SPEARMINT SPMTC

Spearmint/Legal/Privacy Policy

Spearmint Mining · privacy policy · draft v0.1

Privacy Policy

A mining pool needs very little to do its job: an address to pay, the shares that earned the payment, and the connection that delivered them. This policy lists exactly that, and states what is deliberately not collected.

Pre-launch · pool not open Draft for attorney review

Prepared by , Instant Access · Version 0.1 · 13 September 2026 · Draft for review by counsel

Draft First-pass draft prepared for review by qualified counsel. Not in force and not legal advice. Last revised 13 September 2026.

01 Who this covers

  1. This policy is issued by Instant Access [legal entity name, form, and registered address — to be inserted] (the "Operator") and covers Spearmint Mining — the Stratum endpoints, the dashboard, the statistics pages, and support — and the spearmintcoin.com website.
  2. It does not cover the Spearmint network itself. Transactions on the Spearmint blockchain, including payouts, are public by design and are not under the Operator's control once broadcast.
  3. There are no accounts. A miner is identified by the payout address they mine under. Nothing in this policy asks you to identify yourself further.
  4. The website offers one optional email list, for project announcements. It is double opt-in, holds only an email address and the minimum needed to confirm and remove it, and is covered in sections 02, 04, 05, 06 and 08.

02 What we collect and why

Data the service holds
DataSourceWhy it is needed
Payout address The first part of your Stratum username It is where mining rewards are sent and how shares are attributed. It is a public blockchain address; the service adds nothing to it.
Worker name The suffix of your Stratum username To show per-worker statistics. Choose a name that does not identify you if you prefer.
Share records Your hardware, over Stratum Timestamp, difficulty, and validity of every share. This is the evidence that every payout was earned by mining. Exportable by address.
Connection logs Stratum and web servers IP address, time, and the endpoint used. Kept for security (rate limiting, abuse, incident response) and for the sanctions controls described below. The country derived from the IP address is used for sanctions screening; nothing more precise is derived.
Notification email and signed message (optional) You, if you register for notifications To send worker-offline and payout notifications. The signed message proves you control the address. Not required to mine.
Announcements list email (optional) You, if you sign up at /announcements/ To send occasional project announcements. Stored with a status, a random token and two timestamps, in a file on the site's own server outside the web root; not passed to a third-party mailing service. Double opt-in: nothing is sent until you confirm. Every message carries an unsubscribe link, and unsubscribing deletes the record. Unconfirmed sign-ups are deleted after 30 days. Sign-up attempts are rate-limited using a hashed connection identifier discarded after two hours.
Support correspondence You, if you email support To answer the question. Send only what is needed — a payout address and a block height are usually enough. Never send a private key; we will delete any message containing one and tell you to move the address.
Compliance decision records Generated by the service When a connection is refused or a payout is withheld for a sanctions reason, the decision, its basis, and the address or IP-country involved are recorded. See the Sanctions / Restricted Persons Policy.

03 What we do not collect

  1. No names, government identification, dates of birth, phone numbers, postal addresses, or bank or card details. The service does not need them to mine or to pay a mining reward, so it does not ask for them.
  2. No precise location. Only the country associated with a connecting IP address is derived, and only for the purpose in section 02.
  3. No behavioural analytics, advertising identifiers, or tracking pixels.
  4. This site sets no cookies. The dashboard uses no login session. If a cookie ever becomes necessary for a specific function, this policy will say which one and why before it is set.
  5. The website loads the Geist typefaces from Google Fonts. When your browser requests them, Google receives your IP address and browser details under Google's own privacy policy. To avoid this, block fonts.googleapis.com; the site remains readable in your system font.
  6. No private keys or recovery phrases — ever. Spearmint Mining will never ask for your private key or recovery phrase.

04 Purposes

The Operator uses the data above only to:

  1. Operate the mining service: attribute shares, calculate reward allocations, and run payouts.
  2. Show you statistics for your address and workers, and send notifications you have asked for.
  3. Send project announcements to addresses on the announcements list that have confirmed their subscription, and nothing else to those addresses. The list is never used for marketing, partner offers, or anything price-related.
  4. Keep the service secure and available: rate limiting, abuse detection, incident response.
  5. Meet legal obligations that apply to the Operator as a U.S. person — chiefly sanctions compliance and recordkeeping — and respond to lawful requests.
  6. Demonstrate, if asked by a regulator, auditor, or miner, that every payout was calculated from recorded mining participation.
STOP — legal review required before implementation Counsel to confirm the legal bases and required notices under any state privacy statute that may apply to the Operator, and whether the EU/UK GDPR applies if miners outside the United States connect. If it does, the "legitimate interests" and "legal obligation" bases, the international-transfer position, and data-subject rights wording need to be added here.

