Summary
- We store public X profile data (numeric id, handle, name, avatar, follower count) of accounts that someone locked a bag for, even if that person never used HeldFor.
- We store wallet addresses and transactions, which are public on the Solana blockchain anyway.
- If you log in with X, we read your numeric X id and handle once, and keep a login cookie for 4 hours. We never keep your X password or access token.
- We don’t sell data, don’t run ads, and don’t use tracking cookies.
- You can object at any time: opting out blocks new bags for you, hides you from every public page and stops our bot from posting about you.
- Data written to the blockchain can’t be deleted by anyone, including us.
1. Controller
The controller under the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Latvian Personal Data Processing Law (Fizisko personu datu apstrādes likums) is .
2. Whose data we process
- Recipients: owners of X accounts that a bag was locked for. Most of them never visit HeldFor.
- Deployers and lockers: people who launch a coin or lock tokens, identified by their wallet address.
- Visitors: anyone browsing the site.
- Security researchers who report bugs and receive a reward.
3. Data we process
| Data | Whose / source | Purpose |
|---|---|---|
| X numeric user id, handle, display name, avatar URL, follower count, verified and suspended flags | Recipients. Read from the X API when someone types the handle on /launch or /lock (lookup), and when the account logs in | Identify which account a bag belongs to (by id, so handle changes don’t matter); refuse non-existent, suspended or opted-out accounts; show public profile pages, coin pages, leaderboards and share images |
| Bag records: coin, amount, value, status, vesting, destination wallet, related transactions | Recipients, deployers, lockers. The Solana blockchain (public) | Show bags and activity; let the recipient claim |
| Account flags: opted out (date), “allow mentions”, claimed before | Recipients, set by their own actions | Honour opt-out everywhere; only @mention people who allowed it |
| Wallet addresses, transaction signatures, token balances | Deployers, lockers, recipients. Your wallet when you connect; the blockchain | Prepare and check transactions you sign; show activity (deployer, locker on coin pages); rate limits |
| Wallet signatures over our sign-in messages (“HeldFor launch …”, “HeldFor lock …”) | Deployers, lockers | Prove you control the wallet before we prepare a transaction |
| Coin name, ticker, image, description | Deployers (uploaded). May contain personal data if the deployer chose so | Create the coin; show it |
| Login session: signed cookie with your X user id, handle and a random session id; list of logged-out session ids | Recipients who log in with X | Let you claim, burn, withdraw, opt out or change mention settings; log you out everywhere |
| Custody log: every transfer out of the custody wallet (bag, coin, amount, destination wallet, time, transaction); hashed IP addresses in rate limits | Everyone who launches, locks, claims or opts out | Security audit trail; detect abuse and key misuse; investigate incidents |
| Rate-limit counters keyed by hashed IP address, wallet or X id | Everyone using the APIs | Prevent spam and abuse |
| Server and error logs (IP address, browser, request path, time, error details) | Visitors | Run the service, fix errors (via our error-tracking provider) |
| Email address and embedded wallet address | Recipients who choose an email wallet on /claim. Collected by Privy; we receive only the wallet address | Give you a wallet to receive a bag |
| Receipt posts on X | Recipients (handle, coin, bag value) | Public receipts from our bot account |
| Name, country, ID document, wallet, email | Security researchers receiving a reward | KYC and sanctions checks before paying a bug bounty |
We do not process special categories of data (Art. 9 GDPR) on purpose. IP addresses are stored only as salted hashes in our own logs; your hosting and error-tracking providers may see them in plain form for a short time.
4. Legal bases
| Processing | Legal basis |
|---|---|
| Preparing transactions you ask for; logins; claims, burns, withdrawals, opt-outs; mention setting | Performance of a contract or steps at your request (Art. 6(1)(b)) |
| Recipients’ public X profile data, bag records, public pages, share images, receipt posts | Legitimate interests (Art. 6(1)(f)): running a service that records and shows bags held for public accounts, so recipients can find and claim them. Balancing: see section 5. |
| Keeping the opt-out record and the minimum data to enforce it (X id, date) | Legitimate interests and Art. 21(3) / Art. 17(3) GDPR: we must remember an objection to honour it |
| Signature log, rate limits, server and error logs | Legitimate interests: security, abuse prevention, defending legal claims |
| Bug-bounty KYC; accounting records | Legal obligation (Art. 6(1)(c)) |
| Optional cookies or analytics (none today) | Consent (Art. 6(1)(a)), asked first if we ever add them |
5. People who never signed up
Anyone can lock a bag for any public X account. When they do, we look the account up on X and store its public profile data, without that person knowing or agreeing first. We think this is fair because:
- we use only data the person already made public on X, and only what is needed (id, handle, name, avatar, follower count, status flags);
- a bag can only benefit them: nobody but them can claim it, and they can burn it;
- we never @mention them with our bot unless they allowed it, and never send them messages;
- they can object at any time with one click (opt-out), which also removes them from every public page.
6. Public and on-chain data
The Solana blockchain is public and permanent. Each bag stores the recipient’s numeric X user id, the coin, the amount, the wallet that locked it and, after a claim, the destination wallet. An opt-out stores the X user id. Coin names, images and descriptions are written on chain and to public IPFS storage. Nobody, including us, can change or delete on-chain data. We can delete or hide what we store off chain (our database, our pages, our bot posts).
