Privacy Policy

Last updated: September 10, 2026 This Privacy Policy explains how RocX handles personal information when you use its websites and services.

​

1. Information processed

Depending on the features you use, RocX processes:

• public wallet addresses, blockchain activity, and wallet-verification results;
• linked-account identifiers, public account information, and authentication information needed for account connections;
• submitted links, public content metadata, verification results, profiles, and activity records, including evaluations, rankings, and participation records; and
• information you provide when contacting support.

This information comes from you, connected services, and public sources. Do not send private keys, seed phrases, or recovery codes to RocX.

​

2. How information is used

RocX uses this information to provide its services, connect accounts, verify content ownership, display profiles and activities, operate participation features, prevent abuse, respond to support requests, and comply with legal obligations.

​

3. External services and public records

External wallets, platforms, and protocols have their own privacy practices. RocX may disclose information where required by law or reasonably necessary to protect users, rights, or the service. Wallet addresses and public blockchain activity may identify a person when combined with other information. RocX cannot remove public blockchain records or delete content and information independently controlled by external services.

​

4. Google and YouTube API data

This section governs Google user data, including YouTube API data, and takes precedence over other general provisions in this Privacy Policy where they differ.

​

4.1 Services used

RocX uses Google OAuth 2.0 and YouTube API Services. Connecting a YouTube account is optional and works only after your explicit authorization. See the Google Privacy Policy and the Google API Services User Data Policy. RocX’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

​

4.2 Google user data accessed

To provide the authorized connection and verification features, RocX may access or process:

• your Google account identifier;
• your email address, display name, and profile image only if the corresponding OAuth permissions are actually requested and authorized;
• your YouTube channel ID, channel name, and other basic channel information;
• public metadata for a YouTube URL you submit, such as the video ID, title, channel ID, thumbnail, URL, and publication information;
• OAuth access and refresh tokens only where technically required to maintain the authorized connection; and
• account-linking status and the result of matching your connected channel with the channel that published the submitted video.

Access to YouTube content is read-only and limited to verifying videos you submit. RocX does not collect your Google password or YouTube login credentials. OAuth tokens authorize the connection without giving RocX your password.

​

4.3 How Google user data is used

RocX uses Google user data only to:

• connect your YouTube account to RocX and identify the connected channel;
• verify that a public YouTube video you submit was published by that channel;
• record the verification outcome for your Proof of Activity (PoA) submission;
• prevent impersonation, duplicate submissions, fraud, and abuse; and
• maintain security and respond to your support requests about these features.

A submitted YouTube URL can be registered as your PoA activity only if its publishing channel matches your connected channel. This prevents users from claiming other creators’ content as their own. A match does not guarantee any reward. RocX does not use Google user data for advertising or retargeting, selling user data, providing data to data brokers or information resellers, determining creditworthiness, lending decisions, training generalized AI or machine-learning models, or unrelated analytics or profiling. RocX does not upload, publish, modify, or delete YouTube videos or other YouTube content on your behalf. It does not like, comment, subscribe, or perform other YouTube write operations.

​

4.4 Sharing, transfer, and disclosure

RocX does not sell Google user data. Google user data sharing, transfer, and disclosure to third parties are limited to:

• hosting, database, infrastructure, security, and support service providers processing data under RocX’s instructions only as necessary to operate the features you authorize and with your consent;
• investigating security incidents, fraud, or service abuse;
• complying with applicable law, a court order, or a lawful government request; or
• a merger, acquisition, or transfer of assets, subject to applicable law, required notice, and your explicit prior consent.

Service providers are bound by contractual confidentiality and security obligations. They may not use Google user data for their own advertising or independent purposes. These exceptions remain subject to the Limited Use requirements.

​

4.5 Retention and deletion

RocX does not store the video contents. OAuth access and refresh tokens are retained only while your YouTube account is connected to RocX. When you disconnect it, RocX immediately revokes token access and deletes tokens from active systems without delay. Google account and YouTube channel identifiers and related data obtained through OAuth are retained only as necessary to maintain the connection and verify PoA submissions. When you disconnect YouTube, delete your RocX account, or request deletion, RocX deletes or de-identifies related Google user data in active systems within 30 days, subject to the shorter YouTube deletion deadlines below. For YouTube API data, RocX deletes data covered by a disconnection, account deletion, or deletion request as soon as possible and within 7 calendar days. If you revoke access through Google Account permissions, RocX deletes the affected API data as soon as possible and within 30 calendar days of revocation. RocX periodically checks authorization validity and deletes affected data when authorization can no longer be refreshed. Stored YouTube channel and video metadata is refreshed or deleted within 30 calendar days. Limited backup copies may remain for up to 90 days under the disaster recovery cycle before deletion or overwriting. This backup period does not extend the shorter YouTube API deletion deadlines; affected YouTube API data must be deleted within those deadlines, including from backups. Where fraud prevention, a security investigation, or a legal obligation requires longer retention, RocX restricts retention to the minimum necessary information and deletes it when that purpose ends. This exception applies only to the extent permitted by applicable law and Google and YouTube policies. Public URLs you submit directly and public blockchain records are distinct from data obtained through Google OAuth. This distinction does not exempt API-derived metadata from the deletion rules above. RocX cannot delete immutable onchain records, but removes the Google account association and internal RocX identifiers where possible. Deletion by RocX does not delete content or data held by YouTube; you must use YouTube’s own controls for that purpose.

