Privacy Policy

01. Introduction & Scope

This Privacy Policy is issued by XPAYR LLC, a New Mexico limited liability company (USA) (“XPAYR”, “we”, “our”), which operates ShitTag and is the data controller for the personal data described below. ShitTag is a project of XPAYR LLC and is not a separate legal entity. Contact: privacy@shittag.fun. This policy outlines what information is processed when you access shittag.fun, interact with our web applications, or connect your Solana wallet to our smart contracts.

Unlike legacy centralized exchanges and corporate platforms, ShitTag is designed from the ground up as a Web3-native protocol. We believe financial sovereignty starts with strict data minimization.

02. Information We Do NOT Collect

We strictly avoid collecting government identity or traditional banking data:

• No Identity Documents (Zero KYC): No passport, national ID, driver's license, or biometric proofs.
• No Physical Location or Phone Data: No residential addresses or SMS phone numbers.
• No Banking Credentials: No credit card numbers, bank routing codes, or fiat deposit accounts.
• No External Wallet Seed Phrases: We never have access to the seed phrases or private keys of your external browser/hardware wallets (Phantom, Solflare, Backpack).

03. Information Processed by Protocol & Optional Account Features

When you interact with the ShitTag interface or underlying Solana blockchain, the following technical and optional account data may be processed:

• Public Wallet Addresses: When you connect Phantom, Solflare, Backpack, or any Solana wallet, your public key (e.g., 7xKX...shit) is read to display balances, held domains, and bonding curve positions.
• Optional Web2/Hybrid Account Credentials: If you choose to register a username/email account or bind a waitlist reservation, we store your chosen username, email address (used strictly for transactional verification codes and security alerts via SMTP), cryptographically salted password hash, and optional TOTP Two-Factor Authentication (2FA) status.
• Wallet Sign-In Sessions: When you sign in with your wallet we store your public wallet address and a hash of the session token (the session cookie), with its expiry. We never receive or store private keys or seed phrases; the former custodial trading wallet is retired.
• Name Reservations (waitlist): for each reservation we store your wallet address, the reserved name, the referrer name you arrived with, your verified X handle (shown publicly only if you choose to show it; otherwise a placeholder derived from your wallet is shown), your X account's creation date and follower count as read from public X data at verification (used only for the airdrop eligibility check), the queue rank, reward tier and status, a risk score with its reasons, timestamps and the expiry date. Your public reservations are shown with your wallet shortened (first 4 and last 4 characters).
• Anti-Abuse Signals: with each reservation we store a keyed hash (HMAC-SHA256 with a server secret) of your IP address (IPv6 by /64) and of your browser user-agent string, never the IP itself. For the per-network limits we also record which wallets acted from the same hashed IP in the last 24 hours. These hashes and records are deleted after 90 days.
• Quests & Points: for each wallet we store completed quests, points, the daily check-in streak and timestamps. For the X quests we store your X username, X user id, the id of the post you submitted, the follow check result and a temporary verification code (deleted once used, valid for 24 hours). The public leaderboard shows the shortened wallet, your reserved name and your points.
• Airdrop Review: wallets may be flagged, reviewed or excluded for abuse; we keep the exclusion reason and the reviewing admin. We may export an eligibility snapshot (wallet, points and the inputs above, without IP hashes) to prepare a possible distribution. Admin actions and exports are recorded in an append-only audit log.
• On-Chain Transaction Records: All token launches, bonding curve swaps, domain registrations, Say Hi escrows and refunds broadcast to the Solana network are permanent, immutable, and publicly queryable worldwide.
• Technical Diagnostics & Rate-Limit Logs: IP addresses are held in memory for rate limiting. Our server and access logs (IP address, time, request path and status) are kept for up to 30 days for security and debugging and then deleted. Hashed IP and user-agent values (see “Anti-Abuse Signals”) are deleted after 90 days. Database backups contain the same records: on the server they are deleted when they age out (devnet: every 6 hours, kept 14 days; mainnet: one a day, the last 7 daily and 4 weekly copies, so up to about five weeks); on mainnet the weekly copy is also stored encrypted off-host, where the last 13 weekly copies (about three months) are kept and older ones are deleted, so data deleted from the database can remain in a backup for up to about three months.

