Privacy policy

What Treasury Guild stores about you, who can see it, and how to have it changed or deleted.

This page explains what Treasury Guild knows about you, why, and what you can do about it. Treasury Guild is operated by André Diamond. For any privacy question or request, write to andruzkas@gmail.com. The Terms of service cover using the app.

Last updated: 2 November 2026 (Payday allocation rules: per paying treasury, percent, destination address or sibling treasury, token scope, and who created the rule — members can read them; earlier: bridge/swap conversion episodes on Cardano inflows: sent amount/asset/chain, optional address, fee lines, foreign-chain proof hashes and notes members can read; writing them counted under abuse protection; earlier: watched float wallets: name, address and optional note members can read, plus chain activity at those addresses; creating one is counted under abuse protection; earlier: an SDK treasury's stake address and optional DRep key hash are read from each signer's connected wallet and kept on a signer invite until the treasury is created or the invite expires; earlier: AI assistants may be granted governance:write to prepare stake / DRep / Cardano vote pending transactions; earlier: SDK treasury stake and optional DRep key hashes for plain wallets that stake or act as a Cardano DRep; earlier: which admin archived a treasury, cleared when it is restored; earlier: community invite links: token hash, creator, expiry, use count; earlier: funding sources and commitments a community's admins record; treasury payout Discord may use a bot channel or a pasted webhook; governance Discord posts and discussion threads via the community's connected bot instead of a pasted webhook; ballots are accountable among members once visible, not anonymous; Discord reminders when on-chain proposal anchors sit due or a closed anchor's copy-grace window is ending; GitHub archive repository as a second place admins can publish frozen tally records; changes an AI assistant makes for you after you confirm them, the draft id they keep and that members can see it, and what is kept with an assistant's sign-in codes and renewal tokens; sign-in challenges and their retention, sign-in counted by IP address only, Google access revoked only when no other community uses the account, why a co-signer signature failed; treasury templates: signer groups, the app-held co-signer key and its decision log; frozen and published tally records, decisions cited on-chain, outside-spend alerts, on-chain proposal anchors).

The short version

You sign in with a Cardano wallet. There are no passwords, and Treasury Guild never sees your keys or seed phrase.
Treasury Guild stores your wallet address, the display handle you choose, and the accounts you decide to link.
It uses no advertising, no analytics and no tracking cookies, and it does not sell or rent data to anyone.
Payments happen on the Cardano blockchain, which is public and permanent. Nobody, including Treasury Guild, can erase a transaction from it.
Votes in a community are signed and shown to its members once voting closes (or while it runs, if the community shows results live). They are not anonymous: that is how the community checks spending decisions.

What Treasury Guild stores

Your wallet address. It is your identity in the app and the address your rewards are paid to. When you sign in, your wallet signs a one-time message; Treasury Guild checks the signature and keeps the address, not the signature. The message is a random challenge, stored with the address it was issued for and its expiry (5 minutes) only until it is used or has expired.

Your profile. The display handle you set on the Profile page. It is optional and you can change it at any time.

Accounts you link. Linking is always optional and always started by you.

GitHub: your GitHub username and numeric user id, so that issues assigned to you on GitHub can be paid to your wallet. Treasury Guild asks GitHub for your public profile only. When a community connects a GitHub repository, Treasury Guild also keeps each event GitHub sends about its issues (the issue's text and the GitHub usernames in it) in order to process it; these events are kept without expiry.
Discord: your Discord user id and display name, so that you can be recognised in a community's voice calls. Treasury Guild asks Discord for the identify scope only: no email, no messages, no server list.
Google: your Google account's identifier (the OpenID sub value), so that you can be recognised in a community's Google Meet calls. Treasury Guild asks Google for the openid scope only. It does not receive or store your email address, name, picture, contacts, calendar or files, and it keeps no Google access token after linking. (A community admin who connects a Google account as the meeting host grants more; see below.)

Voice calls a community captures. A community can connect its Discord server so that attendance of its calls is recorded. While such a call runs, the Treasury Guild bot notes who is in the call's voice channel every few minutes (and once whenever a manager presses Capture now, which works from 15 minutes before the start): your Discord user id, the name you show in that server, and the times you were seen. This happens whether or not you use Treasury Guild, because that is how the community counts attendance; the bot does not join, listen to or record the call, and reads no messages. The community's members see your name on the call's attendee list. Your Discord user id is never shown to them; it is used only to recognise you across snapshots and to find your wallet if you linked your Discord account. The same bot, when admins pick a governance channel, may also post into that Discord channel (see below); it still does not read Discord messages.

