Privacy Policy

This policy covers the NFT Gallery Widget iOS app, its Home Screen widget, and nftgallerywidget.com (together, the “Services”). The Services are provided by Ümit Gül under the Curious Code name.

Questions or privacy requests can be sent to hello@curiouscode.xyz. The app's license terms are Apple's Standard EULA.

The app handles the following information to provide your gallery:

• a public wallet address or ENS name that you choose to add, plus the blockchain you select;
• public NFT and POAP information returned for that identifier, including token and contract identifiers, titles, descriptions, collection names, event or acquisition dates, and artwork URLs;
• choices you make in the app, such as favorites, hidden items, and per-widget display settings; and
• downloaded artwork needed to display the gallery and widget.

Collection records, favorites, hidden states, and artwork are stored in the app's local App Group container so the app and widget can use the same gallery. iOS stores each widget's display configuration. Curious Code does not operate an account database or cloud profile for this app and does not receive a copy of this local gallery.

A wallet address and its blockchain history are public. Depending on how you use a wallet elsewhere, others may be able to associate that public address with you. Never enter a private key, recovery phrase, or other secret into the app.

The gallery needs an internet connection to retrieve public data and artwork. When you add or refresh a collection, the app sends the public wallet address or ENS name and selected network to:

• Alchemy for supported Ethereum-compatible NFT collections; or
• the POAP API for POAP collections.

The app then downloads artwork from the URLs supplied in those API responses. These may be hosted by Alchemy, Cloudinary, POAP, or the original project's content host. Like any internet request, the receiving service can see technical request data such as the IP address and user agent needed to deliver and secure its service. Each provider processes that information under its own terms and privacy practices.

Curious Code uses these providers only to return the collection and media you requested. It does not sell wallet addresses, use them for advertising, or build advertising profiles from them.

Gallery+ subscriptions and offer-code redemption are handled by Apple through StoreKit and the App Store. Apple processes your Apple ID, payment method, billing, and transaction records under the App Store privacy notice. The app receives subscription and entitlement status so it can unlock paid features; Curious Code does not receive your card or bank details.

The app does not contain TelemetryDeck, an advertising SDK, or a third-party usage analytics SDK. Apple may provide Curious Code with aggregated App Store, subscription, crash, and usage reports. App usage and diagnostic reports depend on your Apple device's analytics sharing choices and are designed by Apple not to identify you personally.

The website has no account, wallet input, checkout, or contact form. If you choose a light or dark theme, that preference may be stored in your browser's local storage.

The site is hosted by Vercel and uses Vercel Web Analytics and Speed Insights. Web Analytics records anonymous, aggregated information such as page path, referrer, approximate location, browser, operating system, and device type. It does not use advertising cookies; Vercel identifies a visitor with a request-derived hash that resets daily. Speed Insights records anonymous page-performance measurements such as Web Vitals, route, browser, device type, operating system, country, and network speed. See Vercel's Web Analytics privacy information and Speed Insights privacy information.

Vercel also processes ordinary request and security data, which can include IP address, user agent, requested URL, timestamps, and related logs, to host, deliver, protect, and operate the website. See the Vercel Privacy Notice.

If you email support, Curious Code receives the address, content, and attachments you choose to send and uses them to respond to you and resolve the request.

App collection data remains on your device until you remove it. From Settings, you can manage individual collections or use “Delete All Collections and NFTs” to remove imported collections, NFT records, favorites, hidden states, gallery data used by the widget, and the artwork cache from the device. Cached artwork is also automatically limited by age and storage size. Deleting local app data cannot remove records that already exist on a public blockchain or data independently held by a network provider.

Website analytics and hosting data are retained by Vercel according to the applicable product, account plan, security needs, and legal obligations. Support emails are kept only as long as reasonably needed to handle the request, maintain relevant records, and meet legal obligations.

Reasonable safeguards are used, but no device, storage system, or internet transmission can be guaranteed completely secure.

You control which public identifiers you add. You can remove app data in Settings, change Apple analytics sharing in iOS Settings, and stop website analytics by using browser or network content-blocking tools. Because Curious Code does not maintain an app account or server-side copy of your gallery, there is normally no central gallery record for Curious Code to access, correct, or delete on your behalf.

Depending on where you live, you may have rights concerning personal information held in support correspondence or other records. Contact hello@curiouscode.xyz to make a request. We may need enough information to verify and respond to it.

The Services are not directed to children under 13, and Curious Code does not knowingly collect personal information from children. If you believe a child has sent personal information through support, please contact us so it can be addressed.

This policy may be updated when the Services or their providers change. The revised version will be posted here with a new “Last updated” date.