05 Retention

  1. Share records, reward calculations, and payout records are kept for as long as needed to demonstrate how each payout was calculated, and for at least five years after the payout, consistent with U.S. sanctions recordkeeping expectations.
  2. Connection logs are kept for 90 days for security purposes, except entries tied to a compliance decision or a security incident, which are kept with that record.
  3. Notification registrations are kept until you remove them (section 08) or the service closes.
  4. Announcements-list records are kept until you unsubscribe, which deletes the record; unconfirmed sign-ups are deleted after 30 days.
  5. Support correspondence is kept for two years.
  6. The full record-by-record schedule, with the reason for each period, is at /docs/recordkeeping/.

06 Sharing

  1. Hosting and infrastructure providers process data on the Operator's behalf, under contract, to run the servers. They are not permitted to use it for anything else.
  2. Email delivery providers receive your notification email address if you register for notifications.
  3. The announcements list is sent from the site's own server through its hosting provider's mail system. The list itself is not uploaded to, synchronised with, or processed by any third-party newsletter or marketing service, and no tracking pixels or click-tracking links are used in announcement emails.
  4. Sanctions screening may involve comparing payout addresses and IP-derived countries against published U.S. government lists. Where the Operator uses a third-party screening service, only the data needed for the match is sent.
  5. The Operator will disclose data when required by law, subpoena, court order, or a valid request from a government authority, and may disclose it to protect the service or the network from an active attack.
  6. The Operator does not sell data, does not share it for advertising, and does not share it with anyone for their own purposes.
STOP — legal review required before implementation Counsel to set the law-enforcement request policy: what constitutes a valid request, whether and when miners are notified, and how requests are logged and reported in aggregate. Until then the Operator treats every request as one for counsel.

07 Security

  1. Data is held on access-controlled systems with encrypted backups. Administrative access uses key-based authentication and two-factor authentication, and is logged.
  2. The Operator's own operational keys are isolated from the systems that hold miner data. No miner keys exist on any Operator system.
  3. The security measures are described at /docs/security/. If a breach affects your data, the Operator will publish what happened and notify affected miners by any contact route it holds.

08 Your choices

  1. Stop mining and the service stops collecting. Records already created are kept for the periods in section 05 because they document payouts already made.
  2. Mine under a different address at any time. Nothing links two addresses unless you register the same notification email for both.
  3. Remove a notification registration by signing a removal message with the address, or by using the link in any notification email. Removal takes effect within 24 hours.
  4. Leave the announcements list at any time: enter your address in the unsubscribe form at /announcements/#unsubscribe, or use the one-click link in any announcement email. Removal is immediate and deletes the record; there is no confirmation step and no login. Joining the list is double opt-in: your address is held as "pending" until you click the confirmation link, and nothing but that one confirmation is ever sent to a pending address.
  5. Export your share records for any address at any time from the dashboard.
  6. Ask what the Operator holds about a payout address by writing to the contact in section 12. Because the service holds no identity, you will be asked to prove control of the address by signing a message; the Operator cannot release records to anyone who cannot.

09 Children

  1. The service is for people aged 18 and over. The Operator does not knowingly collect data from anyone younger. Because no age or identity is collected, the Operator relies on the representation in the Terms of Service.

10 Where the service is operated

  1. The service is operated from the United States by a Pennsylvania operator, and data is processed there and on the hosting providers' infrastructure. If you connect from elsewhere, your data is transferred to the United States.

11 Changes

  1. Changes are published at /updates/ and on this page with a new version and date. Any change that adds a category of data collected will be announced at least 30 days before it starts.

12 Contact

  1. Privacy questions: [email protected], subject line "Privacy".
  2. Postal: Instant Access [legal entity name, form, and registered address — to be inserted].
version
0.1 — draft for attorney review
revised
13 September 2026
effective
Not in force
← All legal documents Recordkeeping Terms of Service