This Privacy Policy explains how TCC Network ("TCC", "we", "us", or "our") collects, uses, discloses, and protects your information when you use our mobile application, websites, and related services (collectively, the "Service"). By creating an account or using the Service, you agree to the practices described in this Policy.
1. Information we collect
We collect only the information needed to operate the Service securely.
Account information
- Username and password (passwords are stored only as a strong one-way hash — we never store them in plain text).
- Email address, and optionally phone number, country, and city that you choose to provide.
- The invitation (referral) code you used and the referral relationships you create.
Usage & mining data
- Mining activity, session timestamps, balance, and referral team statistics.
- Chat messages you send in public rooms or private conversations, and moderation actions (reports, blocks).
Device & technical data
- A device push token and device identifier used to deliver notifications.
- IP address, general request metadata, and basic diagnostic logs used for security and anti-abuse.
- Local storage / cookies used to keep you signed in and remember preferences.
Identity verification (KYC) data
If you choose to complete identity verification, we may process identity documents and related verification data. See Section 4 for how this is minimized, protected, and deleted.
2. How we use information
- Provide, maintain, and secure the Service, including accounts, mining, and referrals.
- Send you service notifications and reminders (for example, when a mining session ends).
- Enable community features such as chat, reporting, and blocking.
- Detect, prevent, and investigate fraud, abuse, spam, and security incidents.
- Verify identity where you opt in to KYC.
- Communicate important updates and respond to your support requests.
- Improve the reliability, performance, and features of the Service.
We do not sell your personal information.
3. Push notifications
We deliver push notifications (such as mining-session reminders and important announcements) using standard mobile push infrastructure. To do this, we store a device push token linked to your account. You can disable notifications at any time in your device settings; doing so does not affect your ability to mine or use other features.
4. KYC & identity data
Protecting user privacy is one of our highest priorities, and identity verification is handled with data-minimization by design.
- Before KYC documents are submitted, sensitive information (such as ID numbers, home addresses, and other unnecessary personal details) is masked whenever possible. Only the minimum information required for identity verification is transmitted.
- KYC data is transmitted over encrypted connections and processed using industry-standard security practices.
- Once KYC is successfully completed, your name, year of birth and every submitted image are deleted. What the system keeps is a cryptographic digital signature of your document number — a one-way record that can confirm your KYC status but cannot be reversed to reconstruct the number — and an encrypted face template, which is biometric data and is explained in full below.
During the first month after you apply, we will ask you a few times, at random moments, to take a short selfie clip. This is what confirms the account belongs to a real person and not to someone who verified once on another person's behalf. To make that comparison possible we derive a face template from your photo — a short list of numbers, which is biometric data. Each clip is turned into those numbers and then deleted immediately; the clips themselves are never stored, and the template is never shown to our staff.
We keep the face template after your verification is approved
This is a change from our earlier policy, which said the template was deleted as soon as verification finished. Please read this section before you start verification.
- Why. The face template is the only thing that stops one person from opening many verified accounts using several different identity documents. The one-way signature of your document number cannot do this on its own, because the same person can legitimately hold more than one valid document number — for example an older national ID and its newer replacement. Mining rewards and referral rewards depend on one person meaning one account, so this check protects every honest user's share.
- What is kept. A deliberately coarse numeric template, encrypted at rest. Not a photograph. No API returns it, and no member of staff can view it.
- What it is used for. Exactly one thing: comparing a new application against existing ones and flagging a possible duplicate for a person to review. It never decides anything by itself, it is never used to identify you anywhere else, and it is never shared.
- How long. For as long as the duplicate check needs to work, which in practice means indefinitely. Deleting your account does not delete it — if it did, deleting and re-registering would defeat the check entirely. This is a stated exception to Section 9.
- What we will not claim. We will not tell you the template cannot be reversed. Published research shows that an approximate face image can sometimes be derived from templates of this kind. We store reduced precision and we encrypt it, but we are not going to promise you something we cannot guarantee.