04. Local Storage & Browser Preferences

We use browser LocalStorage and IndexedDB strictly for functional and user experience purposes:

• UI Settings: Dark mode color preferences, chart intervals, slippage presets, and audio toggle states.
• Session & Terminal State: Cached public wallet identifiers and terminal layout preferences.
• Recent Search Queries: Cached domain lookups to speed up responsive autocomplete without hitting server endpoints repeatedly.
• Embedded Wallet: if you create or import the in-browser embedded wallet, its private key is encrypted with your password and stored only in this browser's local storage. It is never sent to us, and we cannot recover it.

05. Third-Party Services & Infrastructure

The ShitTag frontend and backend interact with distributed infrastructure providers:

• Solana RPC Nodes (e.g., Helius): For reliable transaction relaying, signature verification, and WebSocket streaming.
• Domain NFT Metadata: domain NFTs use the Metaplex token-metadata standard; their metadata and images are served by our server at shittag.fun and referenced from the chain.
• Content Delivery Network (CDN) & Transactional SMTP: Reverse proxies for SSL termination/DDoS mitigation and transactional email delivery for optional account verification codes.
• X (Twitter) Lookups: to verify the X quests we send the X username you enter (and the post link you submit) to the public X data services fxtwitter.com and vxtwitter.com, and, for the follow check, to the third-party X data APIs RapidAPI (twitter-api45) and Sorsa when configured. No password or X login is ever requested.
• Telegram (Operations Notifications): our team receives a periodic summary of new reservations in a private Telegram channel: the reserved names, tiers, shortened wallet addresses, referrer names and review flags.

We encourage you to review the privacy notices of these infrastructure providers if you have specific technical concerns regarding network transport logs.

International transfers: XPAYR LLC is located in the United States, and our service providers, including the Solana RPC provider Helius and the X lookup services (fxtwitter.com, vxtwitter.com, RapidAPI and Sorsa), are located in the United States. If you use the Services from outside the United States (for example from the EEA or the United Kingdom), the data listed above is transferred to and processed in the United States.

06. Security Cookies & Zero Ad Tracking

ShitTag does NOT utilize advertising cookies, remarketing tags, or third-party behavioral profiling scripts (such as Google Ads, Meta Pixel, or TikTok tracking).

We use strictly necessary HttpOnly; SameSite=Strict; Secure session cookies (such as shittag_wallet_session) solely to authenticate signed wallet sessions and protect against Cross-Site Request Forgery (CSRF) and XSS token theft.

07. Rights Under Data Protection Regulations (GDPR & CCPA)

We process the limited data listed above (wallet addresses, X usernames, optional e-mail accounts and hashed network signals). Residents of the European Economic Area (EEA), United Kingdom, and California hold statutory rights regarding data processing, including access, correction and deletion:

• Right to Erase / Forget: You can clear your browser storage, cookies, and local wallet keys at any time through your browser settings. To delete the data we store for your wallet (reservations, quests, X username, account), e-mail privacy@shittag.fun from the account e-mail or with a message signed by the wallet; deleting it also removes the wallet from the points campaign.
• Blockchain Immutability Caveat: Please be advised that due to the immutable and decentralized consensus architecture of the Solana blockchain, data published directly to the public blockchain cannot be erased, altered, or restricted by ShitTag or any centralized controller.

08. Children's Privacy

ShitTag is strictly intended for individuals aged 18 and older. We do not knowingly solicit or collect data from minors. If we discover that a user under 18 has interacted with the platform, appropriate interface restrictions will be deployed.

09. Changes to this Privacy Policy

We may update this policy periodically to reflect evolving regulatory frameworks or architectural enhancements in our decentralized contracts. Updated versions will be published directly to this page with an updated timestamp.

10. Contact & Data Inquiries

If you have questions regarding our privacy architecture, data policies, or on-chain indexing practices, or want to exercise your rights, please reach out to the data controller, XPAYR LLC (New Mexico, USA), operator of ShitTag:
Email: privacy@shittag.fun