A community can likewise connect the Zoom account that hosts its meetings. For the meetings it lists as rewarded calls, or links in advance so that every occurrence is listed by itself, Zoom tells Treasury Guild who joined and left: the name you show in the meeting, your Zoom user id if you are signed in to Zoom, and the times. Treasury Guild does not read, keep or pass on your email address, and receives no audio, video, chat or recording. The name appears on the call's attendee list for the community's members; the Zoom user id is never shown to them. Because a call is often listed after its meeting has started, the same details (name, Zoom user id if any, times), with the meeting's id and topic, from the connected account's other meetings are held temporarily for a call to claim them. The background cleanup job runs every five minutes and deletes unclaimed entries older than 24 hours; if the job is delayed, deletion waits until it runs again. Until then the community's admins and workgroup leads see only that the meeting took place (topic, time, number of participants); nobody sees who was in it. The community's members can see that a Zoom account is connected, under its Zoom display name; the account's id is not shown to them. The connected host account's access tokens are stored so the participant report can be read, and are deleted when the community disconnects the account or removes the app in Zoom.

The same holds for Google Meet: a community can connect the Google account that creates its meetings, granting Treasury Guild read access to that account's Google Meet conference records. Treasury Guild uses it only to read attendance, never audio, video, chat, recordings, transcripts or calendar. For the meetings it lists as rewarded calls, or links in advance so that every occurrence is listed by itself, Treasury Guild reads who joined and left (for a linked meeting it also checks every few minutes whether a new occurrence has started; the account's other meetings are never read): the name you show in the meeting, your Google account id if you are signed in to Google, and the times. No email address is read. The name appears on the call's attendee list; the Google account id is never shown to members and is used only to find your wallet if you linked your Google account. The host account's access tokens are stored for this and are deleted when the community disconnects the account or connects another one; Treasury Guild then also revokes its access at Google, unless another community is still connected to the same Google account.

Community invite links. A community's admins can create invite links so people join with their wallet (the usual path for a private community; invites also work when the community is public). Treasury Guild stores a one-way hash of each link's token (never the link itself after creation), which admin created it, optional expiry and use limit, how many times it has been used to add a new member, when it was last used, when it was revoked if it was, and an optional label the admin typed for their own notes. Looking up a link before joining is counted by IP address; redeeming one is counted by wallet. Expired or revoked links are deleted about 90 days later. A link that has hit its use limit and never expires stays until an admin revokes it (then the same 90-day window applies). Joining through an invite creates the same membership record as any other join; the invite does not record a separate list of who used it.

SDK signer invites. When an admin creates a plain treasury that can stake, each listed signer connects their wallet and Treasury Guild reads that wallet's stake address and, when the wallet provides one, its DRep key hash (public key material, not a private key). Until the treasury is created, those values sit on the invite together with a one-way hash of the link, which admin created it, the treasury name, the payment addresses the admin listed and when the invite expires (7 days). Members cannot read the invite. The admin who is creating the treasury sees which of those payment addresses have connected, not the stake addresses or DRep hashes. Looking up the link is counted by IP address; sending keys is counted by wallet. The stake address is deleted when the treasury is created (the treasury then keeps the stake key hash and, when one was provided, the DRep key hash, as described above) or when the invite expires. The cleanup job deletes expired invites.

Recognition (when enabled). If a community turns on Recognition, Treasury Guild stores endorsement and kudos events: which wallet granted them, which wallet received them, which paid task they refer to, an optional short note, the season key, and whether they were later revoked (with who revoked and why). Members of that community can read those events. Recognition settings and a log of who changed them are also stored. Turning the module off stops new events; history is kept.

