Terms of Service

These Terms are a draft. They have not been reviewed by counsel, they have not been adopted by the legal entity that will operate Privé, and they are not yet in force. We publish them now for transparency, so that anyone evaluating the project can read the terms we intend to apply before they apply to anyone.

Two consequences follow. One: this document will change. Several of its most consequential details are bracketed placeholders that counsel must fill before any version takes effect, and they are listed below so that nobody mistakes a placeholder for a decision. Two: the contracts are now deployed and live on chain ID 4663, so — unlike earlier versions of this draft — there is a running protocol to transact with. That the Terms governing it remain unreviewed is itself a risk you are accepting by using it.

Nothing in this draft waives anything or grants anyone a right they would not otherwise have. The risk disclosures, the description of the protocol's on-chain roles, the prohibited-conduct rules, and the assumption of risk describe how the Services must be used whenever they become available, and you should read them as written. Where this draft and the version that takes effect differ, the version in force at the time of your use governs.

• [Operating Entity] — the legal name and form of the entity that will operate Privé and be your counterparty under these Terms. No entity is named anywhere in this draft because none has been formed.
• [Registered Address] — the address for legal notices.
• [Governing Law] — the law that governs these Terms.
• [Forum] — the courts or arbitral seat that will hear disputes.
• [Dispute Resolution Mechanism] — whether disputes go to court or to arbitration, and the treatment of class or representative proceedings, each of which depends on the jurisdiction chosen.
• [Liability Cap] — the aggregate cap in the limitation-of-liability section. The figure shown there is illustrative only.
• [Restricted Jurisdictions] — the jurisdictions from which the interface will not be offered.
• [Effective Date] — the date the first operative version takes effect. This draft has none.

Privé is deployed on Robinhood Chain mainnet (chain ID 4663) as of 9 September 2026. The contracts listed below are live, the reserve asset they accept is Paxos USDG, and the protocol can be transacted with. This section replaces an earlier version of these Terms which stated that nothing was deployed; that statement was true when written and is no longer true.

Deployment is not a warranty. Every statement in these Terms about how the protocol behaves — one-for-one minting, redemption, shielding, proofs, the vault, the guardian, the blocklist, association sets — describes how the software is written and how it is intended to behave. That it is now running does not make it correct, audited, or safe. It has had no external audit (see § Experimental Software and the Absence of an Audit), and you should read that section before sending anything of value.

Verify addresses against this list and nothing else. Anything presented to you as a Privé contract, token, sale, presale, airdrop, whitelist, mint page, or liquidity pool that is not one of the addresses below is not ours, whatever it is called and wherever it appears. We publish addresses here and on useprive.app; we do not announce them by direct message, and we do not run sales.

• PriveDollar ($PUSD) — 0x23d253d6B69a1020D4A0933299e727418cC73174
• USDGVault — 0x8A1f4ccDB9f2D288f155910785517Eb711c26bDB
• MintRamp — 0xA2Fbf795407d5996378d2eE35fa0250D9bd4209d
• RedeemRamp — 0xe34b633052AD8f4463E9657b21910cdB5b4d3006
• ShieldedPool — 0x13761114204D38227b0661bC5d918Cb67a7Ef10C
• NoteMemo — 0xC27B36b2afBDe24fA526f10F8F66D15429079cE0
• Screening blocklist — 0xF9cA8766a800613625A4a63905902D6a99027A02
• Proof verifier (adapter) — 0xDfD90C8183ec24c4e866903142FcB5F9A5C636aB
• Guardian Safe — 0xc35A87C918C1586909715b67d99C8077b62a5355
• Reserve asset, USDG (Paxos, not ours) — 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168
• There is no $PRIVE token contract. Any token claiming to be $PRIVE is not ours.

By accessing, browsing, connecting a wallet to, or otherwise using any part of the Services, you acknowledge that you have read, understood, and agree to be bound by these Terms, in the form in which they are in force at that time, and by any additional policies referenced in them, including our Privacy Policy. If you use the Services on behalf of an entity, you represent that you are authorized to bind that entity, and "you" refers to that entity.

These Terms govern our Services — the website, the App, the documentation, and the software we publish. They do not and cannot govern the smart contracts themselves. Once deployed, the contracts are permissionless code that anyone can call from any client, or with no client at all; they have no terms of service, they do not know who you are, and no agreement with us is required to use them. If you interact with the contracts other than through our interface, you do so entirely at your own risk, without any of the checks our interface performs, and these Terms give you no rights against us in respect of that interaction.

If you do not agree with any part of these Terms, your only remedy is to stop accessing and using the Services. Your continued use after any changes to these Terms take effect constitutes acceptance of the revised Terms.

To use the Services you must be at least the age of majority in your jurisdiction and have the legal capacity to enter into these Terms. The Services are not directed to, and may not be used by, anyone who does not meet these requirements.

You are solely responsible for determining whether, and for ensuring that, your access to and use of the Services is lawful in your jurisdiction. We do not verify your identity, your residence, or your eligibility, and the fact that the interface loads for you is not a determination that your use is lawful. You represent and warrant that you are not located in, ordinarily resident in, or a national of any jurisdiction where accessing or using the Services is prohibited, and that you are not a person with whom we are prohibited from dealing under the sanctions and export rules described in the next section.

We may restrict access to the website or App from particular jurisdictions, including the jurisdictions listed at [Restricted Jurisdictions] once counsel has determined them. Any such restriction affects our interface only; it does not and cannot affect the deployed contracts, which are permissionless.

• You must meet the minimum legal age and have capacity to contract.
• You must not be a sanctioned or restricted party, or acting for or on behalf of one.
• You must not access the Services from, or on behalf of anyone in, a jurisdiction where such access is prohibited.
• You are responsible for your own compliance with all laws that apply to you, including tax, securities, financial-services, and anti-money-laundering laws.
• We perform no identity verification and no know-your-customer check; the absence of a check is not permission.

You represent and warrant, each time you use the Services, that you are not subject to sanctions administered or enforced by any competent authority — including those of the United States, the United Nations, the European Union, and the United Kingdom — that you are not listed on any sanctions, denied-party, or restricted-party list, that you are not owned or controlled by, or acting for or on behalf of, any such person, and that you are not located in or ordinarily resident in a comprehensively sanctioned territory.

The Services include cryptographic software, and software of that kind is subject to export-control and re-export rules in some jurisdictions. You agree not to export, re-export, or make the Services available to any person or in any territory where doing so would breach those rules, and you are responsible for identifying the rules that apply to you.

The protocol design includes an on-chain blocklist owned by the guardian, described below. An address on that blocklist cannot mint and cannot receive a redeem payout. That mechanism is a technical control on the ramps; it is not a sanctions screening service, it does not check every counterparty, it will not always be correct, and it does not discharge your own compliance obligations. Neither its presence nor its absence in any given case is advice about whether a transaction of yours is lawful.

