Privacy Policy
NoxHash Privacy Policy — how we collect, use, store, and protect your personal data on our cloud mining platform.
Privacy Policy
How We Handle Your Data
Effective Date
April 15, 2026
Introduction
NoxHash ("we," "us," or "our") operates a cloud mining rental platform that allows users to rent cryptocurrency mining hardware hosted in our data center facility in Kazakhstan. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our website, platform, and related services (collectively, the "Services").
By creating an account or using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our data practices, please do not use the Services.
This policy applies to all users worldwide and is designed to comply with the General Data Protection Regulation (GDPR), as well as other applicable data protection laws.
Information We Collect
We collect different categories of information depending on how you interact with our platform. The table below provides a comprehensive overview.
| Category | Data Collected | When |
|---|---|---|
| Account Data | Full name, email address, hashed password, Google OAuth ID (if applicable) | Registration |
| Financial Data | BTC wallet addresses (withdrawals), USDT wallet addresses (deposits), transaction history, rental purchase records, earnings data | Platform usage |
| Security Data | 2FA TOTP secrets, API key identifiers, login timestamps, session tokens | Account security setup |
| Usage Data | IP addresses, browser type and version, device information, pages visited, referral URLs, time spent on pages | Automatically on each visit |
| Support Data | Support ticket content, messages, attachments | When you contact support |
| Preference Data | Language preference, theme preference (light/dark), notification settings | Platform usage |
How We Use Your Information
We use the information we collect for the following purposes:
Service delivery -- Creating and managing your account, processing miner rentals, executing deposits and withdrawals, calculating and distributing mining earnings.
Account security -- Authenticating logins, managing two-factor authentication (TOTP), monitoring for unauthorized access, validating API key usage.
Fraud prevention -- Detecting suspicious activity, preventing unauthorized transactions, blocking abusive behavior, enforcing our Terms of Service.
Communication -- Responding to support tickets, sending transactional emails (withdrawal confirmations, rental expirations), and notifying you of important platform changes.
Affiliate program -- Tracking referral relationships, calculating and distributing affiliate commissions, attributing sign-ups to referral sources.
Platform improvement -- Analyzing usage patterns to improve user experience, fix bugs, optimize performance, and develop new features.
Legal compliance -- Fulfilling regulatory obligations, responding to lawful requests from authorities, maintaining records as required by applicable law.
Legal Basis for Processing
Under the GDPR and similar data protection regulations, we process your personal data based on the following legal grounds:
| Legal Basis | Applies To |
|---|---|
| Contract performance | Account creation, miner rental processing, deposit/withdrawal execution, earnings calculation and distribution, support ticket handling |
| Legitimate interest | Fraud prevention, platform security monitoring, usage analytics for service improvement, affiliate program management |
| Consent | Marketing communications, optional analytics cookies, Google OAuth authentication |
| Legal obligation | Tax reporting, anti-money laundering compliance, responding to lawful government requests, maintaining transaction records |
Where we rely on legitimate interest, we have conducted balancing tests to ensure your rights and freedoms are not overridden. You may request details of these assessments by contacting us.
Data Sharing & Third Parties
We do not sell your personal data. We share information only when necessary to operate the platform or when required by law. The following categories of third parties may receive your data:
Blockchain Networks
When you initiate a BTC withdrawal or USDT deposit, your wallet address and transaction amount are broadcast to the respective blockchain network. Blockchain transactions are public and permanent by design -- we cannot control or delete on-chain data.
Payment Processors
We work with third-party cryptocurrency payment processors to facilitate USDT deposits. These processors receive your wallet address and transaction details as needed to complete the transaction. They operate under their own privacy policies.
Authentication Providers
If you choose to sign in with Google OAuth, Google receives confirmation that you are authenticating with NoxHash. We receive your name and email address from Google. We do not access your Google account beyond basic profile information.
Infrastructure & Hosting
Our servers and databases are hosted by third-party cloud providers. These providers may process your data as part of delivering hosting services but are contractually prohibited from using it for their own purposes.
Law Enforcement & Regulators
We may disclose personal data when required by law, court order, or governmental regulation. We will notify you of such requests unless prohibited by law from doing so.
