Privacy

Who is responsible

The NO DECAF project team is the data controller for information submitted through this site. For privacy questions or requests, email privacy@nodecafcoin.com.

What we collect

We collect the email address you submit and, if provided, your X username. If you choose Wallet Sign-In, we store the public Solana address you prove control of, the time the identity was created and the time of sign-in. We do not request payment information, transaction permissions or private keys.

Purposes and lawful bases

We use your email, with your consent, to send NO DECAF lore drops, project updates and the official verified mint address if it is published. We rely on legitimate interests to operate optional site identity, secure the waitlist and community tools, prevent abuse, maintain essential service records and understand aggregate product usage. You can withdraw consent at any time without affecting earlier lawful processing.

Wallet Sign-In

Wallet Sign-In asks your wallet to sign a readable, short-lived Sign In With Solana message. Signing proves control of a public address at that moment; it is not a transaction, costs no SOL and does not give this site permission to move funds. The challenge expires after five minutes and can be used only once. The raw nonce, signed message and signature are used for verification and are not retained after the request.

A public wallet address is a persistent identifier and activity associated with it may already be visible on a public blockchain. One wallet identity does not prove one physical person. Wallet providers operate independently and may process information under their own privacy terms.

Storage and providers

The NO DECAF Pre-launch waitlist is stored in Cloudflare D1. Your email address is also sent to Brevo, our email delivery and contact-list provider. Your optional X username remains in D1 and is not sent to Brevo. Cloudflare also provides privacy-focused Web Analytics and infrastructure analytics. Product events do not include your email or X username.

Resistance Missions and XP

If you submit mission evidence, we store the canonical public X post URL, its numeric post ID, the wallet identity linked to the submission, its status, timestamps, rules version and a safe review reason. Approved mission XP and later reversals are kept in an append-only ledger, together with an audit trail of moderation actions.

We use this information to operate and manually review missions, prevent duplicate or abusive submissions and preserve an accurate XP history. Approved moderators can access submission evidence and internal review records. Mission data is not automatically linked to your Brevo email, waitlist record or optional waitlist X username. X is a separate public service governed by its own terms and privacy practices.

Weekly Signal voting

Weekly Signal uses a first-party security cookie to remember whether this browser has already voted in the current community poll. The cookie contains a random identifier protected by a server signature. We store only a one-way round-specific hash with the selected option and submission time. We do not link votes to waitlist email addresses, X usernames or wallet addresses, and we do not store raw IP addresses with votes.

These cookies are used only to operate Weekly Signal voting and optional Wallet Sign-In sessions. They are not used for advertising, cross-site tracking or general personalization.

One vote per browser does not guarantee one vote per physical person because a visitor can clear cookies or use another browser or device.

International transfers

Cloudflare and Brevo may process information outside the United Kingdom or European Economic Area. Where required, transfers are protected by an applicable adequacy decision, approved contractual safeguards or another lawful transfer mechanism described in the provider's terms.

Retention

Waitlist records are reviewed at least every 12 months and deleted no later than 24 months after the last project email unless you renew consent or we must retain limited information for a legal reason. Unsubscribing stops marketing immediately; operational copies are scheduled for deletion within 30 days. A minimal suppression record may remain only to honour your opt-out. Wallet challenges are removed after they expire or are used. Authentication sessions expire after seven days and expired or revoked session records are removed within 30 days. Mission submissions, XP ledger entries and moderation audit records are retained while the mission programme operates and for up to 24 months after it closes, unless a longer period is needed to resolve abuse, a dispute or a legal obligation. A wallet identity remains while the feature operates or until a valid deletion request is completed, subject to limited security, audit or legal retention.

Your rights

Depending on where you live, you may ask for access to your information, correction, deletion, restriction, portability or an objection to certain processing. You may withdraw consent at any time and complain to the UK Information Commissioner's Office or your local EEA data-protection authority. To make a request, email privacy@nodecafcoin.com. We may need to verify control of the relevant email address or wallet before completing a request.

No sale of data

We do not sell your waitlist information. If this policy changes materially, the updated version will be posted here.

Legal review

This pre-launch notice is intended to describe current site behaviour clearly. It is not legal advice and should be reviewed by qualified counsel before broader public marketing in the UK or European Union.