Legal Notices & Disclosures

⚠️ CRITICAL: Financial Disclaimer

What FAWN Is NOT

• Not a bank: FAWN does not hold customer deposits in trust. FAWN is a software platform for peer-to-peer crypto transfers.
• Not FDIC insured: Unlike traditional bank accounts, FAWN wallets are NOT protected by FDIC insurance. Account access and payment instructions must be kept secure.
• Not investment advice: The Daily Brief podcast, Investing tab, and any market commentary is informational only. Not financial advice. Consult a licensed advisor before investing.
• Not a securities broker: Alpaca brokerage integration is provided by a third party. FAWN is not responsible for broker errors, outages, or losses.
• Not a payments processor: Stripe is used only for founding member checkout. All other payments are via stablecoin (USDC).

USDC Stablecoin Risks

• Smart contract risk: USDC is deployed on Ethereum/Polygon blockchains. Smart contract vulnerabilities could result in permanent loss.
• Issuer risk: USDC is issued by Centre Consortium. If Centre fails, USDC value may collapse.
• Market risk: "Stable" does not mean guaranteed. USDC price can depeg from USD, especially during market stress.
• No insurance: If your wallet is compromised, stolen, or lost, there is no recovery mechanism. This is not like a bank account.
• Custodial key security: FAWN wallets are custodial. Signing keys are envelope-encrypted at rest and are not exposed to users or stored in the browser.

Tax & Regulatory Responsibility

• Taxable events: Every USDC transfer, stablecoin purchase, and investment is a potential taxable event in most jurisdictions.
• Reporting requirement: Users are responsible for tracking and reporting all transactions for tax purposes.
• No tax advice: FAWN does not provide tax advice. Consult a tax professional.
• Regulatory compliance: Crypto regulations are rapidly changing. Users are responsible for ensuring compliance in their jurisdiction.

Service Limitations

• No uptime guarantee: FAWN is provided "as-is" with no guarantee of service availability. Downtime may occur without notice.
• No security guarantee: While FAWN implements industry-standard security, no system is 100% secure. User funds could be lost due to breach, bug, or infrastructure failure.
• Limited liability: FAWN's liability is limited to fees paid by the user in the prior 30 days. In no case shall FAWN be liable for loss of funds.
• Service suspension rights: FAWN reserves the right to suspend or terminate accounts for fraud, abuse, regulatory non-compliance, or other reasons at its sole discretion.

🤖 AI Disclosure: This Platform Was Built With AI

What Uses AI

• Code generation: Backend API endpoints, database models, frontend UI were generated by Claude AI.
• Architecture design: System design, data models, and security approach were AI-assisted.
• Daily Brief podcast: Daily market summaries are AI-generated news aggregation (Claude), not human-written.
• Smart contract logic: Wallet creation, transfer logic, fee collection were designed and coded by AI.

Quality & Risk Implications

• Code review: All AI-generated code was reviewed by human creator, but may still contain bugs, security vulnerabilities, or logical errors.
• No guarantee of correctness: AI sometimes "hallucinates" (makes things up or misunderstands requirements). Critical logic may have hidden bugs.
• Security review: Security was audited, but AI-generated security code should not be considered "battle-tested" production-grade.
• No legal liability for AI: Claude (Anthropic) is not liable for any issues in AI-generated code or content. Liability falls on FAWN creator.
• Daily Brief disclaimer: News summaries are AI-generated. May contain inaccuracies, misinterpretations, or omissions. Not fact-checked by humans. Definitely not investment advice.

Opt-Out

Users uncomfortable with AI-generated services can:

• Opt-out of Daily Brief: Disable podcast notifications in settings.
• Request human review: Email alex@getfawn.com for security concerns or bug reports (will be reviewed by human).
• Use alternative platforms: This is still a beta product. Consider traditional crypto wallets (MetaMask, Ledger) if you prefer non-AI software.

