Privacy Policy

We collect the following categories of personal data:

• Account & identity data: full name, username, email address, and (optionally) phone number, provided when you register and manage your account.
• Authentication data: a securely hashed password and email-verification status. We never store your password in plain text.
• Financial & transaction data: your gold balances, USDT balances, deposits, withdrawals, stakes, returns, bonuses, and redemption history generated through your use of the Service.
• Blockchain & wallet data: your BSC (Binance Smart Chain) deposit and withdrawal wallet addresses, and the on-chain transactions associated with your account. Blockchain data is public by nature.
• Network & referral data: your referral code and your relationships within the affiliate network (your sponsor and your referred members), used to calculate ranks and bonuses.
• Shipping data: your name, postal/shipping address, country, and phone number, collected only when you redeem HGold rewards for physical items.
• Device & push data: a device push-notification token and platform type, used to deliver notifications if you enable them.
• Usage & analytics data: aggregated, privacy-friendly usage metrics (such as page views) collected via our analytics provider to help us improve the Service.

We use your personal data to:

• create and administer your account and authenticate you;
• process deposits, withdrawals, stakes, returns, bonuses, and redemptions, and maintain accurate balance and transaction records;
• operate the affiliate network, including calculating ranks and referral bonuses;
• fulfil physical reward redemptions and arrange delivery to your shipping address;
• send you service-related communications and, where enabled, push notifications about your account activity;
• protect the Service against fraud, abuse, and security threats, and comply with our legal obligations;
• maintain, troubleshoot, and improve the Service.

We do not sell your personal data. We share it only as necessary to operate the Service:

• Service providers who process data on our behalf under contract, including our database and authentication host (Supabase), hosting and analytics provider (Vercel), email delivery (Resend), and push-notification delivery (Google Firebase Cloud Messaging).
• The blockchain. Deposit and withdrawal transactions are recorded on the public Binance Smart Chain and are visible to anyone.
• Within the affiliate network, limited information (such as your username) may be visible to your sponsor and direct referrals as part of network and rank functionality.
• Legal and safety. Where required by law, regulation, legal process, or to protect the rights, property, or safety of Hibiscus Gold, our users, or others.

We retain your personal data for as long as your account is active and as needed to provide the Service. We may retain certain records (such as transaction and financial history) for longer where required to comply with legal, accounting, or regulatory obligations, or to resolve disputes and enforce our agreements. Note that data recorded on the public blockchain cannot be altered or deleted by us.

We apply technical and organizational measures designed to protect your personal data, including encrypted connections, hashed passwords, strict server-side access controls, and row-level database security. Private keys that authorize fund movements are held in secured server environments and are never exposed to the app or stored in our user database. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Subject to applicable law, including the Malaysian PDPA, you may have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your account and associated personal data, subject to records we must retain by law;
• withdraw consent to optional processing, such as push notifications;
• object to or limit certain processing of your data.

To exercise any of these rights, contact us at dev@hgold.app. You can also delete your account from within the app or by contacting us.

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

Our service providers may process and store data in countries outside your own. Where personal data is transferred internationally, we take steps to ensure it remains protected in accordance with this policy and applicable law.

We may update this Privacy Policy from time to time. When we do, we will revise the “Effective date” above and, where appropriate, notify you through the Service. Your continued use of the Service after an update constitutes acceptance of the revised policy.

If you have questions or requests regarding this Privacy Policy or your personal data, contact us at:

Hibiscus Gold
Email: dev@hgold.app