If we believe your use of the Services breaches this section, we may restrict your access to the website and App. That is a restriction on our interface and nothing more: we cannot seize, freeze, move, or claw back your assets, and any assets you hold remain in your own custody.

Privé is non-custodial. The protocol operators never hold, control, or have access to your funds, your wallet, your private keys, your recovery phrase, or your shielded note secrets. You alone control your wallet and everything in it. There are no user accounts on the website, no logins, and no server-side database of user funds; there is nothing for us to sign into on your behalf and nothing we can move for you.

The Privé smart contracts are designed to be immutable. There are no proxies, no upgrade path, no migration hatch, and — once the one-time ramp wiring described under “The Guardian Role and Its Limits” has locked — no administrative withdrawal function. Once deployed, their logic cannot be changed by us or by anyone else — which also means it cannot be patched if a defect is found. Immutability is a protection against us and a risk to you at the same time, and both halves of that are true. The contracts are not deployed on any network today, and nothing in these Terms should be read as a representation that a live protocol exists or that any particular deployment will happen.

Because your assets remain in your own self-custody or in permissionless, immutable contracts you interact with directly, we cannot move, freeze, reverse, seize, or recover your self-custodied assets, and we cannot reverse or undo any transaction you sign. The same fact that prevents us from taking your funds prevents us from returning them if you make a mistake.

The website and App are convenience interfaces. They help you construct and broadcast transactions to Robinhood Chain, a public network, from your own wallet; they are software, not a financial service, and using them creates no account, no balance with us, and no claim against us. Zero-knowledge proofs for shielded operations are generated locally, in your own browser; no proving service acts on your behalf, no relayer submits for you, and no key material is delegated to anyone. The underlying contracts are permissionless and can be reached independently of our interface. We do not guarantee that the website or App will remain available, and their unavailability does not alter the operation of the on-chain contracts.

One limited on-chain role exists in the protocol and is described in full in "The Guardian Role and Its Limits" below, together with the conditions that apply to exiting the protocol. Read those two sections before you assume what the contracts can and cannot do to you.

We are not a bank, a deposit-taking institution, an exchange, a broker or broker-dealer, a custodian, a trust company, a money transmitter or money services business, a payment processor, an investment adviser, a fund, or a fiduciary. We do not hold client money or client assets. We do not effect transactions for your account, quote prices, match orders, operate an order book, provide liquidity, or take the other side of your trade. Every transaction you make is one you construct and sign yourself, sent from your own wallet to public contracts.

The interface performs no know-your-customer check, no identity verification, and no source-of-funds review. We do not collect your name, and we could not produce a customer record if asked, because we do not create one. The absence of these checks is a description of what the software does, not an opinion that your use is exempt from any obligation that applies to you. If your activity requires registration, licensing, reporting, or record-keeping where you live, that obligation is yours.

$PUSD is not a bank deposit, a savings or checking account, an e-money balance, a security, or a claim on us. It is not insured or guaranteed by any deposit-insurance scheme, government, central bank, or third party. $PRIVE is not offered as an investment, a security, a share, a note, or a participation in any enterprise, and nothing on our website is an offer or solicitation to buy or sell either token in any jurisdiction where such an offer or solicitation would be unlawful.

$PUSD (on-chain name "Prive Dollar," symbol PUSD) is designed to be a public, freely transferable, dollar-denominated ERC-20 token with six decimals. USDG (the "Global Dollar," issued by Paxos, six decimals) is the protocol's only reserve asset, and the USDG backing is designed to be held in an immutable vault contract. Because both tokens use six decimals, the intended one-for-one relationship is an exact integer one with no scaling factor in it.

The design has two ramps and no fee at either. Minting deposits USDG and issues an equal amount of $PUSD; redeeming burns $PUSD and pays out an equal amount of USDG. We charge no protocol fee on either side — you pay only the network gas for your own transaction. Both ramps screen an address, as described under "Screening at the Ramps." Minting is an entry and the guardian can pause it. Redeeming is an exit and has no pause path anywhere along it — not on the ramp, not on the burn, not on the vault payout — but it is still subject to the screening of the payout address and to the conditions set out under "Exits and the Conditions on Them."

Minting $PUSD does not make anything private. A freshly minted balance is an ordinary public ERC-20 balance: the mint transaction, the amount, and every subsequent transfer are visible on-chain to anyone, exactly as with any other token. Privacy is a separate, opt-in step. You may shield $PUSD into the shielded pool described below, and shielding, private transfer, and unshielding are proof-gated on-chain operations that you initiate and sign yourself. If you never shield, nothing about your $PUSD is private.

$PUSD is not interest-bearing and pays no yield, no rewards, no staking return, and no distribution of any kind. Holding it entitles you to no payment, dividend, or profit, and there is no mechanism in the design by which holding it earns anything.

We make no representation, warranty, or guarantee that $PUSD will maintain any particular value, will trade at or hold any peg to the U.S. dollar or to USDG, or that any level of secondary-market liquidity will exist. The value of $PUSD may deviate from one dollar on secondary markets, and on-chain redemption may be affected by network conditions, contract state, reserve availability, or an action by the issuer of the reserve asset. Because the backing is designed to consist of USDG, $PUSD inherits the characteristics and the risks of USDG, which are set out in full in the next section. You bear the full risk of holding, transferring, and redeeming $PUSD.

$PUSD is designed to be backed one-for-one by USDG, the "Global Dollar," a six-decimal ERC-20 issued by Paxos at 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168 on Robinhood Chain. Naming Paxos states a fact about what the protocol is designed to hold. Paxos has not reviewed, endorsed, sponsored, approved, or partnered with us, has no relationship with us, and owes you nothing on our account.

USDG is an issuer-controlled asset. Paxos retains the ability to freeze addresses and to wipe balances. This is a genuine and material property of the reserve, and it is not something an immutable contract can design around: anything that holds USDG inherits it, including the vault. If Paxos froze the vault's address, redemptions would stop for as long as the freeze lasted — the redeem function would still be unpausable, and it would still fail, because the asset it is trying to pay out could not move. If Paxos wiped a balance held by the vault, the backing behind $PUSD would fall by that amount and $PUSD could be left under-backed, with no mechanism in the protocol to restore it.

Neither we, nor the immutable contracts, nor the guardian could reverse, override, or appeal such an action. The guardian's powers do not extend to moving funds — subject to the one-time wiring window described under "The Guardian Role and Its Limits" — and no contract can compel an issuer to unfreeze an address. We have no agreement with Paxos, no service relationship, and no standing to act for you; we could not obtain relief on your behalf, and we would not be able to make you whole.