Cookies & Tracking
We use cookies and similar technologies to operate the platform and improve your experience. Here is what we use and why:
| Cookie Type | Purpose | Duration |
|---|---|---|
| Session | Maintains your authenticated session, CSRF protection | Browser session (expires on close) |
| Locale Preference | Stores your selected language (EN, VI, ZH, RU, KO, JA) so we can serve the platform in your preferred language | Session-based |
| Theme Preference | Remembers your light/dark/system theme choice via localStorage | Persistent (localStorage) |
| Affiliate Tracking | Tracks the referral source when you arrive via an affiliate link, used to attribute sign-ups and calculate commissions | 30 days |
| Remember Me | Keeps you logged in across browser sessions if you opt in | Up to 30 days |
We do not use third-party advertising trackers or sell cookie data. You can manage cookies through your browser settings, though disabling essential cookies may prevent you from using the platform.
Data Security
We implement multiple layers of security to protect your personal data from unauthorized access, alteration, disclosure, or destruction:
Encryption
All data in transit is encrypted via HTTPS/TLS. Passwords are hashed using bcrypt with per-user salts. Sensitive fields such as 2FA secrets and API keys are encrypted at rest.
Two-Factor Authentication
Users can enable TOTP-based 2FA (compatible with Google Authenticator) for an additional layer of account protection on login and sensitive operations like withdrawals.
Infrastructure Security
Our servers are protected by firewalls, intrusion detection systems, and DDoS mitigation. Database access is restricted to authorized services only, with all queries parameterized to prevent injection attacks.
Access Controls
Internal access to user data follows the principle of least privilege. Administrative actions are logged and auditable. API keys are scoped with specific permissions and can be revoked at any time.
While we implement industry-standard security measures, no system is completely immune to threats. We encourage all users to enable 2FA, use strong unique passwords, and keep their API keys confidential.
Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law.
| Data Type | Retention Period |
|---|---|
| Account data | Duration of account existence + 30 days after deletion request |
| Transaction records | 7 years (financial record-keeping requirements) |
| Support tickets | 3 years after ticket resolution |
| Server logs (IP, access) | 90 days |
| Affiliate tracking data | Duration of affiliate relationship + 1 year |
When data is no longer needed, it is securely deleted or anonymized so that it can no longer be associated with you.
Your Rights
Depending on your location, you may have the following rights regarding your personal data under applicable data protection laws, including the GDPR:
Right of Access
You can request a copy of the personal data we hold about you. We will provide this in a commonly used, machine-readable format.
Right to Rectification
You can update your name, email address, and wallet addresses directly in your account settings. For other corrections, contact our support team.
Right to Erasure
You can request deletion of your account and associated personal data. Note that we may retain certain data (such as transaction records) where required by law or for legitimate business purposes.
Right to Data Portability
You can request your personal data in a structured, commonly used, machine-readable format (JSON or CSV) and have it transferred to another controller where technically feasible.
Right to Object
You can object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
Right to Restrict Processing
You can request that we limit processing of your data in certain circumstances, such as while we verify the accuracy of your data or assess an objection.
Right to Withdraw Consent
Where processing is based on consent (e.g., marketing emails, Google OAuth), you can withdraw consent at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.
International Data Transfers
NoxHash operates its mining infrastructure in Kazakhstan and may use hosting and service providers located in various jurisdictions. Your personal data may be transferred to, stored, and processed in countries other than your country of residence.
When we transfer personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission, incorporated into our agreements with data processors.
- Adequacy decisions where the destination country has been recognized as providing adequate data protection.
- Technical safeguards such as encryption in transit and at rest, ensuring data remains protected regardless of location.
You may request a copy of the safeguards we use for international transfers by contacting us at [email protected].
Children's Privacy
NoxHash is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. Our registration process requires users to confirm that they are at least 18 years of age.
If we discover that we have inadvertently collected personal data from a person under 18, we will take immediate steps to delete that data and terminate the associated account. If you believe a minor has provided us with personal information, please contact us at [email protected] so we can take appropriate action.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:
- Update the "Effective Date" at the top of this page.
- Post a notice on the platform dashboard for logged-in users.
- Send an email notification to registered users for significant changes that affect how we handle personal data.
We encourage you to review this page periodically. Your continued use of the Services after changes are posted constitutes acceptance of the updated policy.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, you can reach us through the following channels:
Support Ticket
Submit a ticket through your account dashboard under "Support"
Response Time
We aim to respond to all privacy-related inquiries within 30 days