png.cafe

Privacy Policy

Last updated: July 21, 2026

This Privacy Policy explains how Calco Labs LLC (“Calco Labs,” “we,” “us,” or “our”) handles information in connection with png.cafe, available at png.cafe and its related tools (collectively, the “Service”). png.cafe provides an NFT marketplace, community features, creator tools, and holders-only content for collections on the XRP Ledger. We aim to collect only what the Service needs to work.

1. Information We Collect

  • XRPL wallet address. When you connect, we receive the public wallet address you verify through Xaman (XUMM) or a WalletConnect-compatible wallet. We never receive or store private keys or seed phrases.
  • Session data. Sign-in produces a session credential (an HTTP-only cookie and/or a bearer token stored in your browser’s local storage) used to keep you signed in and authorize actions like listing, buying, and posting. Sessions expire and can be ended by disconnecting.
  • Profile information you choose to provide. Username, X (Twitter) handle, a profile picture chosen from your NFTs, and an uploaded banner image. Profiles are public. If you verify your X account, we receive your confirmed X handle from X’s OAuth flow — never your X password — and store it to power the verified checkmark and handle reservation.
  • Community content. Comments, links and media URLs you post, likes, follows, and related notification records. These are stored and displayed publicly with your profile or wallet.
  • Marketplace activity. Listings, offers, purchases, and sales are on-ledger transactions on the public XRP Ledger. We index this public data (including wallet addresses, prices, and timestamps) to power the marketplace, sales history, floors, statistics, holder pages, and rarity ranks.
  • Launchpad submissions. Collection details, artwork, and metadata you submit for launch. Files you pin become publicly accessible on IPFS and are effectively permanent.
  • Generator inputs. Trait configuration (layer names, trait names, weights, rules) is sent to our server to compute combinations; your trait images are processed in your browser and are not sent to us for generation.
  • Technical and log data. Our hosting providers automatically process basic technical information such as IP address, browser/device type, and request timestamps for security, reliability, rate limiting, and abuse prevention.

We do not use advertising trackers, and we do not collect names, email addresses, or payment card information through the Service.

2. How We Use Information

  • verify wallet control and NFT ownership, and authorize gated features;
  • operate the marketplace — create and settle listings, offers, and sales, and display accurate market data;
  • display public profiles, community content, and notifications;
  • run the launchpad, including review and IPFS pinning;
  • operate, maintain, secure, and improve the Service; and
  • prevent fraud and abuse, and comply with legal obligations.

3. How Information Is Shared (Service Providers)

We do not sell your personal information. We rely on third-party processors and data sources to operate the Service; information is shared with them only as needed:

  • Vercel — hosting and serving the application, including technical/log data.
  • Supabase — databases and file storage for market indexes, profiles, community content, cached NFT images, and gated files.
  • Xaman / XUMM (XRPL Labs) and WalletConnect wallets — wallet sign-in and transaction signing.
  • Public XRP Ledger nodes — on-ledger verification and transaction submission. The XRP Ledger is a public blockchain.
  • X (Twitter) — the OAuth flow used for account verification, subject to X’s own terms.
  • Bithomp and xrp.cafe — public market-data and image APIs we query to build floors, sales history, statistics, and artwork caches.
  • wsrv.nl — an image-resizing CDN your browser loads NFT thumbnails through; like any CDN it sees standard request data (such as your IP address).
  • GIPHY — GIF search in the comment composer.
  • Pinata / IPFS — pinning of launchpad artwork and metadata to the public IPFS network.

These providers process information under their own privacy terms. We may also disclose information if required by law or to protect our rights, users, or the security of the Service.

4. Public and Permanent Data

Wallet addresses, NFT ownership, and marketplace transactions are public on the XRP Ledger and outside anyone’s ability to edit or delete. Profiles and community content are public by design. Content pinned to IPFS is publicly retrievable and effectively permanent even if unpinned. Think before you link a username or X handle to a wallet — that association is visible to anyone.

5. Data Retention

Session credentials expire automatically and can be cleared by disconnecting. Profiles, community content, and market indexes are retained while the Service operates so pages remain coherent; you can request deletion of your profile and posted content (see Section 7). Technical and log data are retained by our providers only as long as reasonably necessary for security and operations. On-ledger and IPFS data are outside our control and cannot be deleted by us.

6. Security

We use reasonable technical measures to protect the Service, including signed session credentials, server-side authorization of gated actions, on-ledger re-verification of ownership, and rate limiting. All marketplace transactions are signed in your own wallet — we never hold your keys or assets. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your wallet, keys, and seed phrase.

7. Your Choices and Rights

You can use most browse-only features without connecting a wallet. You can end your session at any time by disconnecting. You can edit your profile, and you may request deletion of your profile and posted content by contacting us. Depending on where you live, you may have rights to access, correct, or delete personal information; our ability to act is limited to data we actually control — we cannot alter the public ledger or IPFS. To make a request, contact us using Section 10.

8. Children

The Service is intended for users who are at least 18 years old. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact us and we will take appropriate steps to delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. Your continued use of the Service after changes take effect constitutes your acceptance of the revised policy.

10. Contact

Questions about this Privacy Policy can be sent to [email protected] or asked in our Discord community at discord.gg/rJ7cFfdcWw.