

Provide the service: Authenticate you, keep you signed in, bind one Canton party to one account, serve balances and history, and let you restore a wallet on a new device.
Bill and support plans: Run subscriptions through Stripe and keep your plan, quota and fee tier consistent.
Protect the service: Rate limits, quota enforcement, bot checks at registration, session revocation, and an audit trail of administrative changes.
Account communication: Email verification and account notices. Non-transactional account mail is sent only to a verified address.
Legal obligations: [[OPERATOR: statutory retention or reporting obligations that apply, if any]]

We do not sell personal data, do not share it for advertising, and do not use it to train models.

[[OPERATOR: legal bases for processing, and which privacy regimes you are electing to comply with — e.g. GDPR Art. 6 grounds, UK GDPR, CCPA/CPRA]]

// 06 · Who else is involved

Every third party that can see anything.

Party	What reaches them	When
Stripe	Your email address and payment details, which you give directly to Stripe's own hosted checkout	Only if you subscribe to a paid plan
Cloudflare Turnstile	A bot-check challenge in your browser	Only when the challenge is enabled, at registration
Google, GitHub, Microsoft	A standard OAuth exchange returning your identifier at that provider, your email, and an avatar	Only if you choose to sign in with, or link, one of them
Amazon SES	The recipient address and contents of account email	When account mail is sent
ccscan.xyz a Blueprint product	Your Canton party id — sent by our servers, over TLS, to read the chain. Party ids are public chain data	Whenever your balance or history is read
Cantex api.cantex.io	The instruments and amount a quote is for. Sent by our servers under our credentials — no account identifier of yours is included	Whenever a route is priced
Your Ethereum wallet	Everything the USDC deposit route does, which happens entirely in your browser through your own wallet software	Only if you use that route
Circle, onRails, BitSafe	Whatever their own service requires. We are not a party to it	Only if you use their deposit route

Beyond these, data is shared only with the infrastructure providers that host the service, and where we are legally required to disclose it. We would also disclose it to a successor in the event of a merger or sale of the business.

[[OPERATOR: hosting provider and region(s), and the basis for any international transfer]]

// 07 · How long it is kept

The retention actually implemented.

Sessions: Expire 30 days after sign-in by default; expired rows are deleted automatically, about hourly. Revoking a session deletes it immediately.
Per-minute usage: Deleted after 2 hours.
Per-hour usage: Deleted after roughly 50 hours.
Daily usage: Retained for the life of the account. These are counts, not content.
Vault, previous generation: The displaced ciphertext from your last vault overwrite is kept 30 days so an accidental overwrite is recoverable by you, then discarded.
Account records: Kept for as long as the account exists, and deleted with it.
Outbound email queue: Queued messages are not linked to the account record and are not removed by account deletion. [[OPERATOR: retention period for the outbound email queue]]
Admin audit trail: Append-only, and retains the acting administrator's email and the affected account id after that account is deleted. [[OPERATOR: retention period for the admin audit trail]]
Database backups: Backups are taken on a schedule to private object storage and pruned beyond 30 days. A deleted record can persist in a backup until that backup ages out. [[OPERATOR: backup storage location and encryption-at-rest arrangement]]
Market price history: Up to 730 days. Contains no personal data.

// 08 · Deletion and control

What you can do yourself.

From your account page, without asking us:

See and revoke sessions — individually or all at once.
Manage passkeys — add, name, remove.
Rotate or revoke API keys, at any time.
Change your display name and avatar, and enable or disable two-factor authentication.
Export your usage as CSV.
Delete the account. This removes the account record and, by cascade, sessions, passkey credentials, API keys, recovery codes, linked sign-ins, the wallet party record, orders, sends and the stored vault ciphertext.

Directly against the API, without deleting the account:

DELETE /api/wallet/vault — removes the stored vault backup and its previous generation, leaving the account intact.
POST /api/auth/oauth/<provider>/unlink — unlinks a Google, GitHub or Microsoft sign-in.

[ before you delete ]

Deleting your account deletes the backup, not the wallet. Your Canton party and everything at it survive, because they were never ours — but if the stored ciphertext was your only copy and you do not have the 24-word recovery phrase, the wallet becomes unreachable. Nobody can undo that. Take the phrase first.

Anything already settled on Canton MainNet is on a public ledger and cannot be deleted by us or by anyone.

// 09 · How it is protected

The measures that are actually in place.

Secrets are stored as hashes, not as values: session tokens, API keys, recovery codes and email-verification tokens are all kept only in hashed form.
The session cookie is HttpOnly, Secure, SameSite=Lax, and carries the __Host- prefix over HTTPS — so script on the page cannot read it and another host cannot set it.
The site runs under a self-only Content-Security-Policy: no third-party script origin, no CDN, no hosted fonts, no remote images. Framing is refused outright.
The application server is not reachable from the internet directly, runs unprivileged, and can reach nothing but its own database.
The database role is not privileged and is isolated from the sibling Blueprint products' data.
Avatar images from a linked sign-in are copied and re-hosted here rather than loaded from the provider, so viewing a page does not report back to them.

No system is perfectly secure, and we do not claim ccprime is. The security model has been designed deliberately and reviewed internally, including adversarial review; it has not been audited by an independent third party.

If you find a vulnerability, please report it privately to security@theblueprint.xyz before disclosing it.

// 10 · Your rights

What you can ask for.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to the processing of your personal data, to portability, and to withdraw consent. The account page implements access, correction and deletion directly; for anything else, write to the contact below and we will respond within [[OPERATOR: response window for privacy requests]].

[[OPERATOR: which privacy regimes apply, the rights granted under them, and the supervisory authority a complaint may be made to]]

The service is not directed at children, and accounts require the minimum age stated in the Terms.

// 11 · Changes and contact

How this document moves, and who to write to.

We may update this policy. The "last updated" date at the top always reflects the current version, and material changes will be reflected there.

Entity: Blueprint Infrastructure, LLC
Registered address: [[OPERATOR: registered business address]]
Privacy contact: [[OPERATOR: privacy contact email]]
Security reports: security@theblueprint.xyz
Company: theblueprint.xyz