The same control can be exercised against you directly rather than against the vault. A freeze on your own address would leave you unable to deposit USDG to mint and unable to receive a USDG redemption payout, regardless of what the protocol permits. Your relationship with Paxos in respect of USDG, including any terms it imposes and any remedy it offers, is between you and Paxos.

USDG additionally carries the credit, custody, operational, banking, and regulatory risk of its issuer and of the institutions holding its own reserves. Any impairment there flows through to $PUSD one-for-one, because that is what backing one-for-one means. We publish no reserve attestation and make no representation about the composition, sufficiency, or verification of USDG's own reserves; those are matters for its issuer.

• Paxos can freeze addresses holding USDG, including the vault's.
• Paxos can wipe balances of USDG, including the vault's.
• A freeze on the vault halts redemptions for as long as it lasts, even though redeem itself has no pause path.
• A wipe reduces the backing behind $PUSD and the protocol has no mechanism to replace it.
• A freeze on your own address stops you minting and stops you receiving a redeem payout.
• We cannot reverse, appeal, or compensate for any of this, and we make no attestation about USDG's reserves.

$PRIVE is a token separate from $PUSD, and that separation is the most important thing to understand about it. It is intended as an ecosystem, access, and utility token, planned to launch on PONS. No date has been set for that launch — not a day, not a window, not a quarter — and no $PRIVE contract has been deployed on any network. $PRIVE is complementary to $PUSD and is never a second dollar.

$PRIVE is volatile and unbacked. It is not a stablecoin, it is not pegged to the U.S. dollar or to any other asset, no reserve stands behind it, no vault holds anything for it, and its value can fall to zero. Everything in these Terms about $PUSD's design — the one-for-one USDG backing, the immutable vault, the mint and redeem ramps — describes $PUSD only and says nothing whatsoever about $PRIVE. There is no ramp for $PRIVE, no redemption for $PRIVE, and no floor under it.

$PRIVE has no privacy features of its own. It does not enter the shielded pool, it is not shielded, unshielded, or privately transferable through the protocol, and holding it gives you no privacy of any kind. The privacy properties described in these Terms belong to shielded $PUSD alone.

The separation runs the other way too, and it is a design commitment rather than a preference: no $PRIVE mechanism may make $PUSD's one-for-one USDG backing, or its solvency, depend on $PRIVE. Every $PRIVE mechanism is designed to live outside the immutable core — the vault, the mint and redeem ramps, and the shielded pool never read a $PRIVE price, balance, supply, or contract address, and no $PRIVE holding, market movement, or failure can alter a $PUSD mint, redemption, or payout. Nothing about $PRIVE is a representation about $PUSD, and nothing about $PUSD is a representation about $PRIVE.

The points below are stated explicitly, so that none of them has to be inferred.

• $PRIVE is unbacked and volatile. It is not a stablecoin and is not pegged to the U.S. dollar or to any asset.
• $PRIVE is not redeemable — not for one dollar, not for USDG, not for $PUSD, not for anything.
• $PRIVE pays no yield and quotes no APY. There is no staking-for-returns, no revenue share, and no distribution of any kind.
• $PRIVE has no value-accrual mechanism, no buyback, and no burn program.
• Holding $PRIVE gives you no claim on protocol fees, on any treasury, or on the reserves backing $PUSD.
• $PRIVE confers no ownership, equity, debt, profit share, or governance right over us or over any entity, and is not offered as an investment.
• $PRIVE has no privacy features; it is a separate token from shielded $PUSD in every respect.
• $PRIVE can lose all of its value, and you should treat any amount you put into it as an amount you can afford to lose entirely.
• $PRIVE has no launch date. Any date, allocation, presale, whitelist, or sale presented as ours is not ours, and is an attempt to defraud you.

The protocol design includes one privileged on-chain role, the guardian, intended to be a Safe multisig from the moment of deployment. Its powers are narrow and they are fixed in immutable code, with one exception that exists only at deployment and is set out below. They are worth stating precisely rather than in summary, because a role that can affect what you can do at a given moment is a role you are entitled to see in full.

Three of the guardian’s powers are standing ones, exercisable at any point in the life of the protocol. It can pause entries — minting, shielding, and shielded transfer — which stops new value and new activity entering the system. It can append roots to the association set that gates the unshield operation; appending is append-only and irrevocable, so a root once accepted cannot be withdrawn or reversed, and the contract performs no plausibility check on what a root covers. And it owns the screening blocklist used at the ramps.

One further power exists, and it exists only once. The mint and redeem ramps must be wired to the token and to the vault, and that wiring is done by a guardian-only setter that permanently locks itself the first time it is called. Until the guardian calls it, the guardian can name any address as the token's minter and any address as the vault's redeem ramp — which for the length of that window means it could mint $PUSD with no reserve behind it, or route the reserve to an address of its choosing. Once called, the setter reverts forever and the wiring cannot be changed by anyone, including us. The lock is public state: before using a deployment, read whether the token reports its roles locked and the vault reports its ramps locked, and do not treat a deployment as finished until both read true.

Once that wiring is locked, the guardian cannot move, spend, or otherwise access user funds, and it cannot mint tokens. It cannot upgrade, replace, or alter contract logic, because there is no upgrade path to use. It cannot pause exits: redeem and unshield have no pause path in the code. It holds no key to your wallet, no copy of your note secrets, and no ability to decrypt anything of yours.

Two honest observations follow. Because appending a root is irrevocable and unchecked for plausibility, a mistaken or careless acceptance cannot be undone. And because unshielding requires an accepted root, a guardian that stops acting — through unavailability, key loss, disagreement, or legal compulsion — does not need any power over exits to affect them; the conditions in the next section explain exactly how.

As deployed, the guardian is a 2-of-3 Safe multisig at 0xc35A87C918C1586909715b67d99C8077b62a5355. Its three signing keys are software keys held by a single operator on one machine, not hardware wallets in separate hands. Stated plainly: the multisig threshold provides no meaningful isolation in this configuration, because one compromise of that machine is sufficient to act as guardian, and one loss of it destroys all three keys at once. Because guardian liveness gates unshielding (see § Exits and the Conditions on Them), the loss case is not merely a governance problem: it would leave shielded balances unwithdrawable. The Safe's owner set can be changed without redeploying, so this configuration can be improved; it has not been yet.

The one-time wiring power described above has now been used and has permanently locked itself. vault.rampsLocked and pusd.rolesLocked are both true on chain, and the underlying setters revert even when called by the guardian. The guardian therefore can no longer name a minter, which was the single largest power it ever held.

