Privacy Policy

Last updated: 2 October 2026. Effective: on publication.

Introduction

Najm Protocol ("Najm", "we", "us" or "our") respects your privacy. Najm Protocol is a project operated by its team and is not yet a registered company. This Privacy Policy explains what information we handle when you use the Najm Protocol website and web application at najmprotocol.com and its subdomains (the "Interface") and related services (the "Services"), how we use it, and your rights.

Please read it together with our Terms of Use. Terms defined there have the same meaning here.

By using the Services, you acknowledge that you have read this Privacy Policy. If you do not agree with it, please do not use the Services.

1. Who we are

Najm Protocol, a project operated by its team (not yet a registered company). If a legal entity is formed to operate the Services, this policy will be updated to name it.
Email: doctorfarrukhhabib@gmail.com
Website: najmprotocol.com

2. In short

No accounts. You do not sign up or give us your name to use Najm.
No keys. We never see, collect or store your private keys, seed phrase or wallet passwords, and we will never ask for them.
No wallet addresses in our records. Your wallet address is used only for as long as it takes to check and prepare your swap. Our compliance receipts do not store it.
No selling of data, and no advertising trackers.

3. Information we handle

3.1 When you connect a wallet and request a swap

To check a swap before you sign it, your wallet address and the swap details (network, tokens and amount) are sent to our servers. We use them to:

obtain a quote from a DEX aggregator (currently KyberSwap or Velora), which receives your wallet address and the swap details so it can prepare the transaction; and
simulate the transaction from your wallet address through a blockchain data provider (currently Alchemy), to confirm it moves only the expected tokens.

We do not store your wallet address after the quote is returned to you.

3.2 Compliance receipts

Before you sign, we save a fingerprint of the checked transaction, with the network, tokens, amounts, route and the result of each Shariah rule check. After your swap is confirmed, we read the transaction from the public blockchain and save a compliance receipt containing:

the network and transaction hash;
the tokens, amounts, route and venues;
the router contract used and the aggregator that provided the route;
the version of the approved token list and the result of each rule check; and
the result of our post-trade audit of what actually moved.

Compliance receipts do not contain your wallet address. However, a transaction hash is public, and anyone can look it up on a blockchain explorer, where the sending wallet is visible. Receipts may be published on the Interface, at an address based on the network and transaction hash.

3.3 Technical information

Like most websites, our hosting provider automatically processes technical information when you visit the Interface, such as your IP address, browser and device type, the pages requested, and the date and time. This is used to deliver the Interface, keep it secure and fix problems. Our servers may also limit how often an IP address can request quotes, to prevent abuse.

We do not currently use analytics or advertising tools. If we add analytics in the future, we will update this policy first.

3.4 Information stored in your browser

The wallet-connection service stores information in your browser's local storage, such as which wallet you connected, so that you stay connected between visits. This information stays on your device. We do not use advertising, retargeting or profiling cookies.

3.5 When you contact us

If you email us, we receive your email address, any name you give, and the content of your message. We use this only to reply and to keep a record of our correspondence.

3.6 What we do not ask for

We do not ask for your name, identity documents, date of birth, bank or card details, or any sensitive personal information (such as health, religious beliefs or biometric data). Please do not send these to us. If you include them in a message, we will handle them with care, but we are not responsible for information you choose to send.

4. How we use information

We use the information described above to:

provide the Services: connect your wallet, check routes against the Shariah rules, prepare transactions and record compliance receipts;
keep the Services secure and working: monitor performance and availability, prevent abuse, and find and fix problems;
respond to you: answer your messages and tell you about material changes to our Terms or this policy; and
meet legal obligations: respond to lawful requests from courts, regulators or authorities.

Where the law requires a legal basis, we rely on: performance of a contract (providing the Services you request); legitimate interests (operating, securing and improving the Services); legal obligation; and, where relevant, your consent.

5. Who receives information

We do not sell, rent or trade personal information. Information is shared only as follows:

5.1 Service providers

We use the following providers to run the Services. They process information on our behalf or as described in their own privacy policies:

Vercel (website hosting and server functions);
Neon (database for compliance receipts);
Alchemy (blockchain data and transaction simulation);
Reown / WalletConnect (wallet connection); and
CoinGecko (market prices). CoinGecko is contacted by our servers only; no information about you is sent to it.

5.2 DEX aggregators and blockchains

When you request a swap, your wallet address and the swap details are sent to the DEX aggregator preparing it (currently KyberSwap or Velora). When you sign, your Wallet broadcasts the transaction to a public blockchain. These parties are independent, and their own policies apply to the information they receive or observe.

5.3 Legal disclosure

We may disclose information to competent authorities, regulators, law enforcement or courts where required by law, or where we believe in good faith that it is necessary to comply with applicable law, to enforce our Terms, or to protect the rights and safety of Najm Protocol, our users or others.

5.4 Business transfers

If Najm Protocol is incorporated, or is involved in a merger, acquisition, sale of assets or restructuring, information may be transferred as part of that transaction. We will take reasonable steps to ensure it remains protected.

6. Public blockchains

6.1 Transactions you sign, including your wallet address, tokens, amounts and transaction hash, are recorded permanently and publicly on the blockchain. This data is outside our control and cannot be changed or deleted by us or anyone else.

6.2 Your past on-chain activity remains publicly visible even after you stop using the Services.

6.3 We are not responsible for others observing, analysing or linking on-chain data to your identity. Please consider blockchain transparency before transacting.

7. How long we keep information

Fingerprints of checked quotes: kept so a confirmed swap can be matched to the checks made before signing; quotes that are never signed may be deleted after a short period.
Compliance receipts: kept for as long as the Services operate, as a permanent, tamper-evident audit record of Shariah compliance.
Technical logs: kept by our hosting provider for a limited period under its standard retention, then deleted.
Emails: up to three (3) years from our last contact, unless the law requires longer.
Blockchain data: permanent on the public ledger and outside our control.

8. Security

8.1 We use appropriate technical and organisational measures to protect information, including encrypted connections (HTTPS/TLS), access controls and secrets kept out of our code, and reputable infrastructure providers.

8.2 No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8.3 If a data breach is likely to put your rights at risk, we will notify you and the relevant authorities as required by law.

9. International transfers

The Najm Protocol team and our service providers may process information in different countries, including the United States. Where information is transferred between countries, we rely on appropriate safeguards, such as the providers' contractual data protection commitments.

10. Your rights

Depending on where you live, you may have the right to:

access the personal information we hold about you;
correct inaccurate information;
delete information we no longer need (we cannot delete information recorded on public blockchains);
restrict or object to certain processing;
receive a copy of your information in a portable format; and
withdraw consent where we rely on it.

Because we do not store wallet addresses or accounts, we usually hold little or no personal information that can be linked to you, apart from any emails you send us. To make a request, email doctorfarrukhhabib@gmail.com. We will respond within thirty (30) days and may need to verify your request. Reasonable requests are free of charge.

If you are not satisfied with our response, you may have the right to complain to a data protection authority in your jurisdiction.

11. Children

The Services are not intended for anyone under eighteen (18). We do not knowingly collect information from minors. If you believe a minor has sent us personal information, please contact us and we will delete it.

12. Third-party links

The Interface may link to third-party websites and services, such as blockchain explorers and project websites. This policy does not cover them; please read their privacy policies.

13. Changes to this policy

We may update this policy to reflect changes to the Services, our providers or the law. We will update the date at the top of this page and, for material changes, give notice on the Interface. Continued use of the Services after an update means you acknowledge the revised policy.

14. Governing law

This policy is governed by the laws of the United Arab Emirates and, where applicable, the laws of the Emirate of Dubai. Disputes are resolved as set out in our Terms of Use.

15. Contact

For questions or requests about this policy or our data practices:

Najm Protocol
Email: doctorfarrukhhabib@gmail.com
Website: najmprotocol.com