BASKETPRIVACY · UPDATED 19 SEPTEMBER 2026
Privacy, plainly.
BASKET runs on Solana mainnet. Privacy contact: [email protected]. See Legal for service terms.
Accounts and public profiles
Privy handles the default email or Google sign-in and provisions the embedded Solana wallet. Privy processes the identifiers, authentication data, device and connection information needed to provide that service under its own privacy terms. The legacy BASKET Google sign-in remains available for existing accounts, and external-wallet sign-in verifies a signed message. We store account identifiers and profile data to provide the account you request. Your username, display name, avatar, bio, social link and linked public wallet address are public. Email, Google and Privy account identifiers are excluded from public APIs. BASKET never receives a Privy embedded-wallet private key and never asks for seed phrases or private keys.
Essential storage
HttpOnly BASKET login cookies expire after 30 days. Privy maintains essential authentication and embedded-wallet session data in the browser. The temporary legacy OAuth cookie expires after five minutes. Browser storage also saves your chosen wallet provider and pending transaction receipts so you can recover transaction status safely. These functions support authentication, security and requested wallet actions. Cookie preferences are retained for up to 180 days.
Optional analytics
Analytics is disabled by default. If you allow it, a random session identifier measures active browser sessions and aggregate daily page views. Active presence records expire after inactivity; they are not a count of verified people. No IP address is stored in the analytics database. Do Not Track and Global Privacy Control also disable this telemetry. Rejecting analytics does not prevent use of BASKET. Use Cookie settings in the footer to withdraw consent at any time.
Hosting, network information and public data
Hetzner hosts the website, API, SQLite database and IPFS storage. Cloudflare provides DNS, proxying and network protection. Privy provides default authentication and embedded-wallet infrastructure; Google handles Google authentication through Privy and the optional legacy sign-in. Solana RPC providers handle public blockchain reads, simulations and transaction submission. These providers receive connection information needed to serve requests; requests may be processed across countries under their applicable terms. Fonts are hosted locally. Security controls use connection information for rate limits and abuse prevention.
Wallet addresses, transactions and token metadata are public. Uploaded token files are pinned without automatic age-based deletion. Blockchain records and third-party IPFS copies cannot reliably be erased by BASKET. Avoid putting personal information into permanent token metadata.
Retention and your rights
Profiles are retained while the account exists. BASKET login sessions and temporary challenges expire automatically; Privy controls retention for its authentication and wallet records. Daily BASKET backups currently have a 14-day retention period. Security and transaction records may need longer retention where justified or legally required. You may contact the brand email to request access, correction, deletion or restriction of BASKET account data, object to processing, or exercise other applicable rights. Privy requests may also need to be made through Privy. We may need to verify control of the account. Public blockchain records and independently retained copies are outside our control. Where applicable, you may complain to your data protection authority.
We rely on providing the requested service for account functions, consent for optional analytics, and legitimate security interests or legal obligations where applicable.