Privacy Policy
Last updated: April 2026
Applies to: mondo.celo.org
1. Who we are
Celo Mondo (mondo.celo.org) is an open-source staking and governance interface for the Celo blockchain, maintained by Celo Org. Source code is publicly available at github.com/celo-org/celo-mondo.
2. What data we collect and why
2.1 Usage analytics (PostHog)
We use PostHog (hosted in the EU at eu.i.posthog.com) to understand how the application is used. PostHog is configured with the following privacy settings:
- No persistent identity profiles. PostHog never creates a profile tied to you across sessions.
- Session-scoped only. All PostHog state is stored in
sessionStorage, which is cleared when you close the tab. There are no analytics cookies. - No IP address. Your IP address is deleted from every event before it leaves your browser.
- Wallet addresses scrubbed from URLs. Any EVM address in page URLs, referrers, and pathnames is replaced with
[address]before being sent to PostHog. - Wallet dialogs excluded. The wallet connection dialog is excluded from autocapture.
- Text and attributes masked in autocapture. Text content and HTML attributes are not captured by autocapture events.
- Session replay input masking. Input fields are masked by default in session recordings. Other on-screen content (text, amounts, addresses) is visible in replays and is used solely for product improvement.
PostHog receives page views, page-leave events, clicks on UI elements (autocapture), session recordings (with input fields masked), and the custom events listed below. All events are anonymous.
| Event | Properties sent |
|---|---|
bridge_clicked | Bridge name |
wallet_connected | Wallet type (e.g. "MetaMask") |
wallet_disconnected | (none) |
stake_completed | Action type, CELO amount, validator group address |
lock_completed | Action type, CELO amount |
vote_completed | Proposal ID, vote type |
upvote_completed | Proposal ID |
delegate_completed | Action type, delegation percentage |
account_created | (none) |
nav_clicked | Navigation item label |
mode_toggled | Mode (CELO / stCELO) |
proposal_viewed | Proposal ID, stage |
proposal_filter_changed | Filter value |
vote_button_clicked | Proposal ID, vote type |
validator_group_viewed | Validator group address and name |
stake_button_clicked | Validator group address (optional) |
stake_menu_clicked | Action type, validator group address |
delegatee_viewed | Delegatee address and name |
delegate_button_clicked | Delegatee address (optional) |
register_delegatee_clicked | (none) |
external_link_clicked | URL, context |
Your own wallet address is never included in any analytics event. Validator group addresses and delegatee addresses that appear in some events are public on-chain addresses.
2.2 Internal analytics database
Every analytics event listed in §2.1 is also stored in our own PostgreSQL database. Each record contains a random session ID (a UUIDv4 scoped to your browser tab session), the event name, event properties, and a timestamp. No wallet address, IP address, or persistent cross-session identifier is stored.
2.3 Geo-restriction check
When you connect a wallet, your request is sent to our /police endpoint. This uses Vercel's geo-enrichment headers to determine your country and region (ISO 3166 codes). No IP address is stored — only the country/region is logged transiently. Access is blocked (HTTP 451) for visitors from North Korea, Iran, Cuba, Syria, and Russian-occupied territories of Ukraine (Crimea, Luhansk, Donetsk) as required by applicable sanctions law.
2.4 OFAC sanctions screening
When you connect a wallet, your wallet address is checked against the OFAC Specially Designated Nationals list. This check is performed entirely in your browser — your wallet address is never sent to any external server for this purpose. The sanctions list is downloaded from a public GitHub URL and cached in your browser's localStorage for 24 hours.
2.5 Celo name resolution (namespace.ninja)
To display human-readable names next to wallet addresses in the UI, displayed wallet addresses are sent to a GraphQL endpoint operated by Namespace (celo-indexer-reader.namespace.ninja). This is a read-only lookup. Resolved names are cached in your browser's localStorage (key: celonames_cache) with no expiry. Only addresses actively displayed in the UI are queried.
2.6 Staking auto-activation (Upstash)
When you stake CELO, a delayed activation job is scheduled via Upstash QStash. The following data is sent to Upstash: your wallet address, the validator group address, and the transaction hash. This data is used solely to trigger the required on-chain activateForAccount call approximately 24 hours after staking. Upstash is governed by the Upstash Privacy Policy.
2.7 stCELO Cloud Functions
For stCELO withdraw and claim operations, your wallet address is sent as beneficiary to a Celo-operated Cloud Function at us-central1-staked-celo-bot.cloudfunctions.net. This is used to trigger the relevant on-chain transaction on your behalf.
2.8 Wallet connection (WalletConnect / RainbowKit)
Wallet connectivity is handled by RainbowKit and WalletConnect. When connecting via WalletConnect, session data (wallet type, chain ID, connection session) is relayed through WalletConnect's servers. This is governed by the WalletConnect Privacy Policy.
2.9 Delegate registration
If you choose to register as a governance delegate, you submit your name, wallet address, image, website, Twitter handle, and bio. This data is submitted as a pull request to the public celo-org/governance GitHub repository and becomes publicly visible.
3. What we do not collect
- Your wallet address is never sent to PostHog, stored in our analytics database, or logged server-side.
- Private keys or seed phrases — the application never requests, handles, or transmits these.
- Cookies — no cookies are set by this application. PostHog is configured to use
sessionStorageinstead of cookies. - Cross-session tracking — session identifiers are stored only in
sessionStorageand are cleared when you close the tab.
4. Local storage used by this application
| Storage | Key | Contents | Cleared |
|---|---|---|---|
sessionStorage | analytics_session_id | Random UUIDv4 (anonymous session token) | On tab close |
sessionStorage | PostHog SDK state | Anonymous PostHog SDK data | On tab close |
sessionStorage | mode | Staking mode preference (CELO / stCELO) | On tab close |
localStorage | celonames_cache | Map of wallet address → Celo name | Manual clear only |
localStorage | OFAC list URL | Cached OFAC sanctions address list | 24-hour TTL |
localStorage | theme | UI theme preference (dark/light) | Manual clear only |
5. Third-party processors summary
| Processor | Data sent | Purpose | Region |
|---|---|---|---|
| PostHog | Anonymous usage events, page views | Product analytics | EU |
| WalletConnect | Wallet session metadata | Wallet connection relay | Global |
| Namespace (namespace.ninja) | Wallet addresses displayed in UI | Celo name resolution | Unknown |
| Upstash | Wallet address, tx hash | Staking auto-activation queue | Global |
| stCELO Cloud Functions | Wallet address | stCELO protocol operations | US (GCP) |
| GitHub (Octokit) | Name, address, bio (delegate registration only) | Governance delegate registry | Global |
6. Your rights
Depending on your jurisdiction you may have the right to access, correct, or delete data we hold about you. Because our analytics data is stored against a random per-session UUID (not linked to your identity), we are generally unable to locate records for a specific individual. For any privacy requests, contact us via the GitHub repository at github.com/celo-org/celo-mondo/issues.
7. Changes to this policy
We will update this policy when the data practices of the application change. The "Last updated" date at the top will reflect the most recent revision. Changes are traceable in the git history of the repository.