​

4.6 User controls and revocation

You may revoke access or request deletion by:

• clicking “Disconnect” in RocX My Page settings to disconnect your YouTube account;
• revoking RocX access on the Google Account permissions page;
• deleting your RocX account; or
• sending a Google or YouTube data deletion request to rocx@rocx.io.

Revoking Google permissions alone may not automatically delete all data already stored by RocX at that moment. To request deletion of stored data directly, disconnect YouTube in RocX, delete your RocX account, or email us. The deletion deadlines above still apply to data covered by Google’s revocation, without requiring a separate request.

​

4.7 Security

RocX uses reasonable technical and administrative safeguards for Google user data, including encryption in transit, restricted access controls, authorization and credential safeguards, logging, and security monitoring. Access is limited to personnel and processors who need it to operate or secure the service. Human access to Google user data is limited to the circumstances permitted by the Limited Use requirements, including your affirmative agreement to review specific data for support, security needs, or legal obligations. No online service can guarantee absolute security.

​

5. Meta Platform Data (Facebook, Instagram and Threads)

This section applies when a relevant Meta integration is available and you choose to connect it to RocX. It governs data obtained through Meta APIs and takes precedence over conflicting general provisions of this Privacy Policy. It describes the operating requirements for these integrations, not a claim that they are all currently available or approved.

​

5.1 Services and authorization

For an available integration, RocX uses Meta’s authorization services and official APIs to connect a supported Facebook account or Page, Instagram account, or Threads account for Proof of Activity (PoA) verification. Each platform has separate APIs, permissions, supported account types, and review requirements. Permissions differ by platform and account type and are displayed during authorization. RocX requests only the minimum permissions necessary to identify the connected account and verify content submitted by the user. Instagram requires a supported professional account, such as a Business or Creator account, where required by the applicable API. Facebook account or Page support depends on the available API and approved scope; this does not imply access to every personal profile, Page, or public URL. RocX does not request permission to publish, edit, delete, like, comment on, send messages, follow accounts, or perform other social actions through these integrations, and does not manage advertising on your behalf. Threads verification is designed for minimum read access and does not request threads_content_publish.

​

5.2 Meta Platform Data accessed

Depending on the integration and permissions you authorize, RocX may process:

• your platform-specific user or account ID;
• your username, display name, and profile image where provided by the applicable API;
• OAuth access tokens, token expiration information, and connection status;
• metadata associated with posts or media owned by the connected account, such as the post or media ID, permalink, author or account ID, publication time, media type, caption, title, thumbnail, and public status where made available by the API; and
• the result of matching the connected account with the author of a PoA submission, together with limited fraud-prevention and verification records.

Where an API does not support direct lookup of a submitted public URL, RocX may temporarily process a limited list of posts or media belonging to the connected account solely to locate and verify that content. RocX does not intentionally retain unrelated post metadata after verification. This does not authorize collection of arbitrary posts from unconnected accounts. RocX does not collect your Facebook, Instagram, or Threads password or access private messages, contacts, advertising data, or unrelated private content through these integrations.

​

5.3 Purpose of processing

RocX uses Meta Platform Data only to:

• connect and identify the account authorized by the user;
• verify that a submitted public post was published by the connected account;
• prevent impersonation, duplicate submissions, fraud, and abuse;
• record and administer the corresponding PoA verification result; and
• provide security, troubleshooting, and user support for the integration.

RocX does not use Meta Platform Data for advertising, retargeting, data brokerage, credit or lending decisions, or training generalized artificial intelligence or machine-learning models.

​

5.4 Public display and blockchain data

Public PoA features may display the submitted public URL, authorized public account name, limited public metadata, and verification result on RocX profiles, activity boards, rankings, or related interfaces. RocX does not publicly display OAuth access or refresh tokens, app secrets, internal credentials, non-public Meta Platform Data, unnecessary Meta user IDs, or raw security and abuse-detection data. RocX does not write tokens, private account information, or non-public Meta Platform Data to a public blockchain. Any future onchain attestation would be limited to minimized proofs, status, or hashes, subject to privacy review; this is not a claim that such a feature is implemented. A hash is not automatically anonymous. RocX cannot delete immutable public blockchain records, but removes internal links to deleted account data where technically possible.

​

5.5 Sharing and disclosure

RocX does not sell or license Meta Platform Data or provide it to data brokers. In addition to the limited public display described above, RocX may disclose the minimum necessary Meta Platform Data to:

• hosting, database, infrastructure, security, and support service providers processing data solely under RocX’s instructions and written confidentiality and data-protection obligations;
• competent authorities where required by applicable law, a valid court order, or another lawful request; or
• security and fraud-prevention personnel where reasonably necessary to investigate abuse or protect RocX and its users.

Service providers may not use Meta Platform Data for their own advertising, profiling, independent commercial purposes, or generalized AI or machine-learning model training.

​

5.6 Retention and deletion

OAuth tokens are retained only while the relevant Meta account remains connected. When you disconnect, RocX stops further API access and deletes stored tokens from active systems without undue delay. Meta account identifiers, matched post metadata, and other Meta Platform Data are retained only as necessary for the authorized connection, PoA verification, fraud prevention, or applicable legal obligations. When you delete your RocX account, submit a valid deletion request, or initiate deletion through an available Meta data deletion mechanism, RocX deletes or de-identifies applicable Meta Platform Data from active systems as soon as reasonably possible and within 30 days. Restricted backup copies may remain for up to 90 days before deletion or overwriting and may not be restored for ordinary business use. Where applicable platform rules require deletion, de-identification is not used as a substitute for deletion. Disconnecting stops future API access but does not by itself remove a public URL submitted directly or a de-identified record necessary for settlement integrity or duplicate and fraud prevention. You may separately request deletion of associated personal data. These records are distinct from OAuth data; this distinction does not exempt API-derived metadata from applicable deletion requirements. Where law or an active security or fraud investigation requires retention, RocX keeps only the minimum necessary information and deletes or de-identifies it when that purpose ends, subject to applicable platform requirements. These Meta timeframes do not extend the separate Google and YouTube deletion deadlines above.

​

5.7 User controls and deletion requests

You may disconnect or request deletion by:

• selecting Disconnect in RocX My Page;
• removing RocX through the applicable Meta account, Accounts Center, or Apps and Websites settings;
• deleting your RocX account;
• using an available Meta-provided data deletion request mechanism; or
• sending a deletion request to rocx@rocx.io.

Removing authorization stops future access; it is not necessarily a request to delete every existing record. Use the Social Account Data Deletion instructions to request deletion directly. Provider-specific deletion events remain subject to the deadlines above without requiring a second request. Deleting RocX data does not delete original content held by Facebook, Instagram, or Threads. Use the applicable Meta service controls to delete that content.

​

6. TikTok Data

This section applies when the TikTok integration is available and you choose to connect it. It governs TikTok data and takes precedence over conflicting general provisions of this Privacy Policy. RocX is not an official partner, agent, or representative of TikTok and does not claim TikTok’s approval, endorsement, or sponsorship.

​

6.1 Services and authorization

RocX uses TikTok Login Kit and the TikTok Display API for read-only PoA verification. Connecting TikTok is optional and requires your explicit OAuth authorization. Availability depends on TikTok review, approved permissions, account and regional eligibility, and API availability. RocX requests only user.info.basic to identify the authorized account and access the basic profile information TikTok provides under that scope, and video.list to access the connected account’s public videos and the limited public metadata needed for verification. RocX does not collect your TikTok password.

​

6.2 TikTok data accessed

Processing is limited to information provided by the authorized API and needed for the connection and verification:

• the TikTok open_id specific to the RocX app;
• union_id only if returned by the API and actually needed for account continuity;
• display name and avatar provided under user.info.basic, only as needed to identify or display the connected account;
• OAuth access and refresh tokens, expiration times, authorized scopes, and connection status;
• a limited list of public videos belonging to the connected account, solely to locate and verify a submitted video;
• the submitted video’s Video ID and, only where actually used for verification or its public PoA display, Share URL, Description, Create Time, Duration, Cover, or Embed information returned by the API; and
• the account-to-video match, PoA verification result, and limited abuse-prevention records.

RocX limits requested and retained fields to those actually needed for these purposes and does not intentionally retain unrelated video metadata after verification. This does not authorize collection of arbitrary videos from unconnected accounts.

​

6.3 Purpose of use

RocX uses TikTok data only to:

• connect and identify the TikTok account you authorize;
• verify that a public video you submit belongs to that connected account;
• record and manage PoA verification results;
• prevent impersonation, duplicate submissions, manipulation, fraud, and abuse; and
• maintain security, resolve service failures, and respond to user support requests.