• Can: pause entries — mint, shield, and shielded transfer.
• Can: append association roots, irrevocably and without any plausibility check.
• Can: add addresses to, and control, the on-chain screening blocklist — and hand ownership of that blocklist to a different party, which the blocklist contract permits and which no code requires anyone to announce. Ownership of that blocklist contract can be transferred to another party, so who controls it is a thing to read on-chain rather than assume.
• Can, once and once only: wire the mint and redeem ramps to the token and the vault, using a setter that permanently locks itself the first time it is used. Before it is used the guardian could name an arbitrary minter or redeem ramp; after it is used, nobody can change the wiring.
• Cannot: move, spend, seize, or freeze user funds.
• Cannot: mint tokens or alter supply, once the one-time wiring above has locked.
• Cannot: upgrade, replace, or patch any contract.
• Cannot: pause redeem or unshield.
• Cannot: read, decrypt, or recover your keys or shielded notes.

Redeem and unshield are designed with no pause path. Neither the guardian nor we can switch them off, and no code exists to do so. That is a real property of the design and it is meaningful. It is not the same thing as a promise that you can always get out, and we will not describe it that way, because two separate conditions gate exits and both belong in the same breath as the first fact.

The first condition is at the redeem ramp. Redemption pays USDG to a payout address, and that payout address is screened against the guardian's blocklist. A blocklisted payout address is refused. Your $PUSD is not taken from you — the transaction simply does not succeed — but that address cannot receive the payout.

The second condition is at the shielded pool. An unshield reverts unless the guardian has already accepted an association root that covers your note. Until such a root exists, the withdrawal cannot be proven and the contract rejects it. Exit liveness from the shielded pool therefore depends on the guardian continuing to accept roots. If acceptance stops — because the guardian is unavailable, its keys are lost, its signers disagree, or it is legally compelled to stop — shielded notes cannot be withdrawn until acceptance resumes, and nobody else can accept a root in its place. There is no timeout, no fallback signer, and no escape hatch that lets a note out without a covering root.

Beyond those two, ordinary conditions apply to any on-chain exit: the network must be available and must include your transaction, you must be able to pay gas, the reserve must be there to pay out, and an action by the issuer of the reserve asset can stop a payout regardless of what the contract permits. We state all of this together because the fact that exits cannot be paused, taken alone, would leave you with a more comfortable impression than the design supports.

• Redeem and unshield have no pause path — not for us, not for the guardian.
• A blocklisted payout address is refused at the redeem ramp.
• An unshield reverts unless the guardian has already accepted an association root covering the note, so exit liveness depends on the guardian continuing to accept roots.
• A newly shielded note cannot be withdrawn until a covering root has been accepted.
• Network availability, gas, reserve solvency, and issuer action are further conditions on any exit.

The design screens addresses at the two legible boundaries of the system rather than everywhere. Minting screens the address of the caller. Redeeming screens the payout address — the address that would receive USDG. The list used for both is the on-chain blocklist owned by the guardian.

A screening hit means a transaction does not execute. It does not mean anything is confiscated: a refused mint leaves your USDG where it was, and a refused redemption leaves your $PUSD where it was. What a blocklisted address cannot do is mint, or take delivery of a redemption payout. You may still hold and transfer $PUSD, because $PUSD is an ordinary ERC-20 and ordinary transfers are not screened.

Neither shielded transfers nor unshielding are screened against the blocklist: the pool never consults it, and a blocklisted address can still receive an unshield payout. The exit-side control for the shielded pool is the association-set requirement described above — a different mechanism with different consequences. Together they are a Privacy-Pools style arrangement: screening at the public boundaries, membership proof at the private exit.

Screening is a mechanism, not a judgment about you, and it can be wrong. Lists are compiled by fallible processes, and an address can be listed by association with activity that is not yours — for example, because it received funds from a listed address. There is no automatic appeal built into an immutable contract. If you believe an address has been listed in error you can contact support, but we make no commitment as to outcome or timing, and you should not plan on being able to redeem to any one particular address.

The shielded pool is a commitment tree with nullifiers. Shielding moves public $PUSD into the pool and inserts a commitment representing a private note; spending a note publishes a nullifier, which prevents the same note being spent twice without revealing which note it was. Everything is opt-in: funds become private only when you take the separate step of shielding them.

Zero-knowledge proofs are generated locally, in your own browser. There is no delegation, no relayer, and no prover service, so no third party learns what you are proving and no third party can prove on your behalf. The practical cost of that choice is yours to bear: proving requires a reasonably capable device, can take time and memory, and may fail or be impractical on constrained hardware. We do not warrant that proving will succeed on any particular device.

A withdrawal from the pool proves two things at once: membership in the pool's commitment tree, and membership in an association set the guardian has accepted. That is what makes an unshield conditional on an accepted root, as described above.

The shielded transfer and unshield functions carry a fee and a fee recipient that are bound into the proof — the values you prove are the values the contract enforces. The client we ship always sets that fee to zero. A different client could set it to something else, so read what you sign; a proof binds the fee, it does not make it zero for you.

Be precise about what privacy you are getting. The amount you shield and the amount you unshield are public, as are the addresses that call shield and unshield and the timing of those calls. A private in-pool transfer is also a public transaction: it emits an event, and it is submitted from your own wallet and pays its gas in the clear, so an observer sees that your address made a private transfer at a given moment even though what moved, and between whom, stays hidden. What the pool conceals is the linkage between a deposit and a later withdrawal, the amounts moved inside it, and your in-pool balances. That concealment is only as strong as the crowd it hides in, and the anonymity set today is tiny — at launch, effectively empty. A separate structural limit applies: the transfer circuit consumes two real input notes, so a user holding exactly one note cannot make a private transfer until they hold another. Do not treat a small pool as offering the privacy a large one would, and do not use the pool as though it were anything other than what it is.

• Public: the amount shielded, the amount unshielded, the calling addresses, the timing, and the fact that a private transfer happened — every shielded operation is an ordinary public transaction sent from an address that pays its gas in the clear.
• Private, subject to the size of the anonymity set: the link between a deposit and a withdrawal, the amounts moved inside the pool, and your in-pool balances. Not private: that you transacted at all, and from which address.
• Proofs are generated on your device; no relayer, no prover service, no delegation.
• An unshield requires a guardian-accepted association root covering the note.
• The transfer fee and fee recipient are proof-bound; the shipped client sets the fee to zero.
• One note is not enough to transfer privately — the circuit needs two real inputs.
• The anonymity set is currently very small, and a small set gives correspondingly weak privacy.

The privacy features exist for ordinary users making ordinary payments who would rather their salary, rent, balances, and counterparties not be public by default. That is the posture of the design: privacy at the level a bank statement has, with screening at the legible boundaries — mint entry and redeem payout — and association-set membership at the private exit. It is not built to defeat compliance, and it must not be used as though it were.

