Privacy Policy

unipump is run by a small team that has not yet formed or publicly named a company. Until that happens this policy cannot name a legal entity, a registered address, a data protection officer, or an EU representative, and we are not going to invent one. When an operating entity exists, its name and country will be stated here.

This matters for your rights. Under EU and UK data protection law, parts of what you can demand and who you can complain to depend on who the controller is and where it is established. That is unresolved. In the meantime, a message to support@unipump.fun reaches the people who actually hold the data and can delete it.

The whole of it, in five lines.

• What we collect A wallet address, at least one of a Telegram or an X username, your IP address, the time you signed up, the time you consented, a random invite code we generate for you, and the invite code of whoever referred you, if anyone.
• What we never ask for No email address, no private key, no seed phrase, no wallet signature, no identity document. We hold no funds.
• No sale, no advertising We do not sell your data, rent it, trade it, or use it for advertising or profiling.
• No trackers The public pages set no cookies and run no analytics, tag managers, pixels, session recorders, or third-party scripts. Fonts are served from our own domain.
• Who sees it The unipump operators, through a password protected admin page, and our hosting provider, which stores the database.

Submitting the waitlist form writes one row to our database. That row contains exactly the fields below and nothing else.

The form also carries a hidden anti-bot field. If anything is typed into it, the submission is silently discarded and nothing at all is stored.

• Wallet address Required. It must be 0x followed by 40 hexadecimal characters, and we store it in lowercase. An address can appear on the list once: a second submission of the same address is rejected rather than stored again. A wallet address is a public identifier on a blockchain, but held next to a social handle it identifies a person, so we treat it as personal data.
• Telegram or X username At least one is required. We strip a leading @, drop every character that is not a letter, number, or underscore, and keep at most 32 characters. It is how we would reach you, and how you can look up your own referral count without remembering which wallet you used.
• IP address We store the IP address the submission came from, in full, in the same row as your signup. We use it to cap signups per network and to block bots. Be clear about what that means in practice: the raw address is kept with your entry, it is included when an operator exports the list to a CSV file, and it is not shortened, hashed, or deleted on a schedule. Separately, our rate limiter keeps only a keyed hash of the address and never the address itself.
• Timestamps We store when you submitted the form and when you agreed to the Terms of Service and this policy. Both are recorded at the same moment, in UTC.
• Your invite code A random code generated for you at signup. It is not derived from your wallet or your handle, so it cannot be reversed into either.
• Referrer's invite code If you arrived through someone's invite link, we store the code carried in that link so the person who invited you is credited. They never see your wallet address or your handle. They see a count.

We do not collect email addresses. We do not ask you to connect a wallet or sign a message, so we never see a private key or a seed phrase. We do not collect your name, your location, your device details, or your browsing history, and we do not build a profile of you.

We do not calculate or store a queue position, a rank, or a place in line. There is a database row and the time it was created. Nothing on our side ranks you, and nobody can tell you your number, including us.

This is the complete list of what waitlist data is used for.

• Running the waitlist Storing your signup and keeping the list.
• Getting in touch We may message you on the Telegram or X handle you gave us if there is ever something to say. We may also never message you, and nothing here commits us to.
• Referrals Counting how many signups arrived through your invite link and showing you that number.
• Stopping abuse Using your IP address, the rate limiter, and the hidden anti-bot field to cap signups per network and to block automated submissions.
• Legal compliance Meeting a legal obligation that applies to us.

The waitlist page has an "Already joined? Track your invites" lookup. Anyone can use it without logging in, because there is no login anywhere on this site.

We built it to leak as little as possible. A lookup by wallet address returns no handle. A lookup by handle returns no wallet address. Neither returns your other handle. The invite code it hands back is a freshly generated alias, not the code you were given at signup, so an invite link you published next to your social account cannot be matched back to a wallet. Every response takes the same amount of time and has the same shape whether or not an entry exists, and the endpoint is rate limited.

One residual fact remains, and you should know it before you sign up: somebody who already knows your wallet address or your handle can use the lookup to confirm that it is on this waitlist and see how many referrals it has. If that is a problem for you, do not sign up, or ask us to delete your entry.

