Privacy policy

We collect an email address, a password hash, and a record of what you do on the service. We do not store raw IP addresses, we do not use third-party advertising or tracking cookies, and we do not sell anything to anyone.

Account. Your email address, a scrypt hash of your password (never the password itself), when you signed up and when you verified, your referral code, and the Solana payout address you choose to give us.

Activity. Credit purchases, tasks placed, and a ledger of every credit movement. This is the record of what you bought and what we delivered, so it is kept for as long as the account exists.

Analytics. Which pages are viewed, the referring website's hostname, any campaign tag in the link you arrived through, and a coarse device class (mobile, tablet, desktop). Visitors are identified by a first-party cookie.

Payments. Solana transactions are public by nature. We record the transaction signature and the paying address for orders that settle, because that is how a payment is matched to a purchase.

Raw IP addresses are not stored. Analytics identifies visitors by a cookie instead. Rate limiting does need to distinguish callers, so an IP is hashed with a secret and only the hash is written — enough to count requests, not enough to recover the address.

We do not use third-party analytics, advertising networks, or social media trackers. No data is shared with advertisers, because there are none.

We set two first-party cookies, both strictly functional:

• Session cookie — keeps you signed in. HTTP-only, so page scripts cannot read it. Expires after 30 days or when you log out.
• Visitor cookie — an opaque id used to count unique visitors rather than page loads. Expires after a year.

There are no advertising or cross-site cookies, which is why there is no cookie banner.

Neon hosts the database. Resend sends the verification email and therefore processes your email address. Vercel serves the site. Public price feeds are queried for the SOL rate, with no data about you attached.

Beyond these, nobody. We do not sell, rent, or share personal data, and there is no arrangement under which we would.

Account and transaction records are kept while the account exists, since they are the record of what you paid for. Analytics page views and events are operational data and are not needed indefinitely. Rate limit counters are deleted automatically once they expire.

You can ask for a copy of your data, ask for corrections, or ask us to delete your account. Deleting an account removes your personal data; the credit ledger entries tied to settled payments may be retained in an anonymised form, because they are the record of a transaction that actually happened.

Blocking cookies will stop the analytics cookie being set. Blocking the session cookie will stop you being able to sign in.

Passwords are hashed with scrypt and a per-user salt, so we cannot see them and could not tell you what yours is. Sessions are server-side and are revoked when you change your password. Connections use TLS throughout.

We never ask for a private key or seed phrase. Receiving a payment needs only your public address. Anyone asking you for a seed phrase, here or anywhere, is trying to steal from you.

Privacy questions can be sent to the address these emails come from. See also our terms of service.

This describes what the service actually does rather than restating a template. If this becomes a real commercial operation serving users in the EU or UK, have the GDPR obligations reviewed properly.