Disclosure is opt-in and it belongs to you. Viewing keys let you disclose your own shielded history to someone you choose — a counterparty, an accountant, an auditor, a court — without giving up the ability to spend. We hold no viewing key of yours and no copy of your notes, so we cannot make such a disclosure for you, and we cannot be compelled to make one on your behalf; equally, we cannot help you prove anything if you have lost the material to prove it with.

The interface performs no know-your-customer check, and that fact cuts both ways. It does not screen you, and it does not clear you. Your obligations under anti-money-laundering, sanctions, tax, and reporting law are unaffected by the absence of a check at our end.

You may not use the Services, and in particular the privacy features, to launder money, to conceal or obscure the proceeds of criminal activity, to finance terrorism, to evade sanctions, to defeat a lawful investigation, to defraud anyone, or otherwise to break the law or facilitate any unlawful conduct. Any such use is a material breach of these Terms and is strictly prohibited. You are solely responsible for the legality of your use of the privacy features under the laws that apply to you, and you should take your own advice before using them if your circumstances make that question a real one.

Your shielded identity is derived from two separate wallet signatures, never one. A view signature derives read-only material: it unlocks reading your own shielded balance and decrypting note memos addressed to you, and it can never move funds. A separate spend signature authorizes sending and withdrawing, and registers your receiving key on a new device. The split is deliberate — a site or party that obtains a view signature learns what you hold, and still cannot spend it. That is a limit on the damage, not immunity from it: treat both signature prompts as seriously as you treat any signature.

Only externally owned accounts are supported. Smart-contract wallets and passkey-based signers are refused, and the reason is not preference. Their signatures are not deterministically reproducible, so a key derived from one could not be re-derived later; your notes would become unrecoverable the moment the signer changed anything. Refusing them is how the design avoids handing you an identity that quietly cannot be restored. Supported connectors are MetaMask, Coinbase Wallet, and Phantom, each a third-party product governed by its own terms.

Your note secrets live encrypted in your own browser's storage and nowhere else. There is no server-side copy, no backup held by us, no escrow, no key-recovery service, and no administrative override. If you lose the wallet that produces your signatures, or clear your browser storage without having exported a backup, the notes cannot be recovered by anyone — including us. This is not a policy we could make an exception to under any circumstances, because we do not hold the material an exception would require. The loss is permanent and total for the affected notes.

The same applies to your wallet itself. If you lose your private key or recovery phrase, or if either is compromised, your funds are gone or exposed and no reset, restoration, or reversal by us is possible. Back up your recovery phrase and your exported notes, keep them offline and separate, and never enter or share either. We will never ask you for a recovery phrase, a private key, a note secret, or a signature outside the App, and anyone who does is attempting to defraud you.

• Two signatures: a view signature that can read but never spend, and a spend signature that authorizes sending and withdrawing.
• Externally owned accounts only; smart-wallet and passkey signatures are refused because they are not reproducible.
• Note secrets are encrypted in your browser; we hold no copy and there is no server-side backup.
• Losing the wallet, or clearing browser storage without a backup, destroys access to those notes permanently, for everyone including us.
• Export and back up your notes before you clear storage, change browsers, or change devices.
• We never ask for keys, phrases, note secrets, or out-of-app signatures.

The protocol is designed for Robinhood Chain, an EVM network with chain id 4663 (testnet 46630), whose public block explorer is at robinhoodchain.blockscout.com. Robinhood Chain is operated by a third party. We do not operate it, we have no control or influence over it, and naming it states where the software is designed to run — exactly as any project names the network it deploys on. It does not imply any relationship, endorsement, sponsorship, approval, partnership, or affiliation, and none exists.

A network of this kind depends on infrastructure a third party runs, including transaction sequencing. Sequencer-level transaction filtering and chain-level censorship are real properties of such networks: a transaction you have signed can be delayed, reordered, dropped, or prevented from executing, for reasons outside your control and outside ours. No immutable contract can compel a network to include a transaction, and an unpausable exit function is of no use if the transaction calling it is never included. This is a factual property of the environment the protocol runs in, and it is disclosed for that reason.

Force inclusion does not solve this, and we would rather say so than let you assume otherwise. Robinhood Chain settles to Ethereum, and its delayed inbox is open: anyone can submit a transaction through Ethereum and, after a delay currently set to four days, force the chain to include it. That guarantees inclusion. It does not guarantee execution. The chain's operator can register a transaction hash on the chain itself, and a registered transaction is skipped and its gas consumed no matter how it arrived — the check runs in the chain's own state-transition rules, which apply to force-included transactions exactly as they apply to ordinary ones, and deposits and retryable tickets that are filtered this way are redirected to an address the operator sets rather than returned to you. We verified this against the deployed contracts and the node software, not from documentation. Treat force inclusion as a delay-resistance mechanism, not as an exit guarantee.

Other network-level events can affect you in similar ways: outages and halts, upgrades and hard forks, chain reorganisations, changes to fee mechanics or to the rules of the chain, sustained congestion, and the discontinuation of the network itself. Any of these can make transactions fail, become expensive, or become impossible for a period, and any of them can affect the value or transferability of assets held on the chain.

We select and support the network as a matter of engineering, and we may support others in future. We make no representation about the security, decentralisation, governance, uptime, or continued existence of Robinhood Chain or of any network we support, and we accept no responsibility for the acts, omissions, or policies of its operator.

The design charges no protocol fee for minting or redeeming $PUSD. You pay the network gas for the transactions you send, and nothing to us. Gas is paid to the network, not to us; it is not refundable, and a transaction that reverts still costs the gas it consumed.

The shielded transfer and unshield functions include a fee and a fee-recipient parameter that are bound into the zero-knowledge proof. The client we ship always sets that fee to zero, so a transfer you make through our App pays no fee to anyone. Because the parameter exists in the contract, a different client could set it to a non-zero value; the proof binds whatever value is used, so review what your wallet shows you before signing.

Third parties may charge you for their own services — wallet providers, RPC providers, exchanges, bridges, and on-ramps set their own fees and spreads, and none of that reaches us or is controlled by us.

If we ever introduce a fee for a service of ours, or for anything related to $PRIVE — the separate, unbacked, volatile ecosystem token described above, which is not a stablecoin and can go to zero — we will disclose it before it applies. No such change could alter a deployed immutable contract, so the ramps described here cannot acquire a fee after the fact.

The Services, the website, the whitepaper, the documentation, and any content we provide are for general informational purposes only and do not constitute financial, investment, legal, accounting, or tax advice, nor a recommendation, solicitation, or offer to buy, sell, or hold any token or to enter into any transaction. No fiduciary or advisory relationship is created by your use of the Services, and we owe you no duty to consider your circumstances, objectives, or suitability.

Nothing we publish promises a return. There is no yield, no APY, no interest, and no reward programme in the design of either token, and any material that appears to offer one is not ours.

