Helium Tracker Privacy Policy

• email address (for authentication and communications);
• name (optional, where provided);
• billing information processed through Stripe (we do not store card numbers);
• Helium hotspot keys, deployer labels, and other tracking metadata you choose to upload;
• optional Solana wallet addresses used only at the moment of hotspot lookup; we do not retain wallet addresses after the lookup completes;
• support requests, feedback, and other communications.

• magic-link verification timestamps and one-time tokens issued at sign-in (short-lived);
• session tokens issued after successful authentication, stored as hashed values;
• if you enable two-factor authentication: a TOTP secret encrypted at rest with AES-256-GCM, and SHA-256 hashes of single-use backup codes.

• IP address, device type, browser, operating system;
• log data, request paths, timestamps;
• usage and performance metrics.

• Stripe customer ID and subscription identifiers;
• plan tier and subscription status;
• billing-related communications (sent by Stripe on our behalf).

Andrena does not collect or store full payment card numbers, CVCs, or bank account credentials. All payment data is handled directly by Stripe pursuant to its own privacy practices.

Hotspot keys you choose to track are public identifiers visible on the Helium blockchain. Andrena queries reward and metadata information about these hotspots from third-party APIs (the Helium Foundation, and Amazon S3 for the reward oracle files) to populate your dashboard. This data is publicly available regardless of whether you use the Services.

Unless specifically required for a particular Service, Andrena does not request and users should not provide government-issued identification numbers, financial account credentials, private wallet keys, seed phrases, biometric information, precise geolocation data, health information, or other sensitive categories of information. Users should never share private keys, seed phrases, authentication credentials, or wallet recovery information with Andrena or any third party.

We use personal data to:

• operate, maintain, and improve the Services;
• fetch and display reward data for hotspots you choose to track;
• process subscription payments through Stripe;
• send transactional emails (magic links, billing receipts);
• provide customer support;
• communicate with users about service updates and changes;
• detect and prevent fraud, abuse, sanctions violations, and security incidents;
• comply with legal, regulatory, and audit obligations;
• enforce eligibility requirements, plan limits, rate limits, and acceptable use policies.

To the extent applicable under the GDPR, UK GDPR, Swiss data protection laws, or similar laws, Andrena processes personal data pursuant to one or more of the following legal bases:

• performance of a contract or steps taken prior to entering into a contract;
• compliance with legal obligations;
• legitimate interests, including operating the Services, fraud prevention, network security, analytics, customer support, and business operations;
• consent, where required by applicable law;
• protection of legal rights, security, safety, and operational integrity.

Where consent is required by applicable law, users may withdraw consent at any time, subject to legal and operational limitations.

Andrena may send operational communications, transactional notices, security notifications, support communications, and, where permitted by applicable law, occasional product-related or promotional communications. Users may opt out of marketing communications at any time by using unsubscribe functionality in the email or by contacting contact@heliumtracker.xyz. Users may continue to receive operational, transactional, compliance, legal, or account-related communications necessary for operation of the Services.

We share data with third-party service providers strictly as needed to operate the Services. Each provider processes information only as reasonably necessary to provide services on behalf of Andrena, subject to applicable contractual, legal, and security restrictions.

Andrena may disclose information where required by applicable law, regulation, subpoena, court order, governmental request, or legal process; to comply with sanctions obligations, anti-money laundering obligations, fraud prevention requirements, or other compliance obligations; to protect the rights, safety, integrity, security, or property of Andrena, users, counterparties, or third parties; or to investigate suspected fraud, abuse, unauthorized access, security incidents, sanctions violations, or unlawful activity.

Helium hotspot keys are publicly visible identifiers on the Helium blockchain. Reward data, transaction history, and protocol activity associated with these hotspots may be publicly visible, immutable, permanently accessible, and independently indexed by third parties.

Andrena does not control public blockchain records, third-party blockchain indexing, decentralized storage systems, validator activity, blockchain explorers, or independent blockchain analytics providers. Users should understand that blockchain- related information may remain publicly accessible indefinitely.

Information may be disclosed or transferred in connection with mergers, acquisitions, financings, restructurings, sales of assets, or other corporate or commercial transactions, subject to applicable law. Recipients may include counterparties, lenders, investors, professional advisors, insurers, and auditors.

Andrena implements commercially reasonable administrative, technical, organizational, and physical safeguards designed to protect personal data against unauthorized access, disclosure, alteration, misuse, destruction, or loss. Such safeguards include:

• TLS encryption for data in transit;
• AES-256-GCM encryption for sensitive data at rest, including two-factor authentication secrets;
• hashed session tokens and HTTP-only secure cookies;
• role-based access controls;
• network monitoring and logging;
• incident response procedures;
• vendor security reviews.

Access to personal data is limited to personnel, contractors, and service providers that reasonably require such access for operational, legal, security, compliance, or support purposes.

Despite these measures, no system, network, cloud environment, communication channel, or data transmission method can be guaranteed to be completely secure or error-free. Users are solely responsible for maintaining the security of their devices, credentials, two-factor authentication backup codes, and email accounts.

Nothing in this Privacy Policy constitutes a guarantee against security incidents, cyberattacks, unauthorized access, or third- party compromises.

In the event of a suspected or confirmed security incident involving personal data, Andrena may investigate, contain, remediate, cooperate with authorities, notify affected parties, and take other actions consistent with applicable law, operational requirements, and security practices.

• Essential cookies required for authentication, session integrity, and security;
• Functional cookies for user preferences;
• Performance and analytics cookies, where used to understand aggregate usage and improve the Services.

Andrena does not use third-party advertising cookies or behavioral tracking cookies for the Helium Tracker Services.

Users may manage or disable cookies and similar technologies through browser settings, device-level privacy controls, or industry-standard opt-out mechanisms. Disabling essential cookies may affect the availability or functionality of the Services, including the ability to sign in.

Where required by applicable law, Andrena recognizes Global Privacy Control (“GPC”) signals and similar browser- based opt-out preference signals intended to communicate a user’s privacy preferences. Depending on applicable law and technical feasibility, recognized signals may be treated as requests to opt out of certain categories of data sharing.

Certain processing activities may continue notwithstanding such signals where necessary to provide requested Services; required for security, fraud prevention, sanctions compliance, or legal obligations; or otherwise permitted under applicable law.

Because there is no universally accepted standard for “Do Not Track” signals, Andrena does not currently respond to DNT browser signals except as otherwise required by applicable law.

Depending on your jurisdiction and applicable law, you may have certain rights regarding your personal data, including the right to:

• request access to personal data we maintain about you;
• request correction of inaccurate or incomplete data;
• request deletion of certain personal data;
• request restriction of certain processing activities;
• object to certain categories of processing;
• withdraw consent where processing is based on consent;
• request portability of eligible personal data;
• opt out of certain categories of data sharing or targeted advertising; and
• lodge complaints with applicable regulatory authorities.

These rights may be subject to legal limitations, verification procedures, fraud prevention requirements, security considerations, technical feasibility, and applicable legal exemptions.

You can exercise many privacy-related actions directly through the Services without contacting us: update your email through your billing portal, delete your Account from the security page, disable 2FA, and download your tracked data via CSV export.

Users may submit privacy rights requests by contacting contact@heliumtracker.xyz. Requests should specify the nature of the request, sufficient information to verify identity, and details necessary to process the request.

Andrena may require verification of identity or authority before processing requests. Authorized agents may be required to provide proof of authorization where required by applicable law.

Andrena may deny, limit, or condition requests where permitted by applicable law, including where identity cannot reasonably be verified; requests are excessive, repetitive, or abusive; or information must be retained pursuant to legal, regulatory, contractual, sanctions, cybersecurity, or operational obligations.

Due to the decentralized, distributed, and immutable nature of blockchain systems, certain information recorded on public blockchains cannot be modified, deleted, anonymized, restricted, or controlled by Andrena once published.

This may include hotspot keys, transaction records, reward distributions, validator activity, timestamps, metadata, and other blockchain-related information that may remain permanently publicly accessible and independently indexed by third parties. Andrena does not guarantee the deletion, removal, anonymization, or restriction of information that has been published to public blockchain systems or has been independently retained by third parties.

Andrena may use automated systems, analytics tools, sanctions- screening systems, fraud-detection systems, and geolocation systems in connection with eligibility determinations, access restrictions, fraud prevention, sanctions compliance, abuse prevention, and operational risk management. Such systems may contribute to automated decisions relating to access restrictions, feature availability, or risk assessments, subject to applicable law.