Skip to content
Randoo

Privacy Policy

Last updated: 26 August 2026

This Privacy Policy explains what information the operators of Randoo ("Randoo", "we", "us" or "our") collect when you use the Randoo website at randoo.xyz, its documentation, playground, verification tools, console, APIs and SDKs (the "Site"), and when you interact with the Randoo coordinator smart contracts and oracle (the "Protocol"), how we use it, and the choices you have. It forms part of our Terms of Service.

Randoo is operated pseudonymously and is designed to collect as little personal information as possible. Most of the Site can be used without creating an account and without sending us any personal information at all.

1. Information we collect

1.1 Information you give us

  • Account information. If you create a Console account, we store the email address and display name you provide and a salted hash of your password. We never store your password in plain text. If you sign in through the identity of a hosting or platform provider, we store the identifier that provider gives us for your account.
  • Console records. Names and labels you assign to API keys, subscriptions and consumer contracts, the blockchain addresses of those contracts, and the balances, fees and request history associated with them. API keys are stored only as a hash and a short prefix; the full key is shown to you once and cannot be recovered by us.
  • Inputs to tools. Values you type or paste into the playground, the verification tool or other interactive parts of the Site, such as request hashes, transaction hashes, contract addresses and gas parameters. These may be sent to our servers or to third-party blockchain RPC endpoints to be looked up.
  • Correspondence. Anything you choose to send us through a contact channel published on the Site.

1.2 Information collected automatically

  • Server and infrastructure logs. Like every website, the Site and its APIs are served by hosting, database and edge providers that automatically record technical information about each request, such as your IP address, browser type and version, operating system, referring page, the pages or endpoints requested, timestamps and error information. We use this only to run, secure and debug the Services.
  • Session data. When you sign in to the Console, a session token is kept in your browser's session storage so you stay signed in; it is removed when you close the tab or sign out. The token is stored on our side only as a hash, together with an expiry time.
  • Request telemetry. For each randomness request handled by the oracle we record the request identifiers, the consumer contract address, network, gas parameters, fee, proof, timing and status information needed to fulfil the request, retry it, refund unused gas and publish aggregate statistics.

We do not use advertising cookies, tracking pixels, fingerprinting or third-party analytics on the Site. We do not set any cookie of our own. Our hosting providers may set strictly necessary cookies for security purposes such as bot protection.

1.3 Blockchain information

The Protocol runs on public blockchains. When your contract sends a request, the transaction, the calling address, the value sent, the request parameters, the seed, the proof and the fulfilment transaction are recorded permanently on the public ledger and can be read by anyone, including us. We read this data through public RPC endpoints and indexers to operate the oracle and to present it to you on the Site. Blockchain data is public, immutable and outside our control. We cannot edit or delete it, and this Policy does not apply to the blockchain itself.

2. How we use information

We use the information described above to:

  • provide, operate, secure, maintain and improve the Site and the Protocol, including fulfilling randomness requests and processing refunds;
  • authenticate you, keep you signed in and manage your API keys;
  • show you your own request history, balances and statistics in the Console;
  • publish aggregate, non-identifying statistics such as request counts, latency percentiles and success rates;
  • detect, prevent and respond to abuse, fraud, attacks, security incidents and violations of our Terms;
  • comply with legal obligations and respond to lawful requests from authorities; and
  • respond to you if you contact us.

Where the EU or UK General Data Protection Regulation applies, our legal bases are: performance of the agreement formed by our Terms (account, console and request processing); our legitimate interests in running a secure, reliable service, in understanding aggregate usage and in defending legal claims; and compliance with legal obligations. We do not use your information for automated decision-making that produces legal or similarly significant effects, and we do not sell it.

3. How we share information

We do not sell, rent or trade personal information. We share it only:

  • with service providers that host, store, deliver or protect the Services on our behalf, such as web hosting and edge providers, database providers, serverless and worker platforms, and blockchain RPC and indexing providers, each of which processes information only as needed to provide its service to us;
  • on public blockchains and through public interfaces, as described in Section 1.3, where request data is by design visible to everyone;
  • for legal reasons, where we believe in good faith that disclosure is required by law, regulation, legal process or governmental request, or is necessary to enforce our Terms, to protect the rights, property or safety of Randoo, our users or others, or to detect and address fraud or security issues; and
  • in connection with a transfer, if the Services or the responsibility for operating them are transferred to a successor operator, in which case the information may be transferred with them.

4. International transfers

Our service providers operate globally, and information may be stored and processed in countries other than the one you live in, including countries whose data-protection laws differ from yours. Where required, we rely on lawful transfer mechanisms such as standard contractual clauses offered by our providers. By using the Services you acknowledge that your information may be transferred in this way.

5. Retention

We keep account and Console information for as long as your account exists and for a reasonable period afterwards to resolve disputes and enforce our Terms. We keep request telemetry for as long as it is needed to operate the oracle, publish statistics and investigate incidents. Infrastructure logs are retained by our providers under their own default retention periods, typically a short number of days or weeks. We may retain information longer where the law requires it or where it is stored in aggregated or anonymised form. Blockchain data cannot be deleted by anyone.

6. Security

We use reasonable technical and organisational measures appropriate to a small, pseudonymous project, including encrypted transport, hashed passwords, hashed API keys and session tokens, and access controls on our infrastructure. No system is perfectly secure, and we cannot guarantee that information will never be accessed, disclosed, altered or destroyed by a breach of our safeguards. You are responsible for keeping your credentials, session tokens, API keys and wallet keys secure.

7. Your rights and choices

Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, to withdraw consent where processing is based on consent, and to lodge a complaint with a data-protection supervisory authority.

You can exercise these rights by contacting us through a contact channel published on the Site. We may need to verify your identity before acting on a request. We will respond within the time required by applicable law. Please note that we cannot alter or delete information recorded on a public blockchain, and that we may retain certain information where the law permits or requires it.

You can delete session data at any time by signing out or closing your browser, and you can revoke API keys from the Console.

California residents. We do not sell or share personal information for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes other than those permitted by law. You have the rights to know, delete, correct and non-discrimination described in the California Consumer Privacy Act, exercisable as described above.

Residents of the European Economic Area, the United Kingdom and Switzerland. You have the rights described in the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection respectively, including the right to complain to your local supervisory authority.

8. Children

The Services are not directed to children, and you must be at least 18 years old to use them. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact us and we will delete it.

9. Third-party sites and services

The Site links to third-party websites, block explorers, documentation, wallets and other services. Their privacy practices are their own, and this Policy does not apply to them. We encourage you to read their policies before using them.

10. Do Not Track

We do not track you across third-party websites and we do not run behavioural advertising, so we do not respond to browser "Do Not Track" or Global Privacy Control signals in any particular way; there is nothing to opt out of.

11. Changes to this Policy

We may update this Policy from time to time. We will post the revised version on the Site and update the "Last updated" date. If a change materially reduces your rights we will take reasonable steps to bring it to your attention. Your continued use of the Services after a change takes effect constitutes acceptance of the revised Policy.

12. Contact

Questions, requests or complaints about this Policy may be raised through any contact channel published on the Site. Please do not include passwords, API keys, private keys or seed phrases in any message to us; we will never ask for them.