What you do in a community. Your memberships and roles, the tasks assigned to you and their bounties, your attendance at community calls (the name shown in the call, and whether you checked in), the payouts made to your wallet, and the transactions you create, sign or reject as a treasury signer, in whichever group of the treasury's script your wallet sits (base signer, recovery signer or co-signer; see Treasury templates), together with the name the treasury's creator gave you as its signer. A community's admins may configure Payday allocation rules for a treasury (a percent of paid tokens to an outside address or sibling treasury); members can read those rules (label, rate, destination and token scope) and see the resulting outputs on the transaction. For a plain SDK treasury, Treasury Guild also stores the stake key hash and, when provided, the DRep key hash of each base signer (public key material used to build the wallet's stake and DRep scripts — not private keys). When an admin archives a treasury, Treasury Guild stores that admin's wallet and the time. Members of the community can read both, the same way they can read the treasury. Both are cleared when it is restored. Treasury Guild also copies from the blockchain the transactions that reach or leave a community's treasuries and float wallets, including the sending addresses of incoming payments and the receiving addresses of spends made outside Treasury Guild; the community's members see them on the Treasury and Incoming pages. An admin who registers a float wallet may add a free-text note (for example who holds the key); members can read it. An admin may attach a bridge or swap conversion to a Cardano inflow: what was sent on another chain (amount, asset label, chain, optional address), fee lines, foreign-chain transaction hashes (and optional explorer links), and a note; members of the community can read that record. When a community creates a co-signer treasury with Treasury Guild as the co-signer, Treasury Guild generates a signing key for that treasury and keeps it encrypted on the server; it belongs to no person, it is never shown, it can never be rotated, and it is deleted with the treasury. Every time that key's check runs on a transaction, the outcome (passed or refused, the problems in words, whether it signed, why signing failed if it did, and what triggered the run) is recorded and shown to the community's members; it names no person. A wallet can be recorded without ever signing in: when a community assigns a task or sends a payment to an address, or when a payout found on the blockchain is imported, the receiving address, which the chain already shows, is kept as the task's assignee or the payment's recipient. Nothing else is stored about it, and it is not made a member of the community. When a community's manager links a name from a call to your wallet with Remember this name, the community keeps that name with your wallet so that it is linked by itself in the community's later calls. Members cannot read these entries; ask the community's admins or the operator to remove one.

Proposals and votes. When a community votes on a proposal, Treasury Guild keeps the proposal (its text, what it changes and which wallet made it), the list of members who could vote on it, and each ballot: the choice, the reason you gave, the exact text your wallet signed (which names the proposal, your choice and reason, your wallet address and the time), and the signature with your wallet's public key, so that anyone in the community can check the result. Ballots are not anonymous: hiding them until voting closes only stops herd voting; after the close (or sooner, if the community shows results live), members can see who voted how. That accountability is intentional for budgets and other spending decisions. Only your latest ballot is kept. Which wallet withdrew or cancelled a proposal (with the reason given), which admin removed a workgroup lead immediately (with the reason given), and which admin changed the community's governance settings, is recorded too and shown to the community's members. The community's members see who could vote and how many have voted; they see each member's choice, reason and signature once voting closes (or while it runs, if the community shows results live). You always see your own ballot. Once ballots are visible, a member can download the proposal's signed tally, which contains the same ballots, signatures and voter addresses. When a proposal that reached a vote is over, that tally is frozen: stored once as a file with its hash, so that every later download is the same. A community's admins can choose to have each new frozen tally also published to IPFS (through Pinata), where it is public, permanent and cannot be removed; it then holds the proposal (with the proposer's address and, for a new workgroup, its proposed leads' addresses), the addresses of everyone who could vote and whether each was recused, and every ballot with its choice, reason, signature and wallet address. Treasury Guild records where each copy was published and checks now and then that it still resolves. Proposals and ballots are the community's decision record: they are kept while the community exists, including after you leave it. The ballots themselves are never sent to the blockchain; a payout or payment that carries out a decision names the proposal's number and content fingerprint in its on-chain record, never a voter. A proposal's on-chain anchors carry only the community's slug, the proposal's number and state, the fingerprints of its content, rules and voter list (a hash of the sorted addresses, which does not list them), the frozen tally's hash and counts, and where a published copy is; never an address, a name or a ballot.

