Privacy

Hashly is a public index of proof-of-work projects and mining pools. You can read all of it without an account, and we collect as little as we can to run it. This page explains what that little is.

Who is responsible

The data controller is Iacopo Bonandi — sole proprietorship “BONANDI IACOPO”, Via Foro Boario 10, 48022 Lugo (RA), Italy — VAT no. IT02776330397. This policy covers hashly.net and app.hashly.net. For anything about your personal data, write to [email protected]; for anything else, to [email protected].

When you read the site

Server logs. Our web server and our network provider see your IP address, the page requested, the time, your browser’s user-agent string and the referring page, because that is how a web request works. The server keeps these logs for up to 14 days to keep the service running and secure, then deletes them. Basis: our legitimate interest in operating and protecting the site (Art. 6(1)(f) GDPR).

Visit statistics. To learn which pages are useful, the site records the page opened, the project or pool it was about, the time, the country our network provider reports, the origin of the site you came from, and your IP address with its last part removed (the last octet for IPv4, everything after the first 48 bits for IPv6). The user-agent string is discarded. Visits on the same day are grouped by a code computed from your address and browser with a random key that is replaced every day and never stored, so visits cannot be linked across days and the code cannot be turned back into an address. No cookie or browser storage is used for this. We keep these records for 90 days. Basis: legitimate interest in measuring the use of the site in aggregate (Art. 6(1)(f)).

Paths that work as private links — callout receipts and email preferences — and the admin area are never recorded, and neither are URL parameters.

The landing page at hashly.net sets no cookies, uses no browser storage and records no visit statistics: only the server logs above apply to it.

When you follow projects

Followed projects and read markers are saved in your browser’s local storage, on your device only. To show My Radar, your browser sends the selected project identifiers to our server; we do not store them with any identifier of you. Clearing site data removes them.

When you ask for Radar emails

Daily Radar emails are optional. If you request them we store your email address, the projects you chose, the confirmation and the delivery records, and send a confirmation link: nothing is sent until you confirm. Basis: your consent (Art. 6(1)(a)), which you can withdraw at any time through the preferences link in every email. Unsubscribing stops future emails at once; we keep the subscription and delivery records so that the unsubscription is respected and delivery problems can be investigated, and delete them 24 months after you unsubscribe, or earlier on request. Emails are delivered by Resend, acting on our behalf. This service is separate from any future beta waiting list.

When you submit a callout

A callout is a link to a public X post about a project. We store the post link, the project, your optional explanation, whether you asked for privacy for the post author, the time and the editorial decisions. We do not ask who you are. Editors read the public post and its author’s public profile to verify them, and an eligible post can be credited publicly to its author with an excerpt. If the author asked for privacy, or the case is unresolved, the post is not attributed publicly. Basis: our legitimate interest in keeping a verifiable, correctable record of who documented a project first (Art. 6(1)(f)). We keep callout records for as long as the attribution record they support is maintained; callouts we reject are deleted 12 months after the decision.

If you are the author of a post someone submitted, the data come from your public post and profile on X. You can ask us to stop crediting you by name, to correct a decision or to delete the record; see the methodology for how privacy requests are handled.

When you use the contact form

If you ask to get in touch with a credited author, we store your reply email, your message, the profile you asked about, the time and the review decision. The request goes to our editors; it is not forwarded automatically. Basis: legitimate interest in handling the request you sent and in preventing abuse (Art. 6(1)(f)). We delete it 12 months after the review decision, or earlier on request.

When you ask for a sponsorship

If you use the form on /sponsor we store the name or company you give, the email address or Telegram handle you leave, the placement you chose, the pool or project you are interested in, the date you would like to start, your message, the time and the decision we take. We use them to reply and, if we agree a placement, to set it up. Basis: our legitimate interest in handling the request you sent and in preventing abuse (Art. 6(1)(f)). We keep the request and its decision for up to 12 months after the decision, or earlier on request. The placement record itself is kept while the placement runs and for as long as the commercial agreement requires.

When you write to us

If you email one of our addresses we receive your address, your message and anything you attach. We use them to answer you and keep them for as long as handling your request and any follow-up requires. Basis: legitimate interest in answering you (Art. 6(1)(f)) or, when you exercise one of the rights below, our legal obligation (Art. 6(1)(c)).

Abuse controls

Callouts, contact requests, sponsorship requests and email sign-ups are rate limited. For this we store a one-way keyed code derived from your IP address (or, where the server cannot rely on the address, from a random identifier in a cookie), never the address itself, and delete it with its counters 30 days after its last use. Basis: legitimate interest in protecting the service (Art. 6(1)(f)). Details of the cookie are on the cookies page.

Who else handles data

Hetzner Online GmbH (Germany) hosts the servers and their backups in the European Union.
Cloudflare, Inc. delivers and protects the site. Every request passes through its network, which processes your IP address to route the request and filter attacks. It also receives mail sent to our addresses and forwards it.
Resend delivers Radar emails, only if you request them, and notifies us when a sponsorship request arrives.

They act as processors under their standard data processing agreements. Where one of them processes data outside the European Economic Area, the transfer relies on the safeguards in those terms, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. Mail sent to our addresses is forwarded to a mailbox hosted by Google, under Google’s own terms. We do not sell data, show advertising or use analytics or advertising networks. The typefaces are served from our own server.

Your rights

You can ask for access to your data, correction, deletion, restriction, portability of data you gave us on the basis of consent, and you can object to processing based on legitimate interest. Write to [email protected]; we answer within one month. If we hold nothing that can be linked to you — as is the case for the anonymised visit statistics — we will say so. You also have the right to lodge a complaint with a data protection authority, in Italy the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority where you live or work.

You do not have to give us personal data: beyond the request data every website receives, an email address or Telegram handle is needed only for the optional features that ask for one, such as a sponsorship request. We make no decisions about you by automated means. The site is not directed at children.

Changes

When what we collect changes, this page changes with it and the date at the top moves. Related pages: cookies and browser storage and terms.