TECHNICAL NOTICE
Privacy
This notice describes how the current Hooded Phantoms application handles wallet and technical data.
Wallet sign-in and public profiles
Wallet addresses are read after a user chooses to connect. A profile is created only after the user proves control of that wallet with a one-time signature. The profile stores the public wallet address, profile name, avatar choice, creation time, update time, and the last successful sign-in time. The starting name is the wallet address and one of four Hooded Phantoms avatars is assigned automatically. Profile names, avatars, and wallet addresses shown on the leaderboard are public.
Profile images
A user may choose a standard project avatar, a Hooded Phantom currently held by the signed-in wallet, or upload a custom PNG, JPEG, or WebP image up to 2 MB. Custom profile images are stored in a public Supabase storage bucket so browsers can display them. Do not upload private, confidential, or unlawful material. Owned Phantom avatars are checked against current on-chain ownership when selected.
Secure session
After sign-in, the server stores a signed, HTTP-only session cookie containing the wallet address and expiry. The session lasts up to seven days and is cleared when the user disconnects. The database does not store the wallet signature, private key, or seed phrase.
Retired holder and GTD mint access
The sold-out Genesis mint used public Merkle commitments tied to public wallet addresses. Its website access and verification endpoints have been retired and no longer accept requests. The fixed snapshot, GTD roots, and resulting blockchain transactions remain part of the public on-chain record.
Historical GTD applications
Earlier GTD application records may contain the submitted public wallet address, X post URL, follow confirmation, review status, and timestamps in the private Supabase registry. The September relaunch uses the separately supplied final GTD list; an old application record by itself does not create on-chain access.
Discord role linking
If a user chooses to connect Discord, Discord provides the account ID, current display name, and avatar reference. The private Supabase registry stores those values with the signed wallet address, the last successfully synchronized OG and PHANTOM role state, current Phantom balance, timestamps, and any synchronization error. The OAuth access token is used only during the callback and is not stored. The Discord bot token remains server-only. OG eligibility is recalculated from the verified AGW-to-EVM link registry, while PHANTOM eligibility is recalculated from current NFT ownership. Separately, the Member reaction service receives a Discord user ID when someone presses ✅ on the configured start-here message and uses it to assign the Member role. It does not create a separate Member database record; operational hosting logs can contain the Discord user ID and assignment outcome.
Wallet connection storage
The wallet connection provider may remember the selected connection in browser storage so it can reconnect after a refresh. Disconnecting through the wallet menu clears the application connection and its secure sign-in session. A remembered connection never gives the website access to private keys.
Public blockchain data
Wallet addresses, NFT ownership, contract calls, and transactions are public blockchain data. They may remain publicly available independently of this website.
Merge transactions
The browser reads the selected parent token IDs and fixed $PHTM burn amount directly from the public contracts. No merge request, price quote, or signing key is sent to an application server.
Analytics and infrastructure
Vercel Analytics measures visits and page views so the team can understand which parts of the site are used. It is not used to build advertising profiles. Wallet providers, WalletConnect, RPC providers, Supabase, hosting infrastructure, Blockscout, Robinhood API endpoints, and the ETH price source used for launch configuration and current USD estimates may process network metadata such as IP address, request time, browser information, and requested resources under their own policies.
No secrets requested
The site will never ask for a seed phrase or private key. Transaction approval occurs inside the wallet selected by the user.
Changes
This notice will be updated if email accounts, persistent private portfolio history, or additional infrastructure providers are introduced. The version published on this website is the version that applies to use of the current application.