You submit the public URL of a video you personally posted on TikTok. RocX extracts its Video ID and compares it with public video results for your connected account through the TikTok Display API. RocX processes the submission as verified only if the account-to-video relationship is confirmed. An account mismatch, private or deleted video, invalid URL, expired authorization, or insufficient API information can cause verification to fail or registration to be refused. This verifies the source of the post; it does not automatically guarantee PoA approval, ranking, Active Energy (AE), or any other reward. RocX does not use TikTok data for advertising or retargeting, sale or licensing of user data, provision to data brokers or information resellers, creditworthiness or lending decisions, training general-purpose AI or machine-learning models, or unrelated analytics or profiling.

​

6.4 Read-only operation

You create and publish videos directly on TikTok and voluntarily submit only their public URLs to RocX. RocX does not request video.publish or any other write permission and does not use the TikTok Content Posting API. RocX does not upload, publish, modify, or delete videos; like, comment, or repost; follow or unfollow accounts; send messages or DMs; or create or manage advertising on your behalf. The integration does not access private videos, drafts, contacts, DMs, or advertising data.

​

6.5 Public display and sharing

Public display on RocX is limited to the public TikTok URL you submit, necessary public account and video metadata, and the PoA verification result. RocX does not publicly disclose or record on a public blockchain OAuth tokens, TikTok passwords, app secrets or internal credentials, unnecessary platform identifiers, private TikTok data, or raw security and abuse-detection data. RocX does not collect TikTok passwords or private TikTok content through this integration. RocX does not sell or license TikTok data or provide it to data brokers or information resellers. Apart from the limited public display above, RocX limits processing and sharing to the minimum necessary for:

• hosting, database, infrastructure, security, and support providers acting solely under RocX’s instructions and confidentiality and data-protection obligations;
• personnel handling security and abuse investigations; or
• compliance with applicable law, court orders, or valid government requests.

Service providers may not use TikTok data for their own advertising, profiling, independent commercial purposes, or general-purpose AI or machine-learning training.

​

6.6 Retention and deletion

OAuth tokens are retained only while the TikTok account remains connected. When you select Disconnect in RocX, revoke TikTok authorization, delete your RocX account, or submit a valid deletion request, RocX stops new API requests through that authorization and deletes access and refresh tokens from active systems without undue delay. Other TikTok personal data is retained only for as long as necessary for the purposes above. Following a valid deletion request or RocX account deletion, RocX deletes or de-identifies covered TikTok data from active systems as soon as reasonably possible and within 30 days. If TikTok policies or applicable law require a shorter period or complete deletion, that requirement takes precedence; de-identification does not replace required deletion. Provider-triggered deletion obligations apply without requiring a second request. Restricted backup copies are deleted or overwritten within 90 days and are not restored for ordinary business use. Shorter TikTok or legal deadlines also apply to backups; the backup period does not extend them. These TikTok timeframes do not change the separate Google and YouTube or Meta rules above. A public URL you submit directly is distinct from OAuth and API data. This distinction does not exempt API-derived personal data, associated metadata, or verification records from applicable deletion obligations. Deleting RocX data does not delete your original TikTok account or videos; use TikTok’s own controls to delete them.

​

6.7 User controls

You may stop access or request deletion by:

• selecting TikTok Disconnect in RocX My Page;
• removing RocX authorization in your TikTok account’s connected-app or authorization settings;
• deleting your RocX account; or
• emailing a TikTok data deletion request to rocx@rocx.io.

Removing TikTok authorization stops future access but may not itself request deletion of every existing record stored by RocX. To request stored-data deletion directly, delete your RocX account or email us. Applicable TikTok deletion obligations still apply without a separate request. See TikTok connection and deletion and the TikTok integration terms.

​

7. Retention and security

RocX retains personal information for as long as necessary to provide services, address security issues or disputes, and meet legal obligations. Information is deleted or de-identified when it is no longer needed. RocX applies reasonable administrative and technical safeguards to protect personal information. No online service can guarantee absolute security.

​

8. Your choices and rights

You may disconnect accounts through available RocX, wallet, or provider controls. Revoking a provider’s authorization may require a separate step. Disconnection stops future access but may not delete all existing records. Provider-specific deletion rules above take precedence. You may separately request deletion using the Social Account Data Deletion instructions. Depending on applicable law, you may request access, correction, deletion, a copy of your information, or restrictions on its use. You may also have rights to object to processing, withdraw consent, or complain to a relevant authority. Send requests to rocx@rocx.io. RocX may verify your control of the relevant account without requesting a private key or seed phrase and will handle requests within applicable legal time limits.

​

9. Changes and contact

Updates to this Privacy Policy will be posted on this page. RocX will provide additional notice or obtain consent where required by law. For privacy questions or requests, contact rocx@rocx.io.