Statements about our roadmap, intended deployments, planned features, or future launches are statements of present intention only. They are forward-looking, they depend on matters outside our control, and they are not commitments, guarantees, or contractual obligations. Plans change and plans fail.

You are solely responsible for evaluating the merits and risks of any transaction and for determining its treatment under the laws that apply to you. You should consult your own qualified financial, legal, and tax advisors before using the Services or transacting in any token.

You are solely responsible for determining what taxes apply to your use of the Services and for reporting and paying them. Depending on where you are, minting, redeeming, shielding, unshielding, transferring, receiving, swapping, or disposing of a token may each be a taxable event, and the treatment of shielded transactions in particular may be unsettled where you live.

We do not withhold, collect, or remit any tax on your behalf, we do not issue tax statements or information returns, and we could not do so: there are no accounts, no user records, and no server-side history of your activity to draw on. Keep your own records as you go, including exports of your shielded notes, because we cannot reconstruct your history for you later and neither can anyone else.

No external audit of Privé exists. No third party has reviewed, certified, verified, or approved the contracts, the zero-knowledge circuits, or the client, and no audit report, attestation, or formal-verification result has been produced. We do not describe any part of this system as audited, and if you see a claim that it is audited, that claim is not ours and is false.

The software is experimental and unproven in production. Zero-knowledge systems are an area where defects are unusually hard to see: a circuit can be under-constrained in a way that passes every test and still permits an invalid proof, and errors of that kind have caused total losses in other protocols. The client, the proving code, and the contracts have not been through the adversarial review that a system holding value should have.

Immutability compounds this. Because there is no upgrade path, a defect found after deployment cannot be patched, hot-fixed, or migrated away from. The most that could be done is to pause entries, which stops new value arriving and does nothing for value already inside.

Use the Services accordingly. Do not commit funds you cannot afford to lose entirely, do not treat this as a substitute for a bank, and do not size your exposure on the assumption that a defect will be caught in time. If you find a vulnerability, tell us at support@useprive.app; we welcome reports, and we make no promise of a bounty, a timeline, or a reward.

You understand and accept that using blockchain networks, digital assets, and experimental smart-contract software carries significant risk, and you assume all such risk. The risks below are the ones we consider material; the list is not exhaustive, and the absence of a risk from it is not a representation that it does not exist.

• Pre-deployment risk: the Privé contracts are not deployed on Robinhood Chain mainnet and nothing there is live. A rehearsal deployment exists on the Robinhood testnet using a test reserve token with no value, for testing only. No version of the protocol has been externally audited or verified by anyone.
• Smart-contract risk: the contracts may contain bugs, vulnerabilities, or errors, may behave unexpectedly, and are immutable and cannot be patched; an exploit or defect could result in the total loss of funds.
• Zero-knowledge risk: circuits may be under-constrained or incorrectly implemented in ways that are hard to detect and that could permit invalid proofs or leak information; proving may also fail or be impractical on your device.
• Market and volatility risk: the value of digital assets can be volatile and may fall to zero. $PUSD is designed to hold a one-for-one relationship with its reserve, but there is no guarantee of value, peg, liquidity, or a market; $PRIVE is unbacked and volatile by design, and there is no floor under it at all.
• Reserve-asset and issuer risk: $PUSD's backing is designed to consist of USDG, issued by Paxos. Paxos retains the ability to freeze addresses and to wipe balances, and anything holding USDG — including the vault — inherits that; a freeze on the vault would halt redemptions for as long as it lasted, a wipe would reduce the backing, and immutable contracts cannot override either. USDG also carries the credit, custody, operational, and regulatory risk of its issuer, all of which flows through to $PUSD.
• Second-token risk: $PRIVE is a separate, unbacked, volatile token that is not a stablecoin, is not redeemable, pays nothing, has no privacy features, and may lose all of its value. It is not part of $PUSD's backing, and holding it entitles you to nothing.
• Chain and censorship risk: Robinhood Chain is operated by a third party. Sequencer-level transaction filtering and chain-level censorship are real properties of such a network, and a transaction you sign can be delayed, reordered, dropped, or prevented from executing. Outages, halts, forks, reorganisations, and congestion can have similar effects. Force inclusion through Ethereum is open to anyone after a four-day delay, but it compels inclusion only, not execution: a transaction hash the operator has registered on-chain is skipped and its gas burned however it was submitted. There is no tested escape hatch, and you should not rely on one.
• Exit-condition risk: redeem and unshield have no pause path, but a blocklisted payout address is refused at the redeem ramp, and an unshield reverts unless the guardian has already accepted an association root covering the note — so exit liveness from the shielded pool depends on the guardian continuing to accept roots. If acceptance stops, withdrawals stall until it resumes, and no one else can accept a root in its place.
• Guardian risk: the guardian can pause entries, controls the blocklist, and appends association roots irrevocably and without any plausibility check; a mistaken acceptance cannot be undone, and an unavailable or compelled guardian affects the shielded exit even though it cannot pause it. Separately, the one-time wiring of the ramps to the token and the vault is a guardian-only action that locks permanently on first use, and until it locks the guardian could name an arbitrary minter or redeem ramp.
• Screening risk: an address can be blocklisted by association rather than by conduct, screening can be wrong, and there is no automatic appeal in an immutable contract.
• Anonymity-set risk: privacy in the shielded pool comes from the crowd of other shielded notes, and that set is currently very small — at launch, effectively empty. A user holding exactly one note cannot make a private transfer at all, because the transfer circuit consumes two real input notes. Do not treat a small pool as offering the privacy a large one would.
• Key-loss and storage risk: your wallet keys, recovery phrase, and shielded note secrets are the sole means of controlling your funds; note secrets live only in your browser's storage, and clearing that storage, losing the device, or losing the wallet without a backup destroys access permanently, with no recovery possible by anyone including us.
• Irreversibility: blockchain transactions are final once confirmed; a mistaken, fraudulent, or unintended transaction cannot be reversed by us or anyone, and a transfer to a wrong address is unrecoverable.
• Public-token risk: $PUSD outside the shielded pool is an ordinary public ERC-20, and your balances, transfers, counterparties, and timing are visible on-chain to anyone, including to analytics firms that link addresses to identities.
• Front-running and ordering risk: public transactions can be observed before they confirm and can be reordered or exploited by others in ways that affect your outcome.
• Phishing and impersonation risk: fake sites, fake tokens, fake support accounts, and fake sales are common in this industry; a signature obtained by deception can cost you everything, and we will never contact you first or ask for keys.
• Regulatory risk: laws and regulations affecting digital assets, stablecoins, and privacy technology are evolving and uncertain; changes could adversely affect the Services, either token, or your ability to use them, potentially without notice.
• Third-party and infrastructure risk: wallets, RPC providers, hosting, email relay, the underlying network, and other third-party services may fail, be compromised, become unavailable, or behave unexpectedly, which is outside our control.
• Availability risk: we may suspend or discontinue the website or App at any time, and although the contracts remain reachable without us, doing so requires technical ability you may not have.

