Legal

    Privacy Policy

    Effective date: March 10, 2026  ·  Last updated: March 10, 2026

    The short version: I build open-source tools on top of Nostr, Bitcoin, and Lightning. I collect only what's necessary to make things work, I don't sell your data, and most of these apps are designed so you control your own keys and data by default.

    This Privacy Policy applies to all applications, tools, bots, and services created and maintained by Derek Ross ("I," "me," or "my"), including but not limited to: Nostr Plebs, Nostr Nests, YakBak, Zappix, Plektos, ZapTrax, Zaplytics, diVine, Bluestrbot, and other projects hosted at derekross.me. By using any of these applications, you agree to the practices described in this policy.

    1. Information I Collect

    Depending on the application, I may collect or process the following:

    • ›Nostr public keys (npub / hex) — used to identify accounts and interact with the Nostr protocol. Public keys are, by design, public.
    • ›Nostr events — notes, reactions, and other signed events you publish to public relays. These are public by design.
    • ›Lightning Network identifiers — Lightning addresses or invoice data used to facilitate Bitcoin payments or zaps.
    • ›OAuth tokens — short-lived access tokens issued by third-party platforms (e.g., TikTok, X, LinkedIn) when you authorize a cross-posting or integration feature. Tokens are stored locally on your device or server and are never transmitted to my servers.
    • ›Usage data — basic analytics such as page views or feature usage may be collected in aggregate and anonymized form to improve the service.

    I do not collect passwords, private keys (nsec), or sensitive financial information.

    2. How I Use Your Information

    • ›To provide and operate the features of each application
    • ›To facilitate Nostr protocol interactions (publishing events, fetching feeds, sending zaps)
    • ›To enable authorized cross-posting to third-party platforms at your request
    • ›To improve application performance and fix bugs
    • ›To communicate with you if you contact me directly

    I do not use your information for advertising, profiling, or sale to third parties.

    3. Third-Party Services

    My applications may interact with third-party services as part of their core functionality:

    • ›Nostr relays — public relays receive and distribute your signed Nostr events per the Nostr protocol specification.
    • ›Lightning Network nodes — payment routing occurs over the Lightning Network; individual node operators may log payment metadata per their own policies.
    • ›TikTok — when you connect a TikTok account, the TikTok Content Posting API is used to upload videos on your behalf. TikTok's own Privacy Policy applies to data processed on their platform.
    • ›X (Twitter) — when you connect an X account for cross-posting, X's Privacy Policy applies.
    • ›LinkedIn — when you connect a LinkedIn account for cross-posting, LinkedIn's Privacy Policy applies.

    I am not responsible for the privacy practices of these third-party services.

    4. Data Storage and Security

    Most of my applications are self-hosted or client-side tools. In those cases, your data (including OAuth tokens and configuration) is stored on your own device or server — not on any server I control.

    Where I do operate server infrastructure (e.g., Nostr Plebs, Nostr Nests), I take reasonable technical measures to protect stored data. However, no system is perfectly secure, and I cannot guarantee absolute security.

    5. Data Retention

    For self-hosted tools, data retention is entirely in your control. For any server-side services I operate, I retain data only as long as necessary to provide the service. You may request deletion of your data by contacting me directly.

    6. Your Rights

    • ›Access — you may request a copy of personal data I hold about you.
    • ›Correction — you may request correction of inaccurate data.
    • ›Deletion — you may request deletion of your data from any server-side service I operate.
    • ›Portability — Nostr is inherently portable; your keys and data are yours.

    To exercise any of these rights, contact me at [email protected].

    7. Children's Privacy

    My applications are not directed at children under the age of 13. I do not knowingly collect personal information from children. If you believe a child has provided me with personal information, please contact me and I will promptly delete it.

    8. Changes to This Policy

    I may update this Privacy Policy from time to time. When I do, I will update the "Last updated" date at the top of this page. Continued use of any application after changes constitutes acceptance of the updated policy.

    9. Contact

    Questions about this Privacy Policy? Reach me at: