TokonGet the app

Tokon

Privacy Policy

Last updated: October 16, 2026

This policy explains how Cardencer SAS handles personal data when you use the Tokon mobile application (the “App”), in accordance with the EU General Data Protection Regulation (GDPR), the French Data Protection Act and the privacy laws of the U.S. states that apply to our users.

1. Data controller

Cardencer SAS, RCS Marseille 101 350 494, 15 rue Pierre Laurent, 13006 Marseille, France. Contact: privacy@cardencerit.com.

2. Data we collect

  • Sign-in data: the email address you sign in with, or the identifier and email address shared by Apple or Google when you use “Sign in with Apple” or “Continue with Google”.
  • Profile: the @username you choose, the traders you follow and who follows you.
  • Wallet addresses: the public addresses of the wallets created for you in the App.
  • Transactions: the swaps and transfers made with your App wallets (token, amounts, date, transaction hash), as recorded on the public blockchain.
  • Content: the posts you publish, including the token you tag.
  • Technical data: IP address and request logs, kept by our servers and providers for security and to operate the service.
  • On your device only: your preferences (appearance, notifications) and your watchlist are stored on your phone and are not sent to us.

The App contains no advertising, no third-party analytics or tracking, and we do not sell personal data.

3. Data we never access

  • Private keys: your wallets are self-custodial. Their keys are secured by our wallet provider Privy and only you can sign transactions; we never see or store them, including when you export your key.
  • Card and identity data: card purchases are handled by MoonPay, which collects your payment details and identity verification documents directly under its own privacy policy. We do not receive them.
  • Biometric data: Face ID is handled by iOS on your device. We never receive biometric data.

4. Purposes & legal bases

  • Providing the App — your account, wallets, swaps, portfolio, feed, posts, follows and leaderboard — performance of our contract with you (Art. 6(1)(b) GDPR).
  • Security, fraud and abuse prevention, including spam and manipulation in the feed — our legitimate interest (Art. 6(1)(f) GDPR).
  • Support — answering your requests — our legitimate interest (Art. 6(1)(f) GDPR).
  • Legal obligations, such as responding to lawful requests from authorities (Art. 6(1)(c) GDPR).

5. Public information

The App is social. Your @username, your posts, the traders you follow, the trades made with your App wallets and your leaderboard ranking are visible to other users. Blockchain transactions are public by nature: anyone can see them with a blockchain explorer, and they cannot be modified or deleted by anyone, including us.

6. Social logins

When you sign in with Apple or Google, we receive the profile information that provider shares with us, usually your email address (or an Apple relay address if you chose to hide it) and an account identifier. We use it only to create and secure your account. Apple and Google process your data under their own privacy policies.

7. Service providers

We share data only with the providers needed to run the App, acting on our instructions or as independent controllers:

  • Privy — sign-in and wallet infrastructure (sign-in data, wallet addresses).
  • Apple and Google — when you choose to sign in with them.
  • MoonPay — card purchases, as an independent controller, when you choose to buy with a card.
  • Blockchain infrastructure — RPC providers (such as Helius) and swap routing (such as Jupiter) receive your wallet address and transaction requests in order to read balances and execute swaps.
  • Hosting — the providers hosting our servers and database.

Market data providers (prices, charts) receive no personal data. Our providers act under contracts that require them to protect your data and use it only to provide their services. We never sell or rent personal data.

8. Third-party websites

The App may link to third-party websites and services, such as token websites, blockchain explorers or social networks. Data you provide to them is not covered by this policy; please review their own privacy policies.

9. Retention & deletion

  • Account, profile, posts and follows: as long as your account exists.
  • Technical logs: up to 12 months.

You can delete your account at any time in the App (Portfolio › Settings › Delete account). This deletes your profile, posts, follows and feed history, and your sign-in account at Privy. Your wallets are deleted with your account and cannot be recovered: send your funds to another wallet first. Transactions already recorded on the blockchain remain public.

10. International transfers

Some providers, such as Privy, MoonPay and Helius, process data in the United States. In that case we rely on an adequacy decision (such as the EU-US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses.

11. Your rights (EEA, UK)

You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, and to set instructions regarding your data after your death. To exercise these rights, contact privacy@cardencerit.com; we respond within one month.

You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07).

12. U.S. state privacy rights

If you reside in a U.S. state with a consumer privacy law — such as California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah or Texas — you may have the right to:

  • know the categories and specific pieces of personal information we collect, use and disclose;
  • access your personal information and obtain a portable copy of it;
  • correct inaccurate personal information;
  • delete your personal information, subject to legal exceptions (you can also delete your account in the App);
  • opt out of the sale or sharing of personal information, targeted advertising and profiling;
  • not be discriminated against for exercising these rights.

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising or for profiling that produces legal or similarly significant effects. The categories of personal information we collect are those described in Section 2: identifiers (email address, username, wallet addresses, IP address), commercial information (your on-chain transactions), internet activity (request logs) and the content you post. We collect them for the purposes described in Section 4 and disclose them only to the service providers listed in Section 7. We do not knowingly collect sensitive personal information beyond what is needed to sign you in. California residents may also request, once a year, information about any disclosure of personal information to third parties for their direct marketing purposes; we make no such disclosures.

To exercise these rights, email privacy@cardencerit.com from the email address of your account. We will verify your identity by matching the information you provide with the information we hold, and respond within forty-five (45) days, which may be extended once by forty-five (45) days when reasonably necessary. You may use an authorized agent, who must provide proof of their authorization. If we decline your request, you may appeal by replying to our decision; we will answer your appeal within sixty (60) days, and if it is denied you may contact your state Attorney General. As we do not track you across third-party websites or apps, browser “Do Not Track” signals have no effect on our processing.

13. Minors

The App is intended for adults only: you must be at least 18 years old to use it. We do not knowingly collect data from minors. If we learn that a user is under 18, we will deactivate the account and delete their data promptly. If you believe a minor uses the App, contact privacy@cardencerit.com.

14. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS), authenticated access to our API and restricted access to our systems. No transmission or storage technology is completely secure, however, and we cannot guarantee absolute security.

15. Changes

We may update this policy from time to time. The “Last updated” date at the top of this page indicates the latest version; we will inform you in the App of material changes. See also the Tokon Terms of Use.

16. Contact

Cardencer SAS, 15 rue Pierre Laurent, 13006 Marseille, France
privacy@cardencerit.com