Privacy
Draft. Not yet reviewed by a lawyer.
Playing the game on its own stores nothing about you outside your browser. The weekly league stores your wallet address and your runs. There are no ads, no analytics and no tracking cookies.
Who is responsible
operator's legal name and address runs the site and decides what is done with your data. Contact: contact email.
What we collect
Playing without the league
Your browser keeps two small items in its local storage: w1t.best, your best score on this device with the initials you typed, and w1t.ach, the secrets you have found. They stay on your device and are never sent to us. The pages set no cookies, use no session storage and load no analytics, ad or tracking code. The fonts, scripts and pictures come from this site itself.
Like any website, the host that serves the pages sees the address and details of each request. See Netlify below.
The league
When you sign in and play in the league, the server stores:
- Your wallet address, with the first and last time we saw it.
- Your sign-in. A one-time number and the details of the sign-in request (the site, the time and your address), which expire after 5 minutes, and a session: a random token held in your browser, of which only a scrambled copy (a hash) is stored, with your wallet address, the start and last-seen times and how you signed in.
- Hold checks. Your $WELON balance, the price used, the dollar value, the result and the time.
- Your runs. The seed, the start and finish times, your claimed score, the score our replay produced, the recorded button presses of the run, the result of the check, the reason if it was rejected, and the points it earned, with the feats the replay saw.
- Your standing. Weekly points, and for each closed week your rank, points, best score, the value of your hold at the close, your share and the amount due, and any flags set for review.
- Where your wallet's money first came from. For wallets in the top 100 at a weekly close, the server looks up on the public blockchain which address first funded the wallet, and when, and stores that. We use it only to spot groups of wallets that look like one player.
- Payout records. The transaction and time, once a person has sent a payout.
Your IP address is not saved in the league database. It is used in four ways:
- To limit how fast one address can ask for sign-ins and runs. These counters are held in a cache and expire on their own, within about an hour.
- It is passed to Cloudflare Turnstile, the bot check at sign-in.
- Cloudflare works out your country from it. We read only that country code, to apply the country block.
- The web server in front of the league (Caddy) writes an access log that, in its standard form, includes the visitor's address and the page asked for. Our own application logs record the request type, the route, the status and the time taken, and replace any IP field with a placeholder.
The public weekly board
The board shows each ranked wallet as its first four and last four characters, for example 7xKX…9fQz, with its weekly points and its best score. A run still being checked is listed under Verifying in the same shortened form, with its claimed score. We show no names. Anyone can also load the board of a past week. Wallets are public on the blockchain, so someone who knows an address can find it on the board, and someone who sees a shortened address can often work out the rest.
Cookies
The site itself sets none. After you sign in to the league, the league server sets one cookie, __Host-melon_session, to keep you signed in. It is HttpOnly, Secure and SameSite=Lax, it lasts at most 7 days and it stops working after 24 hours without use. Signing out deletes it. Cloudflare, which sits in front of the league server, may set its own security cookies. There are no advertising or tracking cookies.
Who else receives data
- Netlify hosts this website and sees the usual details of every visit, such as the IP address and the page asked for.
- Cloudflare is the proxy in front of the league server and runs Turnstile, the bot check at sign-in, which loads a script from Cloudflare's servers. It sees the league traffic, including IP addresses.
- Hetzner hosts the league server and its database, confirm the data centre location (the plan is the EU).
- Solana RPC providers: Helius, and the fallback RPC provider, for example Alchemy: the code does not name it. They receive your wallet address and the token's address to read balances and funding history.
- Jupiter gives us the token price. We send it only the token's address, which is not personal data.
- Sentry receives error reports, but only if it is switched on: confirm whether Sentry is enabled. If it is, cookies, headers, request bodies, query strings, signatures and IP fields are removed before an event is sent.
- Links you choose to click, such as opening the game in Phantom or sharing your score on X, take you to those services, which have their own policies.
Some of these providers process data outside the EU. transfer safeguards, for example standard contractual clauses: lawyer to confirm.
The blockchain is public and permanent
Your wallet, its balance and its transfers, including any payout we send you, are recorded on a public blockchain. We do not control it and cannot erase or change what is on it.
How long we keep it
| Data | Kept |
|---|---|
| Sign-in numbers | 5 minutes, then deleted |
| Sessions | 7 days at most, 24 hours idle |
| Rate-limit counters (IP address) | About an hour at most |
| Hold check records | 8 days |
| Hold checks made at a weekly close | 180 days |
| Price samples (not personal) | 8 days |
| Runs, points, closed weeks, wallet records, flags and payout records | how long to keep these: the code sets no automatic deletion |
| Web server access log | log retention: not set in the code |
Where the law requires us to keep a record, for example of a payout, we keep it as long as it requires.
Why we use it
We use this data to run the league (checking you hold enough, verifying runs, ranking and paying), to keep it fair and the service secure (rate limits, flags, bot checks, the country block), and to meet legal duties. legal bases under the GDPR: lawyer to confirm.
Your rights
The server is in the EU, so we follow the GDPR. You can ask us to:
- tell you what we hold about your wallet, and give you a copy;
- correct it;
- delete the off-chain league data tied to your wallet, which means your sign-ins, runs, points and standing. This ends your place in the league, and we may keep what the law requires;
- limit or object to how we use it.
To ask, write to contact email with your wallet address. We may ask you to sign a short message with that wallet to show it is yours. We aim to answer within one month. You can also complain to your local data protection authority.
Children
The league is for people who are 18 or older. We do not knowingly collect data from anyone younger.
Changes
If this notice changes, the date at the top changes too. See also the Terms and the League rules.