Privacy Policy

1. Information We Collect

We collect the following limited information:

• XRPL wallet address. When you sign in, we receive the public XRPL wallet address you verify through the Xaman (XUMM) sign-in flow. We do not receive or store your private keys or seed phrase.
• Session data. After successful sign-in, we set a signed, HTTP-only session cookie (a JSON Web Token containing your wallet address) that expires after 24 hours. It is used only to keep you signed in and to gate access to holders-only content.
• On-ledger NFT holdings. To verify ownership, we query public XRPL data for the Blocky Apes NFTs held by your wallet at the time of each request. This information is already public on the ledger and is used in real time; we do not maintain it as a stored profile.
• Generator inputs. When you use the NFT Generator, your browser sends trait configuration (layer names, trait names, weights, and rules) to our server to compute combinations. Your actual trait images are processed in your browser and are not sent to our servers for generation.
• Technical and log data. Like most websites, our hosting provider automatically processes basic technical information such as IP address, browser/device type, and request timestamps for security, reliability, and abuse prevention.

The Skin Tester runs entirely in your browser. Skin PNG files you preview there are never uploaded to us. We do not use advertising trackers, and we do not collect names, email addresses, or payment information through the Service.

2. How We Use Information

We use the limited information above to:

• verify control of your wallet and your ownership of Blocky Apes NFTs;
• grant access to and deliver the files and holders-only features you are entitled to;
• operate, maintain, secure, and improve the Service; and
• prevent fraud and abuse, and comply with legal obligations.

3. How Information Is Shared (Service Providers)

We do not sell your personal information. We rely on the following third-party processors to operate the Service, and information is shared with them only as needed to provide it:

• Vercel — hosting and serving the application, including automatic processing of technical/log data.
• Xaman / XUMM (XRPL Labs) — the wallet sign-in flow used to verify control of your XRPL wallet.
• Public XRP Ledger nodes — queried to verify the NFTs your wallet holds. The XRP Ledger is a public blockchain.
• Supabase — storage for the digital asset files served through the Service.

These providers process information under their own privacy terms. We may also disclose information if required by law or to protect our rights, users, or the security of the Service.

4. Data Retention

Session cookies expire automatically after 24 hours, and you can end your session at any time by disconnecting. Wallet addresses and on-ledger holdings are used transiently to authorize each request and are not retained as a stored user profile. Technical and log data are retained by our hosting provider only for as long as reasonably necessary for security and operational purposes.

5. Security

We use reasonable technical measures to protect the Service, including signed HTTP-only session cookies, server-side gating of holders-only content and files, and on-ledger re-verification of ownership at request time. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for safeguarding your wallet, keys, and seed phrase.

6. Your Choices and Rights

You can choose not to connect a wallet, in which case holders-only content will be unavailable. You can end your session at any time by disconnecting, which clears your session cookie. Depending on where you live, you may have rights to access, correct, or delete personal information; because we hold very little personal data and do not maintain user profiles, our ability to act on a request may be limited to the data we actually retain. To make a request, contact us at the address below.

7. Children

The Service is intended for users who are at least 18 years old. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact us and we will take appropriate steps to delete it.

8. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. Your continued use of the Service after changes take effect constitutes your acceptance of the revised policy.

9. Contact

Questions about this Privacy Policy can be sent to [email protected].