Privacy policy

Who we are

Shear is run by Russell Gray Sneddon, who is the data controller. Questions or requests: russell.gray.sneddon@gmail.com. Shear is currently a testnet; mainnet is not live.

Wallet (Continuum: Windows, Linux, Android, CLI)

• No sign-up, no account, no email, and no analytics or crash-reporting SDKs.
• Your seed phrase and private keys are created and stored on your device only. We never receive them and cannot recover them.
• View keys: anyone who has your wallet's view key can see all incoming payments to it, their amounts and when they arrived, for past and future activity, permanently. A view key cannot spend, and on its own it cannot mark which of your coins were spent, but change returning to you shows up as incoming. Continuum does not currently offer a way to export a view key; your seed phrase contains it, so never share your seed.
• The wallet keeps its settings, transaction history and a copy of the chain on your device. Deleting the app or its data folder removes them; back up your seed first.
• Desktop and CLI wallets talk to a node on your own machine by default. The phone wallet talks to public Shear nodes we run (p2p.shear.digital, r2r.shear.digital, b2b.shear.digital), and on first sync can download a chain snapshot from boot.shear.digital. If you turn it on, an advanced setting uses pool.shear.digital instead. Whichever server you use sees your IP address and what you request or send.
• Android permissions: internet (to reach the network); camera (only when you scan a QR code; images are not stored or sent); biometrics (to unlock on the device, handled by Android, we never see the data); and notifications, a foreground service and wake lock (to keep syncing and show status).

Node and peer-to-peer network

A Shear node stores the chain and its own logs on your machine. It keeps peer IP addresses only in memory while connected, and blocks misbehaving addresses for 15 minutes, also in memory only; the node software does not write peer addresses to disk or to its logs. Every peer you connect to, including nodes we operate, sees your IP address and the blocks and transactions you relay. On the servers we run, the web server and system logs described under "Website" can still contain IP addresses. Our public nodes are in Finland, Germany and the United States.

Mining pool (pool.shear.digital)

• No pool account. To mine you give a payout address and, optionally, a worker name.
• The pool sees your IP address, payout address, worker name and the shares you submit, and uses them to credit and pay your work and to block abuse.
• The pool software keeps IP addresses only in memory, for the connection and for abuse blocks of up to 6 hours; it does not write them to disk or to its logs. A payout address that abuses the pool may be blocked for 6 hours. Share records are kept only as long as they are needed to credit and pay miners.
• Pool payouts are recorded on chain. Payout amounts can be visible on chain; do not assume pool payouts are hidden.

ShearK miner

The miner connects only to the pool or node you choose (by default pool.shear.digital:1111). It sends your login (payout address and optional worker name, plus an optional payout destination), your thread count and CPU core and thread counts, the miner name and version, your hash count and hashrate, and the shares you find. It has no accounts, analytics or update checks. Whoever runs that pool or node sees your IP address.

What is public on the blockchain

Blocks are public and permanent, and every node holds a copy, so nobody (including us) can delete them. Some transaction types reveal less than others; assume anything on chain may be visible. Amounts in normal wallet sends are hidden on chain. These items are always public: each block's total new-coin amount; solo-mined and empty-round finder rewards; the type of every output, including dummy outputs; transaction timing and fees; and, on testnet today, block-reward amounts and pool payout escrow amounts. Shear's cryptographic parameters have not yet been independently ratified. The explorer (explorer.shear.digital) and mempool view only display what is already public on the network.

Website (shear.digital and subdomains)

• No analytics, no advertising, no tracking.
• One preference cookie and localStorage entry, shear-theme (light/dark), set on .shear.digital for 1 year so it applies across our subdomains. It is strictly functional and is not logged or used for tracking.
• Our web servers keep access logs: IP address, time, page requested, status, bytes sent, referrer and browser user-agent. On shear.digital, pool, explorer and our public node hosts (p2p, r2r) the page is logged without the query string (the part of a link after "?"); our other subdomains (such as team, mempool, blunote and vortices) log the full link including it. Separate error logs record the IP address and full request when something fails. Logs are rotated daily and deleted after 14 days (up to about 15 days for the oldest entries). System logs on our website and pool server are kept for 2 days; on our node servers, currently about 3 weeks (system and login records, not node peer addresses). They are not used for tracking or shared.
• When you open a page, your browser asks GitHub (api.github.com) for the latest release details, so GitHub receives your IP address.
• Downloads and source code are hosted on GitHub.

Third parties and transfers

We do not sell or share personal data. Services involved: Hetzner, which hosts our servers in Finland, Germany and the United States; Namecheap, our domain registrar and DNS provider; and GitHub (code, downloads and release details). GitHub is a US company, so the data it receives (mainly your IP address) may be processed in the United States under their own privacy policies and transfer safeguards. If you install from an app store (Google Play, later Apple's App Store), its policy applies too. We may disclose data if the law requires it.

Your rights

If UK or EU data-protection law applies to you, you can ask to see, correct or delete personal data we hold (in practice, server logs), or object to its use. We rely on legitimate interests (running and securing the services). Contact us at the address above and we will reply within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk). Data on the blockchain cannot be deleted by anyone.

Children

Shear is for adults aged 18 and over. It is not aimed at anyone under 18, and we do not knowingly collect their data.

Changes

We will post changes on this page and update the date above.