Crank Privacy Policy

Effective date: 14 October 2026

This Privacy Policy explains how Engaij, Inc., a Delaware corporation ("Engaij", "we", "us"), collects, uses, and shares information in connection with Crank ("Crank", the "Service"), a non-custodial software interface for interacting with DeFi protocols on the Solana blockchain, available at crank.ing and through associated applications and developer tools. Use of the Service is governed by the Crank Terms of Service.

Crank is non-custodial, and much of its operation relies on public blockchain data rather than personal information. This policy covers our obligations under the EU and UK General Data Protection Regulation (GDPR / UK GDPR) and the California Consumer Privacy Act (CCPA).

1. Information We Collect

  • Wallet addresses and public on-chain data. The public Solana addresses you connect or query, and public on-chain activity associated with actions performed through the Service, including balances and transaction history.
  • IP address and approximate geolocation. Collected for compliance (applying geo-restrictions on certain products and supporting sanctions compliance), security, abuse prevention, and rate limiting.
  • X (Twitter) handle. Only if you choose to use social features that involve your X account. Basic use of the Service never requires it.
  • Agent configuration and usage metadata. Parameters you set for strategies, automation, and AI agents; which features and tools you use; and related technical logs.
  • On/off-ramp transaction status. If you use the MoonPay on/off-ramp, we receive transaction status and transaction identifiers from MoonPay (see Section 4).

2. Information We Do Not Collect

  • We never collect, store, or access your private keys or seed phrases.
  • We do not collect card numbers or payment credentials.
  • We do not collect identity documents. We do not perform KYC on users of the Service; identity verification for fiat transactions is performed by MoonPay under its own policies.
  • No personal identity information is required for basic use of the Service.

3. Public On-Chain Data

Transactions you broadcast are recorded on the Solana blockchain, which is public, permanent, and immutable. On-chain data cannot be deleted, altered, or anonymized by us or by anyone. Wallet addresses and transaction history are public by the nature of the blockchain, and deletion and rectification rights described below cannot be applied to them.

4. MoonPay (Fiat On/Off-Ramp)

Fiat on- and off-ramping is provided by MoonPay, an independent third party. MoonPay performs its own KYC and payment processing under its own privacy policy, which governs the personal data you provide to it. Crank receives transaction status and transaction identifiers only from MoonPay. Crank never receives your card data, bank details, or identity documents.

5. How We Use Information

  • Operating the Service: building the transactions you request, calculating and applying the technology service fee.
  • Compliance: applying product geo-restrictions, screening value-bearing actions against the OFAC SDN list, and meeting legal obligations.
  • Security: detecting and preventing fraud, abuse, and attacks; rate limiting.
  • Product analytics and improving the Service (consent-based where required, see Section 7).
  • Communications you request or initiate.

We do not sell your personal information.

6. Service Providers and Other Recipients

We share limited information with providers that help operate the Service, by category:

  • Hosting and infrastructure: Railway and Vercel (application and web hosting).
  • Blockchain RPC infrastructure: Helius (Solana RPC services used to read chain state and submit the transactions you sign).
  • Wallet infrastructure: Turnkey (infrastructure supporting app-managed wallets).
  • Analytics: Google Analytics (consent-based, see Section 7).
  • Fiat on/off-ramp: MoonPay (see Section 4).

In addition, transactions you sign are routed to independent third-party DeFi protocols and venues (for example, Jupiter, Kamino, and Marginfi) and may be submitted via MEV-protection infrastructure (for example, Jito). These are independent on-chain services, not our processors; your interaction with them is public on-chain activity governed by their own terms.

We may also disclose information where required by law, to protect our rights or users, or in connection with a corporate transaction.

7. Cookies and Analytics

We use a minimal set of cookies. Analytics (Google Analytics) runs only with your consent: analytics and advertising storage default to denied under Google Consent Mode v2 until you accept the cookie banner, and we run no advertising, so advertising storage stays denied at all times.

8. Data Retention

  • Financial and fee records: up to 7 years (compliance and audit).
  • IP logs: up to 90 days.
  • Individual analytics data: up to 24 months.
  • Agent configuration: for as long as you keep the configuration, and for a short period after deletion for security and audit.

Public on-chain data is outside our control and is retained by the blockchain indefinitely (Section 3).

9. Security

We use TLS for data in transit, encryption at rest for sensitive data, and role-based access controls. The Service's non-custodial architecture means we never hold your keys or funds. No system is perfectly secure; you are responsible for securing your own wallet and devices.

10. International Transfers

We process information in the United States and may process it in other countries. Where required, transfers of personal data out of the EU or UK are made under appropriate safeguards, such as the EU Standard Contractual Clauses and the UK Addendum.

11. Your Rights (GDPR / UK GDPR)

If you are in the EU or UK, you have the right to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. Our legal bases include performance of a contract, legitimate interests (security, fraud prevention, service improvement), consent (analytics), and legal obligations. Rights that depend on deletion or rectification cannot be applied to immutable on-chain data (Section 3). You may also complain to your supervisory authority.

12. Your Rights (CCPA)

If you are a California resident, you have the right to know what personal information we collect, to request access, correction, or deletion, and to opt out of any "sale" or "sharing" of personal information. We do not sell your personal information. We will not discriminate against you for exercising these rights.

To exercise any rights under this policy, contact us at the address in Section 15.

13. Children

The Service is not directed to anyone under 18, and we do not knowingly collect information from children.

14. Changes

We may update this Privacy Policy from time to time. Material changes will be posted on this page with a revised effective date.

15. Contact

Engaij, Inc.
1111B S Governors Ave #48466
Dover, DE 19904, United States
Email: [email protected]