Privacy Policy

• You sign in with a nostr public key. We don’t require your name, email, phone number or ID.
• Burns are public by design: the npub a burn is credited to and its amount are written into the Bitcoin blockchain, or listed in a batch’s public manifest whose fingerprint is on the blockchain. Neither can be undone.
• We use no cookies, ads or analytics trackers, and we don’t sell personal data.

• Your nostr public key (npub). It is your account: we use it to sign you in and to credit burns. We also keep when you first and last signed in, and whether you created your key in Burnyt.
• Your public nostr profile. The name, picture, bio, website, NIP-05 address, Lightning address and social links you publish on nostr, including a WhatsApp number if you add one. All of them are optional. We copy them from relays when you sign in or edit your profile on Burnyt, and check your NIP-05 address with its domain about once a day. Profile edits you make on Burnyt are published to nostr. Social links you add on Burnyt stay on your Burnyt profile until you remove them here, even if another nostr app leaves them out when it saves your profile.
• Burns and payments. Amounts, their USD value at the time, fees, payment addresses, Lightning invoices, transaction IDs, status and dates, plus gift recipients, your choice to hide yourself as a gift’s payer, and whether to post a certificate. We need these to take payments, make burns, show your history, keep accounts and resolve problems. We don’t record the address you pay from.
• Claims. When you claim a burn made elsewhere: the burn, your npub, any npub you credit it to, and the signed proof with the addresses that funded it.
• Security records. An audit log of important actions, such as payment requests and admin actions. It records your npub and can include payment addresses and gift recipients’ npubs. The database refuses any change or deletion once an entry is written.
• Technical data. Your IP address, used to limit abuse. We use it as a counter key for about a minute, and keep a keyed fingerprint of it (not the address itself) with your unpaid payment requests while they are open: up to about an hour for on-chain requests and about a day for Lightning and USDT. Our cache can keep these entries in its on-disk log for a while after they expire. Our server logs also record your IP address, your browser’s user agent and the addresses of the pages and API calls you request, which can include an npub.
• Error reports. If error tracking is switched on and the website hits an error, our error-tracking service (Sentry) receives the error, the page path, your browser’s user agent and recent activity on the page (clicks, page changes, network requests and console messages). We remove sign-in tokens, cookies, form contents, query strings and your IP address first. Page paths are kept and can contain a public npub or transaction ID.
• Mobile app. If you use our mobile app, we keep your device’s notification token and settings so we can notify you and, if you use it with a remote signer, what we need to wake it when a signature is requested.

We use this data to provide the service you ask for, to keep it secure and to meet our accounting and legal obligations.

A burn’s npub is written into the Bitcoin transaction or listed in the batch’s public manifest; for a gift, that is the recipient’s npub. Profiles, burn history, the leaderboard and claims, including a claim’s signed proof and addresses, are public on burnyt.com. A large on-chain burn can spend your payment directly, which links the wallet you paid from to the npub on the blockchain.

Unless you switch it off before paying, the app posts a certificate of your burn from your own nostr account. Burnyt’s own nostr account may also post a note after a burn or claim, with the amount and a certificate image that mentions the npub it is credited to (for a gift, the recipient’s, never the payer’s).

Burns found on the blockchain that carry an npub may be shown even if their owner never used Burnyt. We then copy that npub’s public nostr profile, and may message it if a burn is made for it. On a gift you are shown as the payer unless you choose to hide yourself; we still keep the payer in our records.

No one, including us, can remove data from the Bitcoin blockchain or from nostr relays.

Burnyt sets no cookies. Your browser’s storage holds your sign-in session, your settings and app state, such as which conversations you’ve read (no message text). If you save your key with a password, it holds that key encrypted until you remove it; the key and password themselves are never stored readably. A connected Lightning wallet’s secret and the connection key for a remote signer last only until you sign out or close Burnyt.

Burnyt’s nostr account may send you encrypted direct messages: when you sign in, when your burn is complete, when someone makes or claims a burn for you, and about your claims. Relays can see that we messaged your npub and when, but not what we said.

• The Bitcoin network and nostr relays. What we publish there is public (section 3), including profile edits you make on Burnyt. Your browser also talks to relays directly for community features, remote signers and wallet connections.
• Media hosts. Profile pictures and files you upload go from your browser to a nostr media host, such as nostr.build, and we upload burn and claim certificate images there too. Images on Burnyt load straight from the hosts that store them, which see your IP address. Remove location data from photos before you upload them.
• NIP-05 domains and Lightning-address servers, which we or your browser contact to check a NIP-05 address or to send a zap.
• Payment infrastructure. Our own Bitcoin, Lightning and TRON nodes. TronGrid may be asked about our USDT receiving addresses.
• Sentry. Error reports, if error tracking is on (section 2), stored in its EU region.
• Telegram. Our team’s internal alerts about burns and payments. They contain amounts, payment addresses and transaction IDs, and some include the npub a burn or claim is credited to.
• Expo, Apple and Google, which deliver our mobile app’s notifications.
• Hosting and storage providers that run our servers and database and hold our backups.
• Authorities, when the law requires it.

Price services receive no personal data. We don’t sell personal data or share it for advertising.

• Unpaid on-chain payment requests are deleted about a day after they were made; the audit log keeps a record that the request was made. Unpaid Lightning and USDT requests are kept.
• Abuse-limiting counters expire after about a minute. The fingerprint kept with your unpaid payment requests expires with them, after at most about a day.
• Server logs are rotated and overwritten as they grow.
• Database backups, including encrypted off-site copies, are kept for a limited time to recover from failures; on our servers that is 30 days.
• Sign-in sessions end after at most 30 days.
• Your account, our copy of your profile, burns, payments, claims and the audit log are kept while Burnyt operates, for accounting, security and legal reasons.

Depending on where you live, you may have the right to access, correct, delete or get a copy of your personal data, and to restrict or object to how we use it. To make a request, email contact@greentruth.tech. We will ask you to sign a message with your nostr key to prove the npub is yours.

Your profile details come from your public nostr profile, so you can change them there; Burnyt picks up the change the next time you sign in. You can also ask us to erase our copy of your profile. We cannot delete what is on the blockchain or on nostr relays, and we keep the burn and payment records we need for accounting and legal reasons. You can also complain to your data protection authority.

Connections to Burnyt are encrypted. The keys that sign burns are held by a separate signer, not on our servers. Access to admin tools is restricted and logged. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

Our servers and database may be in a country other than yours. Error reports are stored in the EU. Nostr relays, media hosts and the other services in section 6 can be anywhere in the world.

We will publish any change to this policy here with a new effective date. The Terms of Service cover how the service itself works.

Privacy questions and requests: contact@greentruth.tech.