We do not sell your data and we share it with nobody for marketing. These are the only other parties involved.

• Our hosting provider The site and the database run on shared hosting. The provider stores the database on our behalf, and its web server logs will contain IP addresses and request times, as any web server's logs do. We do not control that provider's own retention schedule.
• A market data provider The reference prices shown on the waitlist page are fetched by our server from a third-party market data provider, named in our Disclosures. That request carries no visitor data, and your browser never contacts the provider.
• Telegram and X If you click through to Telegram or X, or share an invite link with their share buttons, you leave our site and their own privacy policies apply. We do not send them your waitlist data.
• Legal obligations We may disclose data where we are required to by law, regulation, or valid legal process.
• With your consent Any other sharing happens only if you agree to it first.

The public pages, including the waitlist page, set no cookies. There is no analytics, no tag manager, no advertising pixel, no session recording, no fingerprinting, and no use of localStorage or sessionStorage. Web fonts are served from our own domain, so loading a page contacts no third party.

One cookie exists anywhere on this domain: a PHP session cookie set on the password protected admin page under /api/. It is used by unipump operators to stay logged in and is never set for visitors.

The database sits with our hosting provider. Access runs through a password protected admin page limited to unipump operators, with idle and absolute session timeouts. The form is rate limited, database queries are parameterised, and our endpoints send no cross-origin permissions, so a page on another site cannot read a response about you.

Two honest limits. First, an operator can export the entire list, including raw IP addresses, as a CSV file, and once such a file is on someone's computer it sits outside these controls. Second, no system is perfectly secure, and we cannot promise your data will never be exposed.

We keep waitlist entries until we no longer need them or until you ask us to delete yours. There is no automated deletion schedule today, so an entry stays in the database until a person removes it. Rate limiting records, which hold a hashed IP address and no signup data, are deleted automatically after about two days.

If the project is abandoned we intend to delete the waitlist database rather than keep it or pass it on. If unipump is ever acquired or reorganised, we will update this page before any transfer of data.

Email support@unipump.fun from wherever you like, quote the wallet address or the handle you signed up with, and say what you want: a copy of your entry, a correction, or deletion. That mailbox is read by the same people who run the database. A deletion means an operator removes your row by hand, so expect a human response time rather than an instant one.

We may ask you to prove control of the wallet or the handle before we act, for example by messaging us from that handle. The request is otherwise unverifiable, and acting on an unverified request would itself be a privacy failure. If we cannot verify you, we may refuse.

The limits, stated plainly: a CSV export that an operator has already downloaded is not reached by deleting your row, we may keep a minimal record that a deletion was requested so it is not undone by mistake, and our hosting provider's server logs age out on its schedule rather than ours.

If you are in the EU or the UK you may have rights to access, correct, delete, restrict, object to, and port your data, and a right to complain to your national supervisory authority. We are not naming a lead authority here, because which one it is depends on where the operating entity is established and that is not yet settled. See the first section of this policy.

Where the law requires a legal basis, we rely on your consent for storing your signup and for contacting you about the project. You give that consent by ticking the box on the form, the server refuses any submission that arrives without it, and the time you gave it is stored with your entry. You can withdraw consent at any time by asking us to delete your entry. Withdrawing does not affect anything we did while the consent was in place.

For keeping your IP address, rate limiting, and blocking bots, we rely on our legitimate interest in protecting a public form from abuse. If you object to that specific use, tell us, and understand that we cannot keep your entry without the abuse controls that come with it.

You must be 18 or older, or the age of majority where you live if that is higher, to join the waitlist. We do not knowingly collect data from anyone below that age. If you believe a minor has submitted data, contact us at support@unipump.fun and we will delete it.

We may update this policy. When we do we post the new version on this page and update the date at the top. We hold no email address for you, so we cannot notify you individually. If a change would materially widen what we do with data already collected, we will ask for consent again rather than rely on this page alone.

Questions about this policy, about your data, or about anything on this page that looks wrong can be sent to support@unipump.fun. Our Terms of Service and Disclosures cover what a waitlist signup does and does not give you.