Payment history a community imports. A community that moved from another wallet can import that wallet's past payments from a CSV file its admins prepared (see Payment history from a previous wallet). For each payment Treasury Guild keeps the last characters of the receiving address as the file gives them (usually 6; the whole address if the file has it), the task text, the date, the workgroup and the amounts, plus the file's name and who imported it. The old wallet itself is never read. Only the community's admins see the address endings and the individual lines; its members see the task text and amounts in the Dashboard's spending detail and totals. A recipient is shown by name only where exactly one known wallet of the community ends with those characters. The community's admins can remove a line, a file or the whole history at any time, and doing so deletes it.

Funding sources a community records. A community's admins can list outside funders and what those funders committed: a name, optional description and link, commitment amounts and dates, optional notes, and (for a schedule) the periods from a CSV the admins upload. Admins may also tag an incoming treasury payment as received from one of those sources. The community's members see the sources, commitments and tags on the Funding and Dashboard pages; the CSV itself is not kept after the periods are saved. This is the community's own bookkeeping about who funds it, not a link to anyone's personal account. Admins can edit or delete a source or commitment at any time.

AI assistants you connect. When you approve an AI assistant (such as Claude) on the Connect an AI assistant page, Treasury Guild keeps the assistant's name, its website and the return address it registered, which wallet approved it, the permissions you granted, when you approved it and when it was last used (to within an hour). The sign-in codes and renewal tokens it is given are stored only as one-way hashes; alongside each, Treasury Guild keeps the wallet, the permissions, the return address and when it expires, was used or was replaced. An assistant that identifies itself by a web address has that address and its published details stored, and fetched again from time to time. Treasury Guild does not store what you ask the assistant or what it answers: the assistant receives the same community data you can see as a member, and what it does with it is governed by that assistant's own privacy policy. If you granted it a write permission, it can make or withdraw proposals, create and edit tasks, create calls and pay their attendance, prepare payout transactions for the signers, and (with governance:write) prepare stake, DRep or on-chain Cardano vote transactions for plain SDK treasuries you sign for. Each change is previewed first and carried out only when the assistant confirms that preview, and is recorded as it would be if you had done it in the app (proposals, calls and transactions name your wallet; tasks, as in the app, record no author). A proposal, task, call or transaction it creates also keeps the random id of the preview that made it, so that confirming twice does it once; withdrawals, edits and the attendance tasks of a paid call keep none. That id contains nothing about you, but the community's members can see that the record was made through an AI assistant. Treasury Guild does not store the preview itself: it travels inside the signed (not encrypted) token the assistant holds, so the assistant can read it. Assistants that register but are never approved are deleted a day after they registered or were last looked up.

Abuse protection. To stop sign-in and check-in codes being guessed and the app being flooded, Treasury Guild counts requests to a few actions (signing in, checking in to a call, uploading images, looking up wallets on the blockchain, creating communities, registering wallet addresses for tasks, importing payment history, making proposals and voting, connecting and using AI assistants, creating invite links, looking up and redeeming invite links, creating SDK signer invites, looking them up and sending stake and DRep keys, registering a float wallet, creating or updating a bridge/swap conversion). A count is keyed by your wallet address (for a check-in, together with the call) or, for sign-in and invite previews, by the IP address the request came from; an AI assistant registering or signing in is counted by IP address alone, and a manager's Capture now by the call alone. It holds only a number per window of one minute to one hour, and is deleted about a day later.

What your browser keeps. One essential cookie, tg_session, keeps you signed in for up to 7 days; signing out removes it. Your browser's local storage remembers which wallet app you connected, whether the sidebar is collapsed, and which Overview setup reminders an admin dismissed for a community. None of this is used for tracking.

Who can see it

Members of a community see that community's members (wallet address, handle, GitHub username), tasks, assignees, call attendee lists, treasuries, float wallets (name, address and optional note), bridge/swap conversions on inflows, and payouts. A public community's overview can be seen by anyone.
Everyone signed in can see the wallet addresses, handles and GitHub usernames of contributors, because they label payouts and assignees. When GitHub assigns someone to a task, Treasury Guild also stores that person's immutable GitHub user id on the assignee row (not shown in the app) so a renamed login cannot claim their unpaid tasks.
Only you can see which Discord or Google account your wallet is linked to. A community's managers see the name you used in a call, not your account id. An SDK signer invite's stake addresses and DRep hashes are not shown to members; only the admin creating that treasury sees which listed payment addresses have connected.
The blockchain shows every payout publicly: the paying treasury, the receiving address, the amounts, and a small record naming the community, the workgroup, the task number, the budget period and, when a decision is behind it, the number and content fingerprint of the proposal (never who voted). Treasury Guild does not automatically add personal handles, names or linked accounts to this record. Workgroup names are public, and manual payments also publish any memo their author enters; do not put private information in a memo.

