Privacy Policy

Version 2026-10-04Read together with the Terms of Service

This Privacy Policy describes the categories of personal data processed by the Operator of goated in connection with the Service, the purposes and legal bases of such processing, the recipients to whom data may be disclosed, the periods for which it is retained, and the rights available to data subjects. Capitalised terms carry the meanings assigned in the Terms of Service. The Operator acts as data controller in respect of the processing described herein.

01Categories of Data Processed

Account data: username, password (stored exclusively as a salted scrypt hash), optional email address, referral relationships, account settings, and the version and timestamp of Terms accepted.
Profile and User Content: profile configuration, links, uploaded files, custom code, templates, guestbook entries, reports and support correspondence.
Telegram data: where you elect to link Telegram, your Telegram user identifier and display name, used for notifications, login codes and account recovery.
Transactional data: Star balances and ledger entries, Virtual Item ownership and transfer history, marketplace, auction and offer activity, and payment invoices, including cryptocurrency transaction hashes and amounts.
Technical and security data: salted one-way hashes derived from IP addresses (raw IP addresses are not retained in our database), browser user-agent strings recorded in the login history, session identifiers, and rate-limiting counters.
Page analytics: for each unique view of a profile and each link click, the date, the referring website (host name only), the visitor's country as indicated by our network provider, and the device category (desktop, mobile or tablet). No IP address or identifier of the visitor is stored with these records, which are retained for 120 days and made available to the profile owner in aggregate form.
Mail alias data: messages received at addresses you create on our mail domains, including sender, subject and body.

The Service does not knowingly collect special categories of personal data, and Users should refrain from submitting such data in User Content.

02Purposes and Legal Bases

Performance of contract: creating and operating your Account, rendering your profile, crediting Stars, executing transactions and delivering Virtual Items.
Legitimate interests: securing the Service, preventing fraud, reward abuse and multi-accounting, enforcing the Terms and Community Guidelines, measuring aggregate usage, and improving functionality, in each case balanced against your rights and expectations.
Legal obligation: retaining transactional records, responding to lawful requests from competent authorities, and complying with sanctions and anti-money-laundering requirements where applicable.
Consent: optional features such as linking Telegram or providing an email address, which may be withdrawn at any time through your account settings.

The Operator does not sell personal data. Personal data may be disclosed to the following categories of recipient, solely to the extent necessary for the purposes stated above:

Payment processors (such as NOWPayments) that facilitate cryptocurrency invoices, and public blockchains on which transactions are inherently recorded.
Telegram, for the delivery of messages to Users who have linked their accounts.
Email delivery providers (such as Resend), for transactional email including password recovery and support replies.
Hosting and infrastructure providers, including server, storage, content delivery and network security providers acting as processors on the Operator's behalf.
Embedded content providers: profile pages may load fonts from Google Fonts, emoji artwork from Google's servers, embedded media from YouTube or Spotify, and Discord presence data from Lanyard, at the election of the profile owner. Such providers may receive the visitor's IP address and browser information in accordance with their own policies.
Competent authorities and advisers, where disclosure is required by law, necessary to establish, exercise or defend legal claims, or necessary to protect the rights, property or safety of the Operator, Users or the public.

Information you publish on your profile, including your username, display content, collectibles, names and transaction history associated with public Virtual Items, is visible to the public by design.

04Cookies and Local Storage

The Service uses strictly necessary cookies only: a session cookie that keeps you signed in (HttpOnly, SameSite=Lax) and, where applicable, a referral cookie that attributes your registration to the person who invited you for up to thirty (30) days. The Service does not deploy advertising or cross-site tracking cookies. Certain interface preferences may be held in your browser's local storage and never leave your device.

05Retention

Personal data is retained for as long as your Account remains active and thereafter only for so long as necessary for the purposes described above. Upon deletion of your Account, profile data, links, files, mail and personal settings are erased without undue delay. Transactional records, ledger entries and security logs may be retained, in pseudonymised form where practicable, for the periods required to satisfy legal, accounting, fraud-prevention and dispute-resolution obligations. Expired sessions, login codes and password-reset codes are purged automatically.

06Security

The Operator implements technical and organisational measures appropriate to the risk, including password hashing, transport encryption, two-step verification, CSRF and clickjacking protections, rate limiting, access controls on administrative functions and audit logging. No method of transmission or storage is entirely secure, and the Operator cannot guarantee absolute security.

07Your Rights

Subject to applicable law, you may have the right to access, rectify, erase, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. You may exercise the following directly within the Service:

Access and portability: download a complete machine-readable copy of your data from Account → Download my data.
Rectification: update your username, email and profile at any time.
Erasure: permanently delete your Account from Account → Delete account, subject to Section 5 and to the forfeiture provisions of the Terms.

Other requests may be submitted through the support page. The Operator may need to verify your identity before acting on a request. You may also lodge a complaint with the data protection authority in your jurisdiction.

08Children

The Service is not directed to children under sixteen (16) years of age, or the higher minimum age of digital consent in their jurisdiction. The Operator does not knowingly process the personal data of such children and will delete it upon becoming aware of it.

09International Transfers

Personal data may be processed in jurisdictions other than your own, including by the service providers identified in Section 3. Where required, such transfers are conducted subject to appropriate safeguards recognised under applicable data protection law.

10Changes to this Policy

This Policy may be updated from time to time. The version identifier above indicates the operative text. Material changes will be notified through the Service, and may require re-acceptance as provided in the Terms.

goated — Privacy Policy, version 2026-10-04. Questions and requests: support.