TECHNICAL NOTICE
Privacy
This notice describes how the current Hooded Phantoms application handles wallet and technical data.
Wallet sign-in and public profiles
Wallet addresses are read after a user chooses to connect. A profile is created only after the user proves control of that wallet with a one-time signature. The profile stores the public wallet address, profile name, avatar choice, creation time, update time, and the last successful sign-in time. The starting name is the wallet address and one of four Hooded Phantoms avatars is assigned automatically. Profile names, avatars, and wallet addresses shown on the leaderboard are public.
Profile images
A user may choose a standard project avatar, a Hooded Phantom currently held by the signed-in wallet, or upload a custom PNG, JPEG, or WebP image up to 2 MB. Custom profile images are stored in a public Supabase storage bucket so browsers can display them. Do not upload private, confidential, or unlawful material. Owned Phantom avatars are checked against current on-chain ownership when selected.
Secure session
After sign-in, the server stores a signed, HTTP-only session cookie containing the wallet address and expiry. The session lasts up to seven days and is cleared when the user disconnects. The database does not store the wallet signature, private key, or seed phrase.
OG holder access
The read-only OG address checker compares a pasted public address with the fixed public snapshot and does not require a wallet connection, create a session, or save the submitted address in the private registry. If an eligible holder continues with OG Holder Access, the server verifies a gasless signature from the original AGW or EVM snapshot wallet and a separate sign-in from the receiving Robinhood wallet. After the user confirms the pair, the private Supabase registry stores both public wallet addresses, the verified snapshot holding count, the capped free-mint allocation, verification time, link status, and the confirmed activation transaction hash when one exists. This prevents duplicate links and lets the verified pair return after a refresh. Rejected connections and unconfirmed wallet pairs are not saved. The registry does not store wallet signatures, nonces, private keys, or seed phrases, and it does not create mint rights. The mint contract remains the authority for eligibility, allocation, proof validity, and claimed amount.
GTD applications
A GTD application stores the submitted public wallet address, X post URL, follow confirmation, review status, and timestamps in the private Supabase registry. A signed-in wallet can read only the application linked to that same wallet. The public website does not expose the applicant list. An approved database status is used to prepare the final GTD allowlist, but the deployed mint contract remains the authority during minting.
Wallet connection storage
The wallet connection provider may remember the selected connection in browser storage so it can reconnect after a refresh. Disconnecting through the wallet menu clears the application connection and its secure sign-in session. A remembered connection never gives the website access to private keys.
Public blockchain data
Wallet addresses, NFT ownership, contract calls, and transactions are public blockchain data. They may remain publicly available independently of this website.
Merge transactions
The browser reads the selected parent token IDs and fixed $PHTM burn amount directly from the public contracts. No merge request, price quote, or signing key is sent to an application server.
Analytics and infrastructure
Vercel Analytics measures visits and page views so the team can understand which parts of the site are used. It is not used to build advertising profiles. Wallet providers, WalletConnect, RPC providers, Supabase, hosting infrastructure, Blockscout, Robinhood API endpoints, and the ETH price source used for launch configuration and current USD estimates may process network metadata such as IP address, request time, browser information, and requested resources under their own policies.
No secrets requested
The site will never ask for a seed phrase or private key. Transaction approval occurs inside the wallet selected by the user.
Changes
This notice will be updated if email accounts, persistent private portfolio history, or additional infrastructure providers are introduced. The version published on this website is the version that applies to use of the current application.