Privacy Policy

What We Collect

DRM3 products are designed for privacy. We collect minimal data:

• Pistachio runs locally on your machine. We do not collect prompts, responses, or browsing data. Network telemetry (wallet address, software version, staking events) is transmitted for monitoring. All transmitted data is already publicly visible on-chain.
• MorScan reads publicly available blockchain data. API requests are rate-limited by key.
• NFT marketplace: wallet addresses are visible on-chain by nature of blockchain transactions. We do not collect email, name, or personal information.
• DomainDrift scans public DNS records, TLS certificates, and WHOIS data. No personal information is collected. API keys are associated with service identity, not personal identity.
• TruthFoundry (its news scan, formerly World News RAG) collects articles from publicly distributed RSS feeds. We store article URLs, extracted text, and AI-generated analysis (summaries, entities, signals, scores). Images displayed are hotlinked from the original publisher's servers. We do not collect personal information from article readers. Publisher contact information submitted through opt-out or feed submission forms is stored in our interest collection system and used only to process the request. AI-generated briefs are labeled as AI-generated where shown. An individual named in coverage may request correction or removal (see Data Protection Contact below); we honor valid requests by removing the affected records.
• Interest & Signups: when you submit a form on drm3.io (alpha signup, publisher opt-out, feed submission), we collect name, email, and optionally company, phone, wallet address, and a message. This data is used only to process your request and is not shared with third parties.

Publisher Rights

Publishers whose content appears in TruthFoundry via RSS feeds may request removal at any time. Visit drm3.io/publisher-opt-out to submit an opt-out request. After ownership verification, we remove feeds and delete cached content within 7 business days.

All article content, images, and source material remain the intellectual property of the original publisher. DRM3 does not claim ownership of third-party content.

Data Retention

News records - source metadata, the structured fields and AI analysis DRM3 derives, and the provenance receipts over them - are retained as a permanent, queryable record, and so we can re-derive them with improved models over time. We do not age this data out on a timer; retention serves an ongoing, documented purpose.

Coverage can name real people. A publisher can have their feeds removed (see Publisher Rights, above), and an individual named in coverage may request correction or removal of records about them via the Data Protection Contact below. Valid requests are honored by targeted removal.

What We Don't Collect

• No email addresses (unless you contact us directly)
• No personal identification
• No inference prompts or responses
• No advertising trackers, ad networks, or data brokers
• No analytics cookies unless you accept them. Our sites load no analytics by default; optional Google Analytics runs only after you say yes in the cookie banner (see Analytics below)

Why We Collect Anything

One reason: to understand how our sites and products are actually used so we can improve the experience and the product. Which pages people find, what they look for, what breaks, whether anyone is there at all. That is the entire purpose. We do not sell your data, we do not share it with data brokers, we do not run advertising, and we do not build advertising profiles.

Analytics

We use Google Analytics 4, a web analytics service provided by Google LLC (and, for visitors in the European Economic Area and the UK, Google Ireland Limited), to understand how visitors use our public sites, including drm3.io, drm3.network, and drm3.xyz. Product sites such as truthfoundry.ai, morscan.io, dtaoscan.io, and domaindrift.io follow the same consent approach under their own privacy policies.

Analytics runs only if you accept it in the cookie banner. If you decline, or simply ignore the banner, no analytics code loads and nothing is sent to Google. If you accept, the following is collected: the pages you view and how you arrived here; approximate location at city level, derived from your IP address (Google Analytics 4 does not log or store the IP address itself); device information such as browser, operating system, screen size, and language; and a random identifier stored in first-party cookies (named _ga and _ga_ followed by a container id) so repeat visits can be counted as one visitor. We do not send Google your name, email address, or username. We do not use analytics data for advertising, and we do not sell it.

If you are signed in. When you are signed in to a DRM3 account and you have accepted analytics, we also send Google a pseudonymous account identifier. It exists for one reason: so that a person who uses several DRM3 apps is counted as one person instead of several. Because our apps live on separate domains, this identifier is what links your activity across them into a single view. The identifier is an opaque internal id. It is not your name, your email address, or your username, and Google cannot identify you from it on its own. We do not use it to follow you onto sites that are not ours, we never combine it with advertising data, and it is never sold. If you are signed out, or you decline analytics, no identifier is sent.

Google processes this data on our behalf as a data processor under Google's data processing terms, which include the EU Standard Contractual Clauses where they apply. Data may be processed on Google servers outside your country, including in the United States; Google LLC participates in the EU-U.S. Data Privacy Framework.

Retention: Google Analytics retains this data for up to 14 months, then deletes it automatically. The _ga cookies expire after at most two years unless you delete them sooner. Your consent choice is stored in your browser until you change or clear it. To withdraw consent, use the Cookie settings link in the footer at any time; switching analytics off deletes the Google Analytics cookies for this site and stops any further collection. Declining changes nothing else about how the site works.

Blockchain Data

Wallet addresses and transaction data are public on Base mainnet. This is inherent to blockchain technology, not a choice we make.

AI Subprocessors

Article text and analytical prompts in our news intelligence pipelines are processed by third-party AI inference providers: Venice AI, Cloudflare Workers AI, and providers on the Morpheus decentralized network. This content originates from publicly distributed news sources, not from user accounts. We do not send personal data collected through drm3.io forms to AI providers.

Our pipelines extract named entities (people, organizations, places) from publicly available news articles as part of analysis. Where this includes information relating to an identifiable natural person, that data is obtained from publicly distributed news sources rather than from the individual directly; this notice serves as the transparency information for that processing (cf. GDPR Article 14). If you object to the processing of information relating to you that appears in public news sources, contact legal@drm3.io and we will review the request.

Sanctions Screening

To comply with U.S. sanctions law, we process the IP address of incoming requests to determine coarse geographic location and block access from comprehensively embargoed jurisdictions. This screening happens at the moment of the request; we do not use it to build profiles or retain browsing histories. Where value moves on-chain, we may also screen the wallet address involved against public sanctions lists. The lawful basis for this processing is compliance with a legal obligation.

Third Parties

Other than the AI subprocessors and the consent-gated Google Analytics processing described above, we do not sell, share, or transmit user data to third parties.

Data Protection Contact

We honor data-protection and privacy rights under the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). For requests to access, correct, delete, port, or object to the processing of your information, or to opt out of any sale or sharing of personal information (we do not sell or share personal information), contact legal@drm3.io, or by mail: