Legal
Privacy Policy
Last updated Oct 20, 2026
Summary
This policy covers onchainbaskt.com, the Genesis campaign site at genesis.onchainbaskt.com, and the BASKT app, which is the interface to the protocol. The BASKT project, reachable at contact@onchainbaskt.com, is responsible for this processing. We will name the legal entity once it is formed.
onchainbaskt.com has no accounts, no cookies, no analytics and no third-party scripts. It makes one request to the Genesis campaign site to find out whether the campaign is open, which tells that site your IP address the same way visiting it would. No cookie is set and nothing is stored.
The Genesis campaign site does have participants: to take part you connect a wallet and sign a message with it to prove you control it, which costs no gas and sends no transaction, and you link your X account. You may also link a Telegram account. We store that pair, the Telegram link if you make one, your invites and your submissions.
The BASKT app can be used with only a wallet, and using the protocol through it stores nothing about you with us. Two optional things do: a public profile, and a message attached to a tip. For either one you sign a message with your wallet to prove you control it, which costs no gas and sends no transaction, and we store what you enter.
What is processed, and by whom
| What | Who processes it | Why |
|---|---|---|
| IP address and technical request logs | Cloudflare, which hosts the Site | To deliver and protect the Site |
| Founding Curator applications (alias, social handles, links, your answers) | Google, through Google Forms; stored in a Google Sheet controlled by the BASKT team | To review your application and contact you |
| Emails sent to contact@onchainbaskt.com | Cloudflare Email Routing, which forwards them to the BASKT team's Gmail inbox | To answer you |
| Genesis: your wallet address and the one-time sign-in challenge we ask it to sign, your X account identifier, handle, account creation date and public follower count, your Telegram account identifier if you link it, the invite link you used, your quest submissions, your points, the country your registration came from, the time you accepted the campaign terms, and a participation status with an internal note explaining it | Supabase, which stores the campaign database; Cloudflare, which runs the campaign site. X and Telegram process your sign-in on their own side under their own policies | To run the Genesis campaign, credit quests and invites, and prevent fraud |
| Genesis: IP address and technical logs in transit, and the country derived from your connection | Cloudflare, which runs the campaign site. The country is then stored with your participant record in Supabase | To deliver the site, apply eligibility rules and detect abuse. We do not store your IP address in the campaign database |
| Genesis: the Cloudflare Turnstile anti-bot check, which loads a script in your browser and receives your IP address | Cloudflare, under its own policy | To confirm a registration comes from a person |
| App: your wallet address and the one-time sign-in challenge we ask it to sign; the profile you choose to fill in (display name, bio and profile image); and, if you connect it, your X account identifier and handle and the time you connected it. If the wallet already linked an X account in the Genesis campaign, that link is carried over to its app profile the first time it signs in | Supabase, which stores the app database in the same project as the campaign database; Pinata, which publishes the profile image on IPFS, a public network. X processes your sign-in on its own side under its own policy | To show your profile next to the baskets you launch. Everything in a profile is public. Before a profile image is uploaded, your browser removes any metadata it carries, such as where a photo was taken: a still image is re-encoded, and an animated one keeps its frames and loses only its metadata. An image that can't be cleaned this way is not uploaded |
| App: profile images. Your browser loads them from an IPFS gateway, Pinata's, or ipfs.io when Pinata does not answer, which receives your IP address the same way visiting it would | Pinata and ipfs.io, each under its own policy | To show curators' profile images |
| App: a message you attach to a tip: its text, the wallet addresses of the sender and the recipient, the transaction hash, the amount and the time. And, for a recipient, the list of wallets they chose to stop receiving messages from | Supabase, which stores the app database | To deliver the message to the wallet it was sent to, which is the only one shown it, and to let either side delete it. A tip sent without a message stores nothing |
| App: IP address and technical request logs | Vercel, which hosts the app, and our own server in the EU, which answers the app's reads of baskets, portfolios and curators. The app passes your IP address to that server with each read. On both, your IP address is used in memory, and not stored, to limit how often someone can sign in, upload images and read the catalog. The exception is our server's error log: when that server cannot answer a read, the error it records can include your IP address and what was read, which for a portfolio is a wallet address, and it stays there until the server deletes its old logs | To deliver and protect the app |
| App: when the app's security policy blocks, or would block, something in your browser, your browser reports the kind of rule and the website involved. We keep only a count for each rule and website, with the first and last time it was reported, not the page you were on, your wallet or your IP address | Supabase, which stores the app database | To learn which websites the app needs before its security policy starts blocking |
| App: the requests your browser makes to read the blockchain, which include the wallet addresses being read and your IP address | Alchemy, the node provider the app uses to reach Robinhood Chain, and the chain's public endpoint when Alchemy does not answer, each under its own policy | To show balances, baskets and transactions |
| Genesis and the app: the data your wallet app exchanges to establish a connection, including your wallet address | WalletConnect, operated by Reown, which relays the connection under its own policy | To let you connect a wallet that is not a browser extension |
| App: if you connect Coinbase Wallet, the data it exchanges to connect, including your wallet address | Coinbase, under its own policy | To let you connect that wallet |
| Messages on X and Telegram | X and Telegram, under their own policies | To talk with the community |
The legal basis is your consent when you send us something, and our legitimate interest in running and protecting the Site and the app. Several of these providers are based in the United States, so some of this data may be processed outside the European Union, under each provider's own terms and safeguards.
Cookies
onchainbaskt.com sets no cookies at all.
The Genesis campaign site sets three. All of them are strictly necessary, and none is used for advertising or analytics.
| Cookie | What it is for | How long it lasts |
|---|---|---|
bskt_session | Keeps you signed in after you sign the wallet message. HttpOnly, Secure, SameSite=Lax. It holds your wallet address and a signature we can verify, nothing else | 30 days |
x_state and x_verifier | Carry the one-time state and the PKCE verifier across the redirect to X and back, so the sign-in cannot be replayed by anyone else | 15 minutes |
Signing out clears the session cookie. Clearing it in your browser signs you out and does not delete your campaign record.
The BASKT app sets none until you sign in with your wallet. After that it sets the following. All of them are strictly necessary, and none is used for advertising or analytics.
| Cookie | What it is for | How long it lasts |
|---|---|---|
__Host-baskt_app | Keeps you signed in after you sign the wallet message. HttpOnly, Secure, SameSite=Lax. It holds your wallet address and a signature we can verify, nothing else | 7 days |
__Host-x_state, __Host-x_verifier and __Host-x_wallet | Set only while you connect an X account. They carry the one-time state, the PKCE verifier and the wallet that started the flow across the redirect to X and back, so the sign-in cannot be replayed or attached to another wallet | 15 minutes |
The app also keeps a few things in your browser's local storage, which stay on your device: whether you muted the interface sounds, the state of your wallet connection, and the text of a message you attached to a tip, from the moment you send the tip until the message has been delivered. After seven days the app stops trying and deletes it the next time you open a curator's page in the app.
Blockchain data
Transactions on Robinhood Chain are public by nature. Wallet addresses, balances and transactions can be seen by anyone and cannot be deleted by us or by anyone else. A tip is one of those transactions. A message attached to a tip is not: it is never written to the blockchain.
How long we keep it
Founding Curator applications are kept up to 12 months after the public launch of the protocol, then deleted. Genesis campaign records are kept while the campaign runs and for up to 12 months after it closes, so that results can be reviewed and disputes answered, then deleted or anonymised. Emails are kept as long as the conversation needs them.
An app profile is kept until you clear it or ask us to delete it. A profile image you remove is unpinned from our IPFS storage, unless another profile uses the same image or our storage provider does not answer at that moment; then it can stay pinned, and you can ask us to remove it. IPFS is a public network and copies held by others are outside our control. A tip message is kept until you or its recipient deletes it. Deleting it erases the text; we keep the transaction hash, the two wallet addresses, the amount and the block, which are already public on the blockchain, and the times it was written and deleted, so that the same tip cannot carry a second message. The list of wallets a recipient stopped receiving messages from is kept until they remove a wallet from it. Security-policy counts hold no personal data and are kept until we delete them. Sign-in challenges are deleted after they expire, at the next successful sign-in to the app. Daily database backups can hold what was deleted, including the text of a message, for up to 7 days.
Your rights
You can ask us to access, correct or delete the information you sent us, including your Genesis participation, your app profile and your tip messages, by writing to contact@onchainbaskt.com. Deleting your Genesis record removes you from the campaign. We do not sell your information and we do not use it for advertising.
Changes
If we add analytics in the future, it will be cookieless and this page will say so before it is turned on.
© 2026 BASKT · onchainbaskt.com