To use the Services you connect a self-custodied wallet you control. Supported wallet connectors are MetaMask, Coinbase Wallet, and Phantom. These wallets, and any browser extensions or software you use with them, are provided by third parties, are governed by their own terms and privacy policies, and are solely responsible for the custody of your keys and the signing of your transactions. We do not control and are not responsible for any third-party wallet.

The off-chain footprint of the Services is deliberately small. The website is a frontend plus a small number of serverless routes: one that relays a support message you choose to send us, and read-only routes that report the health of the root operator and serve indexed pool logs. Those read-only routes carry no data of yours — the status route takes a chain id and nothing else — but your browser calls the status route on a timer while the dashboard is open, so the requests land in our hosting provider's ordinary log with your IP address. They are not triggered by shielding, sending or withdrawing, so their timing is not correlated with any action you take.

Some third parties necessarily observe information in the course of serving your requests, and it is fairer to name what each of them sees than to leave it implied. The list below is a plain description, not an endorsement of any provider's practices.

We are not responsible or liable for the acts, omissions, availability, security, accuracy, or content of any third-party service, and inclusion of or reference to any third party — including any network, wallet, issuer, hosting provider, or venue we name — does not constitute an endorsement by them of us, or by us of them, and does not imply any affiliation, partnership, or sponsorship.

• Your wallet provider: sees the addresses you use, the transactions you sign, and typically the sites you connect to; it holds your keys, not us.
• RPC providers: see the requests your browser makes to the network, including the addresses and data queried, together with your IP address and timing — the same visibility any node operator has.
• The blockchain itself: is public and permanent; every public transaction, address, amount, and timestamp is visible to anyone, forever, and cannot be deleted.
• Block explorers you visit: see your IP address and whatever you look up.
• Vercel (hosting): serves the site and, like any web host, processes standard request data such as IP address, user agent, and requested path.
• Resend (email relay): processes the content of a support message you choose to send and the address you give us so that we can reply.
• The issuer of the reserve asset: controls USDG and can act on addresses holding it, as described above.
• Robinhood Chain's operator: runs the network the protocol is designed for, including sequencing, and can affect whether a transaction is included.

Except for content that is open-source, on-chain, or otherwise expressly made available under a separate license, the website, App, whitepaper, documentation, text, graphics, design, the Privé and usePrive names and marks, and other materials we provide are owned by us or our licensors and are protected by intellectual-property laws. Subject to your compliance with these Terms, we grant you a limited, personal, non-exclusive, non-transferable, revocable license to access and use the Services for their intended purpose.

You may not copy, modify, distribute, sell, lease, reverse-engineer (except to the extent this restriction is prohibited by applicable law), or create derivative works from any part of the Services or our materials except as expressly permitted by us in writing or by an applicable open-source license. All rights not expressly granted are reserved. The names, logos, and marks of third parties are the property of their respective owners, and we claim no rights in them.

The Privé and usePrive names and marks may not be used to imply an affiliation, endorsement, or sponsorship that does not exist, or in a manner likely to cause confusion, including in connection with impersonation, fake tokens, or fraudulent schemes.

If you send us feedback, suggestions, or bug reports, you grant us a non-exclusive, perpetual, irrevocable, royalty-free license to use them without restriction or obligation to you. Please do not send us anything you consider confidential.

You agree not to engage in, and not to attempt or assist others in, any of the following in connection with the Services.

• Violating any applicable law, regulation, or sanction, or using the Services to facilitate any unlawful activity.
• Using the privacy features to launder funds, conceal proceeds of crime, finance terrorism, evade sanctions, defeat a lawful investigation, or otherwise break the law.
• Accessing the Services from, or on behalf of anyone in, a prohibited jurisdiction, or while a sanctioned or restricted party.
• Circumventing, or attempting to circumvent, the screening at the ramps, any access restriction we apply, or any technical control in the Services, including by using another address or another person to do what you could not.
• Interfering with, disrupting, overloading, or attempting to gain unauthorized access to the Services, our infrastructure, or any related systems, including via scraping, denial-of-service, or exploitation of vulnerabilities.
• Abusing the support route or its anti-abuse mechanisms, including by automated submission or by sending false, misleading, or abusive information.
• Impersonating Privé, our team, or any other person or entity, or misrepresenting your affiliation with any of them, including by operating a site, token, social account, or support channel that presents itself as ours.
• Representing that Privé is audited, certified, endorsed, partnered with, or affiliated with any company, or that it offers yield, a return, or a guaranteed value — none of which is true.
• Deploying or promoting a modified client that sets a non-zero shielded-transfer fee, or otherwise alters what a user signs, without disclosing it clearly to that user.
• Introducing malware or malicious code into the Services or into anything you distribute in connection with them.
• Infringing the intellectual-property or other rights of any person, or using the Services to defraud, deceive, or harm others.

The Services and all related software, content, and materials are provided "as is" and "as available," with all faults and without warranties of any kind, whether express, implied, statutory, or otherwise. To the fullest extent permitted by law, we disclaim all warranties, including any implied warranties of merchantability, fitness for a particular purpose, title, non-infringement, and any warranties arising from course of dealing or usage of trade.

We do not warrant that the Services will be uninterrupted, timely, secure, error-free, or free of harmful components; that any defect will be corrected; that the results obtained from the Services will be accurate or reliable; that any token will maintain any value, peg, or liquidity; that the immutable contracts are free of vulnerabilities; that proofs will generate successfully on your device; that any transaction you sign will be included by the network; that the guardian will accept any association root, or accept one within any period; or that any deployment will occur at all.

No external audit of the contracts has been performed, and we make no claim that any part of the system has been audited, certified, verified, or reviewed by any third party.

No advice or information, whether oral or written, obtained from us or through the Services, creates any warranty not expressly stated in these Terms. Some jurisdictions do not allow the exclusion of certain warranties, so some of the above exclusions may not apply to you to the extent prohibited by applicable law, and nothing here affects rights you have that cannot be excluded by agreement.

To the fullest extent permitted by applicable law, in no event will Privé, its operators, affiliates, contributors, officers, employees, agents, or licensors be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, data, goodwill, digital assets, or business opportunity, arising out of or relating to your access to or use of, or inability to access or use, the Services or any tokens, whether based in contract, tort, negligence, strict liability, or any other legal theory, and whether or not we have been advised of the possibility of such damages.