📊 Data Transparency: What FAWN Collects

Personal Data We Collect

• Email address: Required for signup and login.
• Password: Hashed with bcrypt, never stored in plain text.
• Wallet address: Your public Ethereum/Polygon wallet address.
• Transfer history: Every transfer you make (sender, recipient, amount, fee, timestamp).
• IP address: Logged for every wallet creation and transfer (security/fraud prevention).
• User agent: Browser/device info logged (security auditing).
• Signup timestamp: When you created your account.

Personal Data We DO NOT Collect

• Seed phrases: Not shown to users for custodial accounts and never logged.
• Private keys: Encrypted at rest using envelope encryption and accessed only by the signing service when an authorized transfer requires it.
• Real name: Not required; email is sufficient.
• Identity documents: No KYC (Know Your Customer) verification. No government ID required.
• Phone number: Not collected.
• Credit card or bank account: Not collected (FAWN doesn't process fiat).

How We Use Data

• Service operation: Email for login, wallet address for transfers, IP for security.
• Fraud prevention: IP address and transfer patterns monitored for suspicious activity.
• Audit trail: All transfers logged for financial compliance (7-year retention).
• Analytics (anonymized): Aggregate stats like "average transfer amount" or "daily active users". No individual data sold or shared.
• Regulatory compliance: Transfer records kept in case of government request (7 years).

Data Retention

• Account data: Kept indefinitely while account is active.
• Transfer history: Kept for 7 years (financial record keeping law).
• IP logs: Kept for 90 days, then deleted.
• On deletion: Account can be soft-deleted (marked inactive), but transfer records remain for compliance.

Third Parties

• No third-party data sharing: FAWN does not sell user data to advertisers, brokers, or data aggregators.
• Infrastructure only: Data is hosted on Railway (backend server provider) and GitHub (frontend CDN). Both have privacy policies available.
• Blockchain is public: Once USDC transfers are settled on-chain, they are visible to everyone. This is blockchain transparency, not FAWN's policy.

User Rights

• Data export: POST /user/export to download all personal data as JSON.
• Account deletion: POST /user/delete to request account removal (soft-delete; transfers remain for compliance).
• Privacy inquiries: Email alex@getfawn.com with data subject access requests (GDPR, CCPA).

🔒 Security Notice

Security Measures

• JWT bearer token authentication (1-hour expiry)
• HTTPS only (no unencrypted connections)
• Input validation on all endpoints (wallet addresses, amounts, memo)
• Rate limiting (prevent brute force, DOS)
• Secrets stored in environment variables (not in code)
• SQLAlchemy ORM (prevents SQL injection)
• No sensitive data in logs (seed phrases, private keys, full amounts)

Known Limitations

• Custodial wallet MVP: Private keys encrypted in database. Future: hardware wallet backup, 2FA.
• No on-chain settlement yet: Transfers instant in our ledger; actual blockchain sweep is manual (future automation).
• No penetration testing: Has not undergone professional security audit. Use at own risk.
• SQLite in dev: Ephemeral database on Railway (resets on deploy). Data loss possible. Postgres recommended for production.

Report Security Issues

Found a vulnerability? Email alex@getfawn.com with details. Do not disclose publicly until patched (responsible disclosure).

📋 Terms of Service Summary

Full Terms of Service available at /terms.html. Key points:

• Wallet custody: Users control their account access and payment instructions; FAWN is custodian of wallet signing keys.
• Account responsibility: Users are responsible for password security, device security, and reviewing payment details before sending.
• Fee structure: $0.01 (100 cents) flat fee per transfer. Immutable. No hidden fees.
• No refunds: Transactions are final. No refunds for user error (wrong address, lost seed).
• Liability cap: FAWN liability capped at fees paid in prior 30 days. Maximum refund = recent fees.
• Service suspension: FAWN may suspend accounts for fraud, abuse, or regulatory non-compliance.
• Changes to terms: FAWN may modify terms with 30 days notice. Continued use = acceptance.

📧 Questions?

For questions about any legal notice, data, security, or AI involvement:

• Email: alex@getfawn.com
• GitHub: GoldstarOrbital/fawn-backend
• Security issues: alex@getfawn.com (responsible disclosure)

FAWN v0.2.0 | Crypto-Native Stablecoin Payments | Experimental Platform | Use at Own Risk