Privacy policy

• There is no Bluu account to open, no email sign-up, no analytics and no advertising tracking. If you sign in with GitHub to collect creator fees, our sign-in provider, Privy, creates a wallet for you that only you control.
• What we store is what you choose to publish: a username and picture for your wallet, and your token's details. Those are public by design.
• Blockchains are public. Your wallet address and everything it does on chain can be seen by anyone, with or without Bluu, and nobody can erase it.

Bluupad runs Bluu at bluupad.com and is the controller of the personal data described here. To ask about it or use your rights, send a direct message to @Bluupad on X.

• Developer profiles. When you set a username or picture, we store your wallet address, the username, the picture and when you changed them, and show them publicly beside your address. Basis: you asked us to publish them.
• Sign-in codes. To check that a profile change really comes from your wallet, we issue a one-time code tied to your address. It expires after 10 minutes and is deleted once used. Basis: our legitimate interest in stopping anyone else from changing your profile.
• Token details and links. When you launch a token or update its links, we store its picture, description, website, X and Telegram links, and show them publicly on its page. Basis: you asked us to publish them.
• GitHub sign-in. If you sign in with GitHub to claim creator fees, we keep your GitHub account id, username and an access token, encrypted, in a cookie on your device for one hour. Privy runs the sign-in and hands the token to the page once. Our server and the attestors send the token only to GitHub, to ask which account it belongs to. We do not store it on our servers. Basis: you asked to claim fees held for that account.
• Bluu wallet. If you sign in with GitHub, Privy creates an EVM and a Solana wallet linked to that sign-in and keeps its key so that only you can use it; we never see the key. Basis: you asked to collect fees without a wallet of your own.
• Free claims. When we send a claim for you and pay its network fee, we count claims per GitHub account and per IP address to stop abuse. The counts are kept in memory only, for a day at most, and are lost when the server restarts. Basis: our legitimate interest in stopping one person draining the gas we pay.
• Server logs. Like any website, our hosting provider records requests, including your IP address, browser type and the pages asked for, to run, secure and fix the site. Logs are kept for a short period and then deleted. Basis: our legitimate interest in keeping the site working and safe.

We do not ask for your name, email address, phone number or payment details, and we do not ask for your wallet keys or recovery phrase, ever. The providers below (Privy, if you sign in through it, and MoonPay, if you cash out) may collect more under their own privacy policies.

The site reads public blockchains to show tokens, trades, holders and developer scores. Your wallet address, its balances and its transactions are public on those chains. Bluu works out developer scores, rug confirmations and warnings from that public data and publishes them. We cannot change or remove anything recorded on a blockchain.

• Cookies: only the GitHub sign-in cookie above, a short-lived one that protects that sign-in from forgery, the session Privy keeps if you sign in through it, and any security cookies Cloudflare sets to stop abuse. All are strictly necessary for something you asked to do or for keeping the site safe, so we do not ask for consent, and none is used for tracking.
• Browser storage: your starred tokens, the developers you follow, your slippage setting, the wallet you last connected and, if you signed in through Privy, your Bluu wallet's two public addresses are saved in your own browser and never sent to us. Clearing your browser's site data removes them.

• Our hosting provider (Render) runs the site and its database, and so processes everything above on our behalf.
• Cloudflare, which every request to the site passes through, sees your IP address and approximate location, and blocks access from restricted places.
• Blockchain RPC providers. Your browser and our servers read the chains through RPC providers, which see the requests, including your IP address when your browser makes them.
• GitHub, if you sign in with it, under GitHub's own privacy policy.
• Privy, if you sign in through it, under Privy's own privacy policy.
• If you cash out: Circle (from Arc), or LI.FI and the bridge it picks (from Robinhood Chain), see your addresses and amounts. MoonPay receives your Solana address and the amount, checks your identity and pays you, under its own privacy policy.
• Your wallet and the blockchains you send transactions to, under their own terms.
• We do not sell personal data, and we do not share it for advertising.
• We may disclose data when the law requires it.

Some of these providers, including our hosting provider, may process data outside the UK and the European Economic Area, such as in the United States. Where they do, we rely on the safeguards the law provides, such as the UK International Data Transfer Addendum and the European Commission's standard contractual clauses.

• Profiles and token details: until you change or remove them, or until we take them down.
• Sign-in codes: 10 minutes at most.
• The GitHub sign-in cookie: one hour.
• Free-claim counts: in memory, a day at most.
• Your Bluu wallet: kept by Privy until you delete it.
• Server logs: a short period set by our hosting provider, then deleted.

Under the UK General Data Protection Regulation, and the EU one if you are in the EU, you can ask to access, correct or delete your personal data, to restrict or object to how we use it, and to receive it in a portable form. You can clear your username and picture yourself, with Edit profile on your developer page; for anything else, send a direct message to @Bluupad on X. We will need you to prove the wallet is yours, usually by signing a message. We cannot delete anything recorded on a blockchain.

You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or, if you are in the EU, to the data protection authority in your country.

Bluu is not offered in Iran, North Korea, Syria, Cuba, Russia, Belarus, Myanmar (Burma), South Sudan and the Crimea, Donetsk and Luhansk regions of Ukraine, or in Bangladesh, Nepal and Turkey, and we do not knowingly collect personal data from people there. To enforce this Cloudflare and we use your IP address to work out roughly where you are connecting from and block access; we use it only for that check and for the server logs described above, and do not build a location profile of you. If we learn we hold data from someone in a restricted place, we will delete it, except anything recorded on a blockchain, which nobody can delete.

Bluu is not for anyone under 18, and we do not knowingly collect data about children.

We will update this policy when what we store or share changes. The date at the top shows the current version.