privacy

Each bid transaction can publicly expose the payer wallet, treasury, SOL amount, token CA, canonical listing key, derived explorer URL, name, description, category, exact contribution, transaction signature, slot, and timestamp. The listing fields are carried in a signed public transaction memo.

The board freezes the metadata from the first accepted listing transaction, but every later memo remains public even when it is not displayed. Public blockchain data may remain available permanently and can be copied or indexed by anyone. SolanaBid cannot delete it from Solana.

The server issues a random, signed, HttpOnly first-party visitor cookie and records page-view, presence, and verified listing-link click events. Browser-supplied identifiers and page paths are not trusted as analytics identity. The signed identifier is pseudonymized again before server-only Supabase storage and is used only for counts and deduplication. Browsers do not read or write this database directly. A listing click counts at most once per visitor identifier, verified board listing, and UTC day.

Aggregate page-view, click, and per-listing click totals are retained until an operator deletes them. Pseudonymous visitor hashes and their first and most recent activity times are retained to calculate all-time and recent unique-visitor totals. Hourly per-visitor rows are kept for about 48 hours, daily per-visitor rows for about 30 days, and click-deduplication rows for the current and previous UTC day. Presence marks a visitor as online for 90 seconds; stale presence rows are pruned after about 31 days. Cleanup runs during later analytics events, so a quiet deployment can retain expired rows longer until another event or an operator cleanup.

Network addresses are HMAC-pseudonymized for one-minute or one-hour rate-limit windows. Expired rate-limit rows are pruned during later requests. Hosting, Supabase, and network providers may also process ordinary request logs under their own terms.

SolanaBid also uses DataFast's default script for longer-range traffic analytics. It uses cookies for visitor identification and may process ordinary page, referral, browser, device, and network information. Consent requirements depend on where the site and visitor are located. DataFast handles that information under its own privacy policy.

Connecting lets the browser request your public address and transaction approval through your wallet. SolanaBid does not ask for or store your seed phrase or private key. Disconnect in your wallet when you are done.

The interface requests listing favicons through Google's favicon service. Opening a listing, explorer, wallet, RPC endpoint, or other external service lets that provider receive normal network and browser information under its own privacy terms.

You can clear the sb_visitor site cookie so future events receive a new first-party visitor identifier. Existing pseudonymous rows and aggregate counters are not automatically deleted when the cookie is cleared. You can also block site storage or analytics requests, although some live counters may no longer work. Blocking or clearing DataFast storage and requests limits or resets that separate analytics stream. Wallet and public-chain records cannot be erased here.

Use the complaint box or the report page for a privacy concern. Do not include seed phrases, private keys, or other secrets in a report. A report stores the listing, reason, details, optional evidence link, reference, and submission time in server-only Supabase storage. The newest 10,000 reports are retained until older rows are displaced or an operator deletes them. Reports are private to authorized operators, but supporting links should contain only information that is already public.