Privacy Policy — Ava Protocol

Last updated: 2026-11-03

This Privacy Policy describes how Ava Protocol ("we", "us", "our") collects, uses, and protects information when you visit avaprotocol.org (the "Site"), fill in one of our forms, sign up through a form we run on an advertising platform, or receive email from us.

Our products have their own policies, which apply in addition to this one when you use them:

Ava is non-custodial software. Nothing on the Site asks you to connect a wallet, and we never ask for private keys, seed phrases, or recovery phrases.

1. Who We Are

Ava Protocol operates the Site and is the data controller for the information described below.

Contact: contact@avaprotocol.org

2. Information We Collect

2.1 Information you give us

Beta access and product-page forms — your email address; optionally, your Telegram @username so we can help you get set up personally; on some pages, an optional short description of what you want Ava to do; and the identifier of the product page you submitted from. We store the description with your email so we can follow up on it, and we repeat it in the confirmation email. These forms appear on our product pages, including when you reach them from an ad on a phone.
Newsletter and blog subscription forms — your email address.
Contact form — your first and last name, email address, company (optional), and message, plus whether you ticked the box to receive our updates.
Sign-up forms on advertising platforms — when we run a lead form on a platform such as X, the platform shows you the fields we ask for (normally your email address and, optionally, your handle on that platform), often pre-filled from your account there. The platform then passes your answers to us. The platform's own privacy policy also applies to that form.

2.2 Information collected automatically

Campaign and click information. When you arrive from a link we published or an ad we ran, the Site records the campaign parameters in that link (utm_* values), the advertising click identifier if the platform added one (for example X's twclid), the page you landed on, the page that referred you, and the time. We store this in a first-party cookie named ava_attribution for 90 days, set for .avaprotocol.org so that our web app at app.avaprotocol.org can read the same value, and in your browser's local storage. The local-storage copy has no expiry date, and the Site uses it to restore the cookie on later visits, so deleting cookies alone does not remove it (see section 5). These values are attached to a form you submit and to the short start reference used when you open the Ava Telegram bot from the Site, so we can tell which message brought you to us.
Browser and device information. Your browser's user-agent string is sent with the beta-access form so we can tell in-app browsers (which cannot open Telegram) from ordinary ones. Your IP address is processed by our hosting provider and by our spam protection, which limits how many times a form can be submitted from one address in a short period.
Usage analytics. We use Google Analytics 4 to understand how the Site is used (pages viewed, events such as button taps, approximate location, device and browser type). We use the X pixel to measure whether an ad led to an action on the Site, such as a sign-up. We use Sentry to collect error reports when something on the Site breaks; those reports can include technical details such as your IP address and browser.
Spam protection. Our forms use Cloudflare Turnstile, which checks that a submission comes from a real browser. Turnstile may process technical information about your browser for that purpose.

2.3 Information we do NOT collect

We never collect, request, or store your private keys, seed phrases, or recovery phrases. The Site never asks you to connect or sign with a wallet.
We do not collect payment or card details on the Site.
We do not buy information about you from data brokers, and we do not build advertising profiles of you.

3. How We Use Your Information

Deliver what you asked for — send you the link to open Ava in Telegram after you request access, confirm a newsletter subscription, and answer your contact message.
Product updates — email you about Ava when you requested access or ticked the box asking for updates. Every such email carries an unsubscribe link.
The blog newsletter — email you new posts when you subscribed to them, and only then.
Measure our marketing — understand which pages and campaigns bring people to Ava and, where an advertising platform provided a click identifier, report back to that platform that the click led to a sign-up. We send the platform the click identifier and the event, not the content of your form.
Keep the Site working and secure — detect spam and abuse, debug errors, and maintain the service.

We do not sell your information, and we do not build advertising profiles of our own. X and Google receive data through their pixel and analytics tags and use it under their own privacy policies, including to measure and optimise the ads we run on X.

Where the law requires a legal basis for processing, ours are: your consent (product updates, the blog newsletter, and analytics and advertising cookies); the steps needed to provide what you asked for (your access link, a subscription confirmation, a reply to your message); and our legitimate interests (keeping the Site secure, preventing spam, and measuring which campaigns bring people to Ava). You can withdraw consent at any time as described in section 8.

4. Email and Your Choices

Transactional email (your access link, a subscription confirmation, a reply to your message) is sent because you asked for it.
Product updates and the blog newsletter are sent only to the list you joined. You can leave any list with the unsubscribe link in the email, or by writing to us.
Our email is sent through Bento, our email service provider, from addresses at avaprotocol.org.

5. Cookies and Similar Technologies

ava_attribution — a first-party cookie, valid for 90 days, holding the campaign and click information described in section 2.2. Also mirrored in local storage, where it has no expiry date.
Google Analytics cookies (for example _ga) — used to recognise returning browsers for usage statistics.
X pixel cookies — used by X to match an ad click to an action on the Site.

Your choice. If you visit from the European Economic Area, the United Kingdom or Switzerland, a banner asks before we set the analytics, advertising and campaign storage above; nothing non-essential is stored until you choose. Everywhere else it is on by default. In both cases the Privacy choices link in the footer lets you change your mind at any time, and we remember your choice in a first-party cookie named ava_consent for six months.

You can block or delete cookies in your browser settings; the Site still works without them. Because the attribution data is also kept in local storage, and the Site restores the cookie from that copy, deleting cookies alone does not remove it: clear your browser's site data for avaprotocol.org (cookies and local storage together) to remove both. Without it we simply cannot credit the campaign that brought you here.

6. Who We Share Information With

We share information only as needed to run the Site and the services above. Most of the providers below process it on our behalf and under our instructions; Google and X also use the data their tags collect for their own purposes, under their own privacy policies:

Vercel — hosting, content delivery, and the serverless functions that handle our forms.
Bento — email delivery and our subscriber lists.
Google — Google Analytics.
X Corp. — the X pixel and conversion reporting; and, when you use a lead form on X, the collection of that form.
Cloudflare — Turnstile spam protection.
Upstash — the store behind our form rate limiting.
Sentry — error monitoring.
Our own web app at app.avaprotocol.org, which receives your beta-access details and campaign information so that your sign-up can be linked to your conversation with the Ava Telegram bot.
Telegram — when you open the Ava bot from the Site, Telegram handles that hand-off under its own policy.

Some of these providers are located in the United States or other countries outside your own. We may also disclose information where the law requires it or to protect our rights, our users, or the public.

7. Retention

Email addresses and the details you submitted with them stay on our lists until you unsubscribe or write to contact@avaprotocol.org asking us to delete them.
The attribution cookie expires after 90 days.
Analytics and error data are kept for the periods set by the providers above and, in our own systems, only as long as needed for security, debugging, and legal compliance.

8. Your Rights

Depending on where you live, you may have the right to access, correct, or delete your information, to object to or restrict how we use it, to receive a copy of it, and to withdraw consent at any time. You can unsubscribe from any email list with the link in the email. To exercise any other right, contact contact@avaprotocol.org; we will respond within the time the applicable law allows. If you are in the EU, the UK, or another jurisdiction with a data protection authority, you may also complain to that authority.

9. Children

The Site and our services are not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect information from them.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by the "Last updated" date above and, where appropriate, announced on the Site.

11. Contact

Questions about this Privacy Policy or your information: contact@avaprotocol.org