1. Who is responsible
The data controller is Gotcha Inc. ("Gotcha", "we"). For any privacy question or request, contact us by a direct message to @gotchadotmeme on X.
2. What we process and why
| Data | Why | Legal basis |
|---|---|---|
| Your public wallet address and on-chain activity (trades, launches, balances) | To run the Service: compute holder credit, pay creators and referrers, show leaderboards and the Proof of fees page | Performance of our Terms |
| Your @username and who invited you | To show your public profile and pay invite rewards | Performance of our Terms |
| Signed messages (profile, claims, invites) | To prove a request really comes from your wallet | Performance of our Terms |
| Card and pack claims, credit balances | To deliver cards and keep accounts correct | Performance of our Terms |
| Technical data: IP address, browser type, request logs | Security, preventing abuse and fixing bugs | Legitimate interest |
| Aggregated visit statistics (no cookies, no tracking across sites) | To know which pages are used | Legitimate interest |
We do not sell your data, do not use it for advertising and do not build profiles about you beyond your public Gotcha profile.
3. Public by nature
Wallet addresses and transactions on Solana are public and permanent. Anyone can see them with a block explorer, independently of Gotcha. Your @username, the coins you hold or launched, and leaderboard results are shown publicly on Gotcha. We cannot erase data recorded on the blockchain.
4. Cookies and browser storage
Gotcha uses no advertising or tracking cookies, so no cookie banner is needed. Your browser stores a few strictly necessary items locally: your light or dark theme, the wallet you connected, and the invite link you arrived with. The wallet login window (provided by Privy) may store what it needs to keep you connected. You can clear all of this at any time in your browser settings.
5. Who receives data
We use service providers that process data on our behalf, only to run the Service:
- Cloudflare (website hosting and visit statistics)
- Render (API hosting)
- Supabase (database)
- Privy (wallet login window)
- Helius and other Solana RPC providers (reading and sending blockchain transactions)
- Collector Crypt (card purchases and delivery to your wallet)
- Google Fonts (fonts loaded by your browser)
Some of these providers are located outside the European Union, mainly in the United States. Transfers rely on the safeguards they offer, such as the EU-US Data Privacy Framework or standard contractual clauses.
6. How long we keep it
Profile, credit, claim and payout records are kept as long as the Service runs and for as long as needed to keep accounts and our legal obligations correct. Technical logs are kept for a short time, usually a few weeks, by our hosting providers.
7. Your rights
Under the GDPR you can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. We can delete or anonymise your profile (username and invite link) on request, but not what is already on the blockchain, and we may keep records we need for accounting or to prevent fraud. To exercise your rights, contact us by a direct message to @gotchadotmeme on X. You can also complain to your data protection authority (in France, the CNIL: cnil.fr).
8. Children
The Service is not for people under 18. We do not knowingly process data about children.
9. Changes
We may update this notice. The date at the top shows the latest version, and important changes are announced on the Service.