A smaller data footprint.

Hotlist uses wallet signatures for project ownership and payments. The waitlist uses X sign-in only; we do not collect passwords or email addresses.

For the waitlist, we store signup times, referral relationships and access status. We use hashed, expiring tokens for waitlist sessions and rate limiting. Invite links identify your referral entry.

When you join with X, we store your X account ID, display name, username, a copy of your profile photo for your VIP pass, and your X account’s creation date and follower count (to help us spot fake accounts used to game referrals). We do not store X access tokens or request permission to post for you. Anyone who opens your invite link sees your X name, username and photo (“@you invited you to join”). Choosing Share on X publishes your pass, including your name, photo, username and member number, at your invite link so social platforms can preview it. Published passes are snapshots. To draw characters our typeface doesn’t include, such as emoji, the pass renderer may fetch those glyphs from Google Fonts.

What is stored

We store public wallet addresses, listing details, checkout quotes, payment amounts, transaction hashes, and timestamps. Listing details and confirmed payment activity are public. Blockchain transactions are public independently of this site.

Browser storage

An HTTP-only session cookie keeps you signed in for up to one day. A short-lived challenge cookie protects wallet sign-in. Outbound-visit cookies prevent repeated clicks from being counted more than once per browser per day. Local storage remembers your color theme and the latest pending transaction so you can recover it. No advertising trackers are included.

Analytics

Vercel Web Analytics counts page views, referrers and approximate location, and Speed Insights measures how fast pages load. Neither uses cookies or follows you to other sites.

Operational data

Temporary request counters use network addresses to limit abuse. Hosting and RPC providers may process technical request data. Your wallet provider handles wallet access and transaction authorization. Hotlist never asks for or stores your seed phrase or private key.

Retention and control

Signing out invalidates the current session. Expired sessions and sign-in challenges are removed during subsequent authentication requests. Payment records are retained for accounting and to prevent duplicate credit. You can edit listing content from My projects. Removing local storage does not erase public blockchain history.