Services Treasury Guild relies on

Treasury Guild shares data with other services only as far as running the app requires:

Supabase hosts the database and Netlify hosts the app. Both process the data above on Treasury Guild's behalf.
Koios (a Cardano API) receives wallet and treasury addresses and transactions, to read balances and submit payments.
GitHub, Discord, Google and Zoom are contacted when you link an account, or when a community connects its own organisation, server or meeting account.
Pinata (IPFS) stores token images that a community uploads when minting and, when a community's admins choose IPFS publication, its frozen tally records (voter addresses and ballots included). IPFS content is public and permanent.
GitHub (the community's App installation) receives the same frozen tally records when admins choose a GitHub archive repository under Governance settings. Those commits are as public as the archive repository.
CoinGecko is asked for exchange rates. No personal data is sent.
A community may connect Discord payout announcements per treasury: either a channel on its connected Discord server (the bot posts) or a pasted incoming webhook URL. The summary carries workgroup names, totals, budget and treasury balances, transaction hash and links; no individual handles or wallet addresses.
A community that connected its Discord server for calls may also pick a governance Discord channel. The Treasury Guild bot posts proposal announcements there (title, kind, deadlines, turnout, counts, the reason given for a withdrawal or cancellation, why a passed proposal could not be applied, and links; never who voted or how), opens a discussion thread or forum post for each proposal that has a discussion period (Treasury Guild stores that thread's link on the proposal; it does not read or store the discussion messages), and, while the community decides budgets by vote, notes each treasury transaction that was not built in Treasury Guild (the treasury, the amounts and the transaction link; never who received it). The same channel may also receive reminders when on-chain proposal anchors have sat due (proposal numbers and which step) or when a closed anchor's published-copy window is ending; those reminders name no person and no wallet.

How long it is kept

Your profile and linked accounts are kept until you remove them or ask for deletion. Tasks, payouts, signatures and attendance that led to a payment are a community's financial records and are kept so that its spending stays auditable; proposals and signed ballots are likewise its decision records. SDK signer invites are deleted when the treasury is created, or by the cleanup job once they have expired (7 days). Community invite links that have expired or been revoked are deleted about 90 days later; links that are still usable stay until an admin revokes them or they expire; used-up links that never expire stay until revoked (then the same 90-day window). Call attendee lists, with the names, times and platform ids behind them, stay with their call until a manager removes the entry or deletes the call; there is no automatic expiry. An AI assistant's approval is kept until you disconnect it, or until Treasury Guild ends it after seeing its sign-in copied and reused; its sign-in codes are deleted a day after they expire and its renewal tokens once they expire (at most 30 days). Sign-in challenges are deleted once used, or by the cleanup job (every 15 minutes) once they have expired. To refuse replayed Zoom notifications, a one-way hash of each notification's signature is kept for 10 minutes; the cleanup job that deletes it runs every five minutes, and if it is delayed, deletion waits until it runs again. Events received from GitHub are kept without expiry. Blockchain transactions are permanent by design.

Your choices

Unlink GitHub, Discord or Google at any time on the Profile page. The link is deleted immediately.
Change or clear your display handle on the same page.
Disconnect an AI assistant under AI assistants on the same page. It loses access on its next request.
Leave a community by contacting its admins or the operator at the address above. The Members page has no removal button yet; removal currently needs administrative support. Treasury signers and the community owner cannot be removed through the membership API.
Captured in a call but not a user? Write to the address below (or to that community's admins) to have your entries removed from its attendee lists.
Ask for a copy, a correction or deletion of your data by writing to andruzkas@gmail.com from a contact you can show belongs to the wallet (for example by signing a message). Deletion removes your profile, linked accounts and memberships. Records of payments already made stay as financial history under your wallet address alone, and nothing can be removed from the blockchain.

Depending on where you live, you may also have the right to complain to your data protection authority.

Children

Treasury Guild is not meant for children under 16 and does not knowingly collect their data.

Changes to this page

When this policy changes, the date at the top changes with it.