- Your choice. If you would rather not have a face template held, do not start verification — nothing else on TCC requires it. If you have already verified and want your template erased, contact us and we will erase it; your verified status will be withdrawn at the same time, because the two cannot be separated.
Apart from the face template, once your verification is approved all we keep is the one-way signature described above, a single yes/no that you are over 18, your country and document type, and the review timestamps. Your name, your year of birth and every image you submitted are deleted.
5. Legal basis & consent
Where applicable law requires a legal basis, we rely on your consent (which you may withdraw), the performance of our agreement with you (to provide the Service), our legitimate interests (security and improvement), and compliance with legal obligations.
6. Sharing & disclosure
We share information only in limited circumstances:
- Service providers that help us operate the Service (for example, cloud hosting, email delivery, and push-notification providers), bound by confidentiality and data-protection obligations.
- Legal requirements — when required by law, regulation, legal process, or to protect the rights, safety, and security of users and the Service.
- Business transfers — in connection with a merger, acquisition, or reorganization, subject to this Policy.
- Certain profile details (such as your username and public referral or chat activity) are visible to other users as part of normal community features.
7. Data retention
We keep personal information only for as long as necessary to provide the Service and for legitimate legal, security, and operational purposes. Original KYC documents, your name and your year of birth are deleted after successful verification as described above. Two items are kept indefinitely for fraud prevention: the one-way signature of your document number, and your encrypted face template (see Section 4). Both survive account deletion, because a check that can be erased by deleting an account does not prevent anything. You may request deletion of your account data as described in Section 9.
8. Security
- Passwords are protected with strong one-way hashing.
- Data in transit is protected using encrypted connections (TLS/HTTPS).
- The TCC blockchain uses post-quantum cryptographic signatures (CRYSTALS-Dilithium / ML-DSA-65) designed to resist both classical and quantum attacks.
- Access to sensitive systems and data is restricted to authorized systems and personnel.
No method of transmission or storage is 100% secure, but we work continuously to protect your information.
9. Your rights
Depending on your location, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. You can update much of your profile directly in the app, and you may contact us to exercise other rights. We will respond within a reasonable timeframe.
Two exceptions, both stated plainly rather than buried: data written to the TCC blockchain cannot be erased by anyone (Section 12), and the fraud-prevention records described in Section 4 — the one-way signature of your document number and your encrypted face template — are not removed when you delete your account. You can still have your face template erased on request, which also withdraws your verified status.
10. Children
The Service is not directed to children under the age required by your local law (at minimum, under 13). We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us so we can remove it.
11. International transfers
TCC Network operates globally. Your information may be processed in countries other than your own. Where required, we take steps to ensure appropriate safeguards for such transfers.
12. Wallet, blockchain & NFT marketplace data
The wallet and the NFT marketplace work differently from the rest of the Service, and the difference matters for your privacy.
- — Your keys stay on your device. Wallet keys are generated locally and encrypted with your PIN. We never receive them and cannot recover them.
- — Blockchain data is public and permanent. Wallet addresses, balances, transfers, mints, listings, bids, sales, rentals and reports are written to a public ledger. Anyone can read them, they cannot be edited or deleted, and this is outside our control — no deletion request can remove them.
- — Addresses are pseudonymous, not anonymous. If you link an address to your identity anywhere — by linking a wallet to your TCC account, by publishing it, or through an exchange — that link may allow your on-chain activity to be attributed to you.
- — NFT media is public and permanent. Media and metadata you mint are published to IPFS. Anyone can copy them and third-party nodes may keep serving them indefinitely, even after we delist an item. Do not mint anything containing personal information you may later want removed.
- — Reports are attributable to administrators. When you report a listing, the report is signed by your wallet; administrators can see which address filed it and which category was chosen.
- — Linking a wallet to your account. If you link a wallet, we store the association so we can notify you about your transactions. We do not disclose the mapping between accounts and addresses to other users.
13. Changes to this Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.
14. Contact us
If you have questions about this Privacy Policy or your data, contact the TCC Core Team at [email protected] or through our official support channels.