Without limiting the foregoing, we are not liable for any loss arising from smart-contract defects or exploits, errors in zero-knowledge circuits or proving code, price volatility or loss of value or peg, an act of the issuer of the reserve asset including a freeze or a wipe, network-level filtering, censorship, congestion, forks, or outages, the acts or omissions of the guardian, a screening decision at a ramp, the unavailability of an association root, irreversible or mistaken transactions, loss or compromise of your keys, recovery phrase, or note secrets, the acts or omissions of third-party wallets, RPC providers, hosting or email providers, or your failure to comply with applicable law.

To the fullest extent permitted by law, our total aggregate liability for all claims relating to the Services will not exceed [Liability Cap]. Until counsel sets that figure, treat it as the greater of the total amount of fees you paid to us directly for use of the Services in the twelve months preceding the event giving rise to the claim, or one hundred U.S. dollars (USD 100) — an illustrative placeholder in this draft, not a decided term. Note that the design charges no protocol fee, so the first limb of that measure would ordinarily be zero.

Some jurisdictions do not allow certain limitations of liability, so some of the above limitations may not apply to you to the extent prohibited by applicable law; in such cases our liability is limited to the maximum extent permitted. Nothing in these Terms excludes or limits any liability that cannot be excluded or limited under applicable law, including liability for fraud, for fraudulent misrepresentation, or for death or personal injury caused by negligence.

You agree to indemnify, defend, and hold harmless Privé, its operators, affiliates, contributors, and their respective officers, employees, agents, and licensors from and against any and all claims, demands, actions, damages, losses, liabilities, costs, and expenses (including reasonable legal fees) arising out of or relating to your access to or use of the Services, your violation of these Terms, your violation of any law or of the rights of any third party, any tokens you acquire, hold, transfer, or dispose of, or any transaction you sign.

This obligation does not extend to any claim to the extent it arises from our own fraud, wilful misconduct, or gross negligence, or to any liability that cannot lawfully be shifted to you.

We reserve the right, at our own expense, to assume the exclusive defense and control of any matter otherwise subject to indemnification by you, in which case you agree to cooperate with our defense of that claim and not to settle it without our written consent. This indemnification obligation survives the termination of these Terms and your use of the Services.

We may, at our discretion and without notice or liability, suspend, restrict, or discontinue the website or App, in whole or in part, or restrict your access to them, including where we reasonably believe doing so is necessary to comply with law, to protect the Services or other users, or to address a security issue.

It is worth being clear about the limit of that power, because the limit is in your favour. Suspending the interface cannot suspend the contracts. The contracts, once deployed, are permissionless and immutable, and they do not check whether our website is up or whether we have restricted you. Your keys remain yours, your notes remain yours, your balances stay where they are, and you can continue to interact with the contracts directly using any client, or none. We intend to keep contract addresses and interfaces published so that direct interaction remains practical. Nothing we do to our interface can move, freeze, seize, or reverse anything of yours.

The honest caveat is that direct interaction requires technical ability, and generating a shielded proof without our client is not something most users could do. Losing the interface is a real inconvenience even though it is not a loss of custody.

You may stop using the Services at any time. The provisions of these Terms that by their nature should survive termination — including the token disclaimers, assumption of risk, disclaimers, limitation of liability, indemnification, governing law, and the general provisions — will survive.

These Terms, and any dispute or claim arising out of or in connection with them or their subject matter (including non-contractual disputes or claims), are governed by the law of [Governing Law], without regard to its conflict-of-laws principles. Disputes will be resolved in [Forum], by the mechanism set out at [Dispute Resolution Mechanism], and you submit to that forum, except where mandatory law grants you the right to bring proceedings in, or requires the application of the law of, another jurisdiction.

Those three items are placeholders. The operating entity, [Operating Entity], has not been formed, so no jurisdiction has been chosen and no forum has been agreed. Whether disputes go to a court or to arbitration, and how class or representative proceedings are treated, are questions that depend on the jurisdiction ultimately chosen and on the consumer-protection rules that apply there; counsel will settle them, and the version of these Terms that takes effect will state them plainly rather than by reference to a bracket.

Nothing in this section limits your responsibility to comply with the laws that apply to you in your own jurisdiction, and no choice of governing law deprives you of the protection of any mandatory consumer or other law of your place of residence that cannot be derogated from by agreement.

Before commencing any formal proceeding, we ask that you contact us at support@useprive.app with a description of the dispute so that we have a genuine opportunity to resolve it. That request is not a condition on your rights and does not extend or shorten any limitation period.

These Terms, together with any policies expressly referenced in them (including our Privacy Policy), constitute the entire agreement between you and us regarding the Services and supersede any prior or contemporaneous understandings on that subject. If any provision of these Terms is held to be invalid, illegal, or unenforceable, that provision will be enforced to the maximum extent permissible and the remaining provisions will remain in full force and effect.

Our failure to enforce any right or provision of these Terms is not a waiver of that right or provision, and no waiver is effective unless made in writing. You may not assign or transfer these Terms or any of your rights or obligations under them without our prior written consent; we may assign these Terms in connection with a reorganization, transfer, or similar event. These Terms do not create any partnership, joint venture, agency, or employment relationship between you and us, and they create no rights in any third party. We will not be liable for any failure or delay in performance to the extent caused by events beyond our reasonable control.

Notices to you may be given by posting them through the Services. Notices to us should be sent to support@useprive.app and, once the operating entity is formed, to [Operating Entity] at [Registered Address]. Section headings are for convenience only and do not affect interpretation. These Terms are written in English; any translation is provided for convenience, and the English version governs in the event of a conflict.

We may update or modify these Terms from time to time. When we do, we will revise the "Last updated" date shown above and post the updated Terms through the Services. Changes are effective when posted unless we indicate otherwise, and the version that takes effect will say so and will carry an effective date in place of [Effective Date].

Where a change is material — for example, a change to the dispute-resolution mechanism, to the limitation of liability, or to the description of what the protocol can do to your funds — we will try to give reasonable advance notice through the Services before it takes effect. We cannot notify you individually, because we hold no contact details for you unless you have written to us.

Your continued access to or use of the Services after the updated Terms take effect constitutes your acceptance of them. If you do not agree to the revised Terms, you must stop using the Services; your on-chain assets are unaffected by that choice, because they were never ours to hold.

If you have questions about these Terms, you can reach us through the support form on the website or by email at support@useprive.app. Messages sent through the form are relayed by email; there is no ticketing system, no account, and no chat log held about you.

Our only channels are the website at useprive.app and that support address. We do not run a support desk on any messaging platform, we do not send direct messages first, and we do not offer allocations, sales, or recoveries. Anyone contacting you as Privé through any other channel is not us.

Please do not include your recovery phrase, private keys, or shielded note secrets in any message to us. We will never ask for them, we could not use them to help you, and anyone who does ask is attempting to defraud you.