Privacy notice

Last updated: 17 September 2026

SecurVault processes two pieces of data so it can recognise you when the Telegram Mini App opens. Below is what is processed, why, and for how long.

Data controller

The SauBlockchain team, Sakarya University. Built for the TEKNOFEST 2026 Blockchain Competition, team 981614. Contact: ekip@saublockchain.io

Data processed

Your Telegram display name and your Telegram user id. Telegram signs both and sends them the moment you open the app; the server verifies the signature before storing them. Nothing else is stored.

Data not processed

No identity documents, phone numbers, addresses, payment cards or real money details are collected. Your private keys never exist in plaintext anywhere; they are decrypted only inside the network isolated signing service, only at the moment of signing, and wiped immediately after.

Purpose and legal basis

To bind your session to you and your wallets to their owner. The legal basis is that processing is necessary to provide the service you requested.

Retention

Your record is kept until you ask for it to be removed, or until the competition period ends. All Devnet data is deleted at the end of the period.

Audit log

Every signing request writes an audit record, and that record cannot be altered by design. It holds no name and no Telegram id, only a pseudonymous caller id. Deleting your record breaks the link, after which the log can no longer be traced to a person.

Transfers and infrastructure

Your data is not transferred to any third party for that party's own purposes; it is not sold and not used for advertising or profiling. Records stay in an isolated database on the team's own machine. Only two infrastructure providers sit in the path technically: the marketing site and Mini App files are served through Vercel, and API traffic passes through Cloudflare. Both are hosted outside Turkey and see your connection data (IP address, request time). No analytics, tracking or advertising tool is used.

Your rights

You may ask whether your data is processed, request information about it, learn the purpose of processing, know the parties it has been transferred to, ask for correction if it is incomplete or wrong, ask for deletion where the conditions apply, ask for these actions to be communicated to parties the data was transferred to, object to an adverse outcome produced solely by automated evaluation, and claim compensation for damage caused by unlawful processing. Write to ekip@saublockchain.io; deletion requests are handled the same day. If our answer does not satisfy you, you may complain to the Turkish data protection authority (KVKK).

Scope warning

This product is under development and runs only on Solana Devnet with test USDC. It is not ready for use with real assets.