7. Processors and other recipients
| Who | What for | Data | Location |
|---|---|---|---|
| Web hosting: Fly.io, Inc. | Serving the website and APIs | All web requests incl. IP addresses, logs | EU (Frankfurt) |
| Database: Fly.io Postgres (Fly.io, Inc.) | Storing the data in section 3 | Everything we store off chain | EU (Frankfurt) |
| Background workers: Fly.io, Inc. | Indexer, receipt bot, scheduled jobs | Database contents they read | EU (Frankfurt) |
| Helius (RPC provider) | Reading and sending Solana transactions | Wallet addresses, transactions; your IP address if your browser talks to it directly | US |
| X Corp. | Login with X; looking up handles; posting receipts | Handles we look up; your login (X sees that you logged in to HeldFor); receipt texts | US. X is an independent controller for your X account |
| Privy (Privy Inc., part of Stripe) | Optional email wallets on /claim and /optout | Your email, embedded wallet, device data, as described in Privy’s privacy policy | US processor |
| Amazon Web Services (AWS KMS) | Holding the custody key and sending withdrawals and burns | The messages we sign (X user id, coin, wallet addresses, amounts) | not used |
| Sentry (Functional Software Inc.) | Error tracking and alerts | Error reports, which can contain IP addresses, request data and wallet addresses | US |
| pump.fun | Coin creation, metadata storage (IPFS), trading | Coin name, ticker, image, description; on-chain data | Independent controller; outside the EU US |
| Authorities, courts, advisers | Only where required by law or to defend legal claims | As required | EU |
We have data processing agreements (Art. 28 GDPR) with our processors. We never sell personal data.
8. Transfers outside the EEA
Some providers are in the United States. We rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on Standard Contractual Clauses (Art. 46(2)(c) GDPR).
9. How long we keep data
| Login cookie | 4 hours, or until you log out (the session id is then kept on a revocation list until it would have expired) |
|---|---|
| OAuth access token from X | Not stored: used once to read your id, then revoked |
| Recipients’ X profile data | As long as a bag for the account exists or is shown, refreshed from X when used. After the last bag is burned or fully paid out, profile data is kept for 12 months for the activity history, then reduced to the X id. |
| Opt-out record | Permanently (X id and date only), because forgetting it would let new bags be locked for you |
| Signature log | 24 months as a security record, longer only if needed for an ongoing incident or legal claim |
| Rate-limit counters | Deleted after their time window (at most a few days) |
| Pending launch / lock records | Minutes to hours while a transaction is prepared; the outcome is kept with the coin record |
| Server and error logs | 30–90 days, per provider settings |
| Bug-bounty KYC | |
| On-chain data | Permanent; not under our control |
10. Your rights
Under the GDPR you can ask us for:
- access to your data and a copy (Art. 15);
- correction of wrong data (Art. 16); X profile data is refreshed from X, so the quickest fix is usually on X itself;
- erasure (Art. 17) of off-chain data, with the limits in section 6 and except what we must keep (the opt-out record);
- restriction (Art. 18) and portability of data you gave us (Art. 20);
- objection to processing based on legitimate interests (Art. 21), see section 11.
To use a right, write to the contact below. If you can log in with the X account concerned, that is how we verify it is you; otherwise we may ask for other proof. We answer within one month (Art. 12(3)). You can also complain to the Latvian Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv) or the authority in your EU country.
11. Objection = opt-out
The simplest way to object to our processing of your X data is to opt out (log in with X, confirm). Opting out:
- blocks every future bag for your account;
- removes your handle, name, avatar and X id from every public page, feed and share image;
- stops our bot from posting about you;
- optionally burns all your unclaimed bags;
- keeps only your X id and the opt-out date, so we can keep honouring it.
If you can’t log in with X (lost access, or you don’t want to log in), write to us; after verifying the request, we hide you from the website and the bot by hand. We can’t record the opt-out without an X login. See the Opt-out Policy.
12. Cookies and local storage
hf_x | Login session after “Log in with X”. Strictly necessary, httpOnly, 4 hours. |
|---|---|
| OAuth state cookie | Protects the X login against forgery. Strictly necessary, deleted after login (minutes). |
| Wallet adapter (local storage) | Remembers which wallet you connected. Stays in your browser. |
| Privy (cookies / local storage) | Only on /claim and /optout if you choose an email wallet. Set by Privy. |
No advertising, analytics or tracking cookies.
13. Security
Signing keys are held in AWS KMS and never leave it. Secrets are stored in our hosts’ secret stores. IP addresses in our logs are salted hashes. Access to production data is limited to the people who run HeldFor. If a breach is likely to put you at risk, we notify the Data State Inspectorate within 72 hours and tell affected people (Art. 33–34).
14. Automated decisions
Our server automatically checks whether your X id matches a bag before it releases anything. This is the service you ask for, not profiling. We don’t make decisions with legal or similarly significant effects based solely on automated processing (Art. 22), except that a claim above a set value may be held for a human review.
15. Children
HeldFor is for adults (18+). We don’t knowingly process data of children. If a bag was locked for a child’s X account, write to us and we will hide it.
16. Changes
We update this policy when our processing changes and show the date at the top. Material changes are announced on the website.