Privacy Policy

Information pursuant to Art. 13 GDPR. Last updated: 29 August 2026.

1. Controller

The controller responsible for data processing on this website is:

2. Hosting and server log files

This website is hosted on Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, and Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany.

Whenever you visit this site, the hosting provider automatically processes information that your browser transmits, in particular:

• IP address of the requesting device
• date and time of the request
• the file or URL requested
• amount of data transferred and status code
• browser type, browser version, and operating system
• referrer URL (the page visited immediately before this one)

This data is processed solely to ensure reliable, secure delivery of the website and to defend against attacks (e.g. DDoS). It is not combined with data from other sources. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in the technically error-free and secure operation of the site). We use Cloudflare's Free plan without Logpush configured, so we do not receive or store raw request logs ourselves; Cloudflare's own retention of this data is governed by its privacy policy, not by a period we set.

Because Cloudflare, Inc. is a US company, your data may be processed outside the EU/EEA, including in the United States. This transfer relies on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and/or Cloudflare's certification under the EU-US Data Privacy Framework, where applicable. Further information is available in Cloudflare's privacy policy. Cloudflare's Data Processing Addendum is incorporated by reference into the Self-Serve Subscription Agreement that applies automatically to Free-plan accounts, so no separate agreement needs to be signed.

Our Cloudflare account has Bot Fight Mode enabled account-wide to block malicious automated traffic, and this applies to every hostname once it is proxied through Cloudflare. Once active, Cloudflare places a __cf_bm cookie to calculate a bot score for the connection (expires after 30 minutes of inactivity), and - only if you are ever shown and pass a security challenge - a cf_clearance cookie confirming that (also 30 minutes). Both are strictly necessary for defending the site against automated abuse, so no consent banner is required (§ 25(2) TDDDG); the legal basis is Art. 6(1)(f) GDPR. See §4 below for how this interacts with the “no cookies” statement.

3. Fonts

This website uses the Literata and Sora typefaces. The font files are served from our own server; no connection is made to third-party font services (e.g. Google Fonts), and your IP address is not transmitted to any third party when fonts are loaded.

4. Cookies and analytics

This website does not use tracking and does not embed any analytics or advertising services. The only cookies ever set here are the two security-related Cloudflare cookies described in §2 (__cf_bm, and cf_clearance if you're challenged) - both strictly necessary, so no consent banner is shown.

5. Wallets and on-chain interactions

Some pages on this website (in particular the testnet token faucet at token.nocturne-standards.org) let you paste a wallet address or connect a wallet extension (DuskDS Moonlight and/or DuskEVM). When you do, the address you provide is sent to our testnet faucet service (testnet.faucet.nocturne-standards.org) and, where used, related ticket endpoints, solely to check rate limits and deliver test funds.

This processing is limited to operating a public testnet faucet and defending it against abuse. We do not use these addresses to build advertising or marketing profiles. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in running a secure public testnet faucet). Blockchain addresses can be personal data in context; once a transaction is submitted on-chain, that activity is public by the nature of the network.

The faucet is testnet-only. It does not involve real monetary transactions or the transfer of funds with monetary value on a production network.

We do not embed third-party wallet user interfaces that transmit your data to third parties beyond what your own wallet extension does when you choose to connect it.

6. Contact by email

If you contact us by email, we process the information you provide (your email address and any other details you voluntarily include) solely to handle your inquiry. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in responding to inquiries) or, where the inquiry concerns entering into an agreement (e.g. a joint project), Art. 6(1)(b) GDPR (pre-contractual measures). We delete this data once it is no longer needed for that purpose, unless we are legally required to retain it.

7. External links

This website links to external resources, including GitHub (GitHub, Inc., a Microsoft company), Nocturne service hosts (for example Consensus, Phoenix, and Supply), the testnet faucet host, and other project pages. Following such a link takes you away from this website; the privacy practices of the respective provider apply there. No third-party content is embedded on this site.

8. Your rights

Under applicable law, you have the right at any time to:

• access the personal data we hold about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of data we hold about you (Art. 17 GDPR)
• restriction of processing, where the legal requirements are met (Art. 18 GDPR)
• data portability, where you have consented to processing or a contract exists (Art. 20 GDPR)
• object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)

Where you have given us consent, you may withdraw it at any time with effect for the future (Art. 7(3) GDPR). An informal message to contact@nocturne-standards.org is sufficient to exercise any of these rights.

9. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the German state (Bundesland) where you live, work, or where the alleged infringement occurred. The authority responsible for the controller is:

10. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place on this website.

11. Changes to this policy

This privacy policy is current as of the date above. We will update it as needed if the site's functionality changes or legal requirements change. The version published here is the one that applies.