Privacy policy

If you buy with a wallet

You only connect your own wallet, and nothing about you is stored in our database. The site never sees your wallet’s key or recovery words.

If you sign in with email

We keep: your email address, the wallet address you enter for withdrawals, your referrer’s address if you came through an invite link, the short code of the ad link you came through, if any (so we know which ads work), your language and time zone, your anti-phishing code, and any support tickets you open.

We send your account these emails: sign-in codes, a deposit arriving, a purchase going through, referral rewards and answers to your tickets always go out. Account reminders and new steps can be turned off in your settings or from the link at the bottom of those emails, and news comes only if you turn it on. We give your email to nobody. The queue of emails to send is kept for at most 30 days.

We never ask for or keep: a password (you sign in only with a one-time code sent to your email), your wallet’s key or recovery words, your name, phone number or identity documents.

Balances, purchases and withdrawals are not in our database; they are recorded on the blockchain. Only for the contest table do we keep each buyer’s id and total purchases, which are public on the blockchain. That table shows only the last four characters of a buyer’s id, never their email.

To prevent abuse, such as guessing codes or mass-sending email, we count requests. The count uses hashed versions of the IP address and email; the IP itself is not stored, and the counts are deleted after a short time.

After you sign in, a sign-in cookie keeps you signed in (for up to 14 days). Each sign-in is recorded with its device type and time, so you can see and end it on the “Account security” page. No IP address is kept in that list.

What we never use

We use no tracking cookies, advertising or third-party analytics tools, and we don’t sell your data to anyone. We only count, per day, how many times each page is opened, how many sign-up and purchase steps happen, and how many times the site was opened in each wallet’s own browser; the count is anonymous, with no cookie, id or IP kept with it.

Services we use

Hosting: Vercel. Account database and email sign-in: Supabase, on servers in Frankfurt, Germany. Emails: Maileroo and Resend, with no tracking of opens or link clicks. Signing in with Google, if you choose it: Google gives us only your email address and confirms it is yours; we take no name, photo or anything else from your Google account. Google, for its part, learns that you signed in to DOTO with your Google account. The team’s internal reports (such as a new sign-up, deposit, purchase or ticket, with the account’s email, and whether a deposit probably came from an exchange or a personal wallet, judged from public blockchain data) reach only the DOTO support team’s accounts through a Telegram bot. These services process data only to provide these functions.

Like every website, the hosting service briefly keeps technical request data (such as IP address and browser type) for security and to block attacks. We do not use it to identify you.

Public data on the blockchain

Your wallet address and the amount and time of each deposit, purchase, withdrawal and claim are recorded on the blockchain and are visible to everyone. That is how blockchains work, and we cannot hide or delete it. If your wallet address is linked to your identity, this data is linked to you too.

Deleting your account

To have your email account deleted, message support, and your email and settings will be removed. What is on the blockchain (purchases and your DOTO) can’t be deleted and still belongs to your wallet address.

Support

If you message support on Telegram, your messages stay on Telegram and are subject to Telegram’s rules. Never send recovery words or wallet keys in a message or ticket.

Changes to this policy

If the way we handle data ever changes, we will publish a new, dated version of this policy on this page.