Privacy Policy

Who we are

Gully Labs LLC (Oregon, USA) runs Gully Chain and the sites and services listed below, and is responsible for the personal data they handle. Questions or requests about your data: [email protected].

• the Gully Chain Testnet blockchain (chain ID 485590) and its public RPC endpoints, such as testnet-rpc.gullychain.xyz
• gullychain.xyz, the developer docs at docs.gullychain.xyz and the developer portal at dev.gullychain.xyz
• the block explorer at testnet-explorer.gullychain.xyz (explorer.gullychain.xyz points to it until mainnet)
• the bridge at testnet-bridge.gullychain.xyz
• the testnet faucet at faucet.gullychain.xyz
• Gully Safe at safe.gullychain.xyz
• the Gully Core DEX and launchpad contracts, Gully Quests, .gully names and the sponsored-gas paymaster on Gully Chain

Signing in with Gully ID (opens in a new tab) is a separate Gully Labs service; what it keeps (your account, passkeys, email) is in the Gully ID privacy policy (opens in a new tab).

Public blockchain data

Gully Chain is a public blockchain. Your address, your transactions, the contracts you deploy, quest completions, referrals and .gully names are public by design, visible to anyone in the explorer, and permanent. We cannot delete or change on-chain data, and this policy cannot make it private. Our explorer and indexer (indexer.gullychain.xyz) read that public data and show it.

What we collect and why

• Visits to our sites. gullychain.xyz, the docs and the developer portal count visits with Umami, an open-source analytics tool we host ourselves at analytics.gullychain.xyz. It sets no cookies and stores no IP address: each visit is counted with a one-way hash whose salt changes every day. It records the page, the referring site, browser, operating system, device type, screen size, language and country (worked out from the request, then discarded), plus a few anonymous counters on key steps. If your browser sends Do Not Track, the script does not run. Blocking analytics.gullychain.xyz turns it off and breaks nothing.
• Requests to our endpoints. When you or your wallet call the RPC, the explorer, the indexer, the bridge, the faucet, the paymaster or a site, our servers receive your IP address, the request and your browser’s user agent, like any web server. We use them to deliver the request, to apply rate limits and to keep the services secure.
• Faucet. To send testnet ETH, the faucet needs your address and a Gully ID sign-in, and uses your IP address and address to apply the once-a-day limit.
• Sponsored gas. The paymaster sees the operation it is asked to sponsor (sender address, target contract, gas) and your IP address, and keeps per-account and per-IP counters to apply its limits. It may remember which first actions an account already had sponsored.
• Email. If you write to us, we get your email address and what you send, and use them to answer you.

Cookies and browser storage

Our Gully Chain sites set no tracking cookies. A few pages keep small settings in your browser’s local storage so they work as you expect, for example the progress of the developer quickstart or a dismissed banner. They never leave your browser and you can clear them at any time.

• Gully Safe keeps your Safes, address book, settings and cached data in your browser’s local storage (keys starting with SAFE_v2__). If you choose to sign in to the optional Hypernative security check, it sets the login cookie hn_auth. Gully Safe counts page views with Cloudflare Web Analytics, which sets no cookies.
• The bridge keeps your wallet connection and transfer history in your browser.

Who else processes data

We do not sell personal data or share it for advertising. These providers process some of it to run the services:

• Cloudflare carries all traffic to our sites and endpoints (DNS, CDN, TLS and security), so it sees your IP address and requests. On Gully Safe it also runs Cloudflare Web Analytics, a cookieless page-view count.
• Hypernative, only if you sign in to its optional security check in Gully Safe: it receives what that check needs (the transaction to be checked and your login).
• OVHcloud hosts the servers that run the chain, the endpoints, the sites and the analytics.
• Market data. Some pages read the ETH price in your browser from Coinbase’s public API; Coinbase then sees your IP address.
• Networks we connect to. Bridging and settlement go through Arbitrum and Hyperlane, which are public networks.

We may disclose data when the law requires it, to protect our users or services from fraud or abuse, or to a buyer if Gully Labs is sold, under this policy.

How long we keep it

Analytics hold no personal data. Server and container logs and rate-limit counters are kept only as long as needed to run and secure the services, then deleted or overwritten. Emails are kept as long as needed to answer you and keep a record of the conversation. On-chain data is permanent and outside our control.

Your rights

Wherever you live, you can ask us at [email protected] to see, correct, export or delete the personal data we hold about you, or to stop using it. We answer as soon as we can, and within the time the law requires. Depending on where you live (for example under the GDPR in the EU or UK, or state laws in the US such as California’s), you may have further rights, including to object, to restrict processing and to complain to your data protection authority. We will not treat you differently for using these rights.

Security and where data is processed

Traffic to our services is encrypted with TLS, our servers accept connections only through Cloudflare, and access to them is limited to the people who run them. Our servers are rented from OVHcloud, and Cloudflare processes data in many countries. By using the services you understand your data may be processed outside your country.

Children

The services are not meant for anyone under 18, and we do not knowingly collect data from children.

Changes and contact

When we change this policy we update the date at the top, and for a material change we say so on gullychain.xyz before it takes effect. Gully Labs LLC, Oregon, USA. Questions, requests or complaints: [email protected].