legal

privacy policy

last updated: 3 september 2026

This policy describes exactly what the manifest at the-unrealized.com collects, why it collects it, who else receives it, how long it is kept, and how to have it removed. It is written against the code that runs the site, not against an intention. Where something is published on purpose, this policy says so plainly.

1. Who operates this

The site and the manifest are operated by the unrealized team. Contact: theunrealizednft@gmail.com.

The registered legal entity and its jurisdiction will be published on this page before the mint opens. Until then, the contact address above is the way to reach the people responsible for this data.

2. What is collected

Your wallet address

When you connect a wallet, the site records the public address (stored lowercase). You prove control of it by signing a plain text message in the format of EIP-4361, sometimes called Sign-In with Ethereum. That signature is verified and not stored. No transaction is ever requested and no funds can move through this flow. The site never asks for, and can never see, a private key or a seed phrase.

From X, if you choose to link it

Linking X uses OAuth 2.0 with the scopes users.read and tweet.read. From the response the site stores:

• your numeric X user id;
• your username (handle);
• the date your account was created;
• your follower count;
• whether the account is verified, and the verification type.

The site does not receive and does not request your email address, your direct messages, or your password. It cannot post, like, follow or delete anything on your behalf. Linking is optional; the wallet alone can put you on the board.

From GitHub, if you choose to link it

Linking GitHub uses OAuth with the scope read:user. From the response the site stores:

• your numeric GitHub user id;
• your login;
• the date your account was created;
• your public repository count;
• your follower count;
• the number of your pull requests merged into other people's public repositories since 20 August 2026. This is a count obtained from the public GitHub search API; the site does not store which repositories or which pull requests.

The read:user scope does not give access to private repositories, private email addresses, or the ability to write anything to your account. Linking is optional.

Public on-chain data for your wallet

Once a wallet is connected, the site reads data that is already public on the blockchain, for that address only: the number of transactions, the date of the first transaction where an explorer can supply it, and the native balance. This is read on Robinhood Chain (id 4663) and on ethereum, bnb chain, arbitrum, base, optimism, polygon, linea, scroll, zksync era and blast.

The site also reads public Hyperliquid trading data for that address: the number of fills, the traded volume in US dollars, and the account value. This comes from Hyperliquid's public information endpoint.

None of this requires your permission to read, because it is public by design. The site aggregates it and stores the aggregate against your entry.

Technical data

• IP address. Your IP address, as supplied by Cloudflare in the CF-Connecting-IP header, is used only as the key of a rate-limit counter, so that one source cannot flood the sign-in endpoints. The counter row holds the key, a window timestamp and a count. Windows are one minute long and old rows are deleted as new ones are written. No request log tied to an IP address is kept by this site.
• Session cookie unr_session: an HttpOnly, SameSite=Lax cookie holding a signed token with your internal id and wallet address. It lasts 30 days and is cleared when you sign out.
• OAuth cookie unr_oauth: a short-lived HttpOnly cookie that carries the anti-forgery state for an X or GitHub sign-in. It lasts 10 minutes and is cleared as soon as the sign-in finishes.
• Browser storage. If you dismiss the X or GitHub step with "skip for now", that choice is written to your browser's localStorage. It never leaves your browser and is not sent to the server.
• Audit log. Actions that change an entry — linking an account, a ban, freezing the board — are recorded with a timestamp, the action, the wallet address and a short detail string.

3. Why it is collected

• To compute and publish the ranking. Each source produces a score; the scores produce a rank; the rank decides who is on the free-mint allowlist and in which phase. The formula is published on the site before the board opens.
• To keep the ranking honest. The same data is what makes farming detectable. Wallets found abusing the system can be banned, and a ban is published with its reason.
• To keep the service standing. Rate-limit counters exist so that the sign-in endpoints and third-party API quotas are not exhausted by one actor.

Your data is not used for advertising, not used to build a profile for anyone else, and not sold, rented or licensed to anyone.

4. What becomes public

The manifest is a public leaderboard. Anyone, with or without an account, can read it. For every listed entry it publishes:

• rank;
• the wallet address (the board serves the full address; the page displays a shortened form);
• the linked X handle, if you linked one;
• the linked GitHub login, if you linked one;
• the total score and the phase band.

Entries scoring below the entry threshold are not listed. Banned entries are not listed. Component scores, follower counts, repository counts, balances and transaction counts are shown only to you, in your own panel; they are not published per entry on the board.

5. Legal basis

Where the UK GDPR or the EU GDPR applies, the processing described here rests on:

• Consent for linking X and GitHub. You give it by completing the OAuth flow, and you may withdraw it by asking us to delete the link (see section 8).
• Performance of a contract, or steps taken at your request for the wallet address and the ranking itself: you asked to be placed on the manifest.
• Legitimate interests for anti-abuse, rate limiting and the audit log — namely running a ranking that cannot be trivially farmed, which is the interest of every honest participant.

Where California law applies, we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not use it for cross-context behavioural advertising.

6. Who else receives data

The site has no analytics scripts and no advertising or tracking pixels of any kind in its pages. The parties below receive data because the service cannot function without them, and each receives only what its lookup requires.

• Cloudflare — hosting, edge network, and the D1 database in which entries are stored. Cloudflare processes all requests to the site and therefore sees IP addresses and request metadata as network infrastructure. Cloudflare's cookieless aggregate analytics may be enabled at the account level; it does not set cookies and does not identify individual visitors. Data may be processed in the United States, the European Union and elsewhere on Cloudflare's network.
• X Corp. — receives the OAuth authorisation request and returns your profile fields, only when you choose to link X.
• GitHub, Inc. — receives the OAuth authorisation request, returns your profile fields, and answers the public search that counts merged pull requests, only when you choose to link GitHub.
• Etherscan — receives your wallet address in order to return the date of its first transaction on a given network.
• Public RPC nodes and Blockscout explorer instances for the networks listed in section 2 — each receives your wallet address in order to return public transaction counts and balances.
• Hyperliquid — receives your wallet address in order to return public trading statistics for it.

These are independent services with their own privacy policies and their own terms. Sending a public wallet address to a public blockchain explorer discloses that you are interested in that address.

7. How long it is kept

• Entries (wallet, linked accounts, scores) are kept for the duration of the campaign and for 12 months after the mint, then deleted or irreversibly anonymised.
• Audit log entries are kept for 12 months.
• Rate-limit counters live for minutes: rows older than one window are deleted as new ones are written.
• Cookies expire on their own schedule: 30 days for the session, 10 minutes for the OAuth state.

8. Your rights and how to use them

Depending on where you live, you have some or all of these rights:

• Access — to be told what we hold about you and to get a copy.
• Rectification — to have inaccurate data corrected.
• Deletion — to have your entry and linked accounts removed, subject to the frozen-snapshot exception above.
• Objection and restriction — to object to processing based on legitimate interests.
• Withdrawal of consent — to unlink X or GitHub at any time.
• Portability — to receive your data in a machine-readable form.
• Complaint — to complain to your local data protection authority.

How to exercise them. Write to theunrealizednft@gmail.com. Because the entry is keyed to a wallet, we need proof that the wallet is yours: either sign a message with it and include the signature, or write from the email of the X or GitHub account that is linked to it. We answer within 30 days.

Unlinking is not self-service. There is no button to detach an X or GitHub account from a wallet. That is deliberate: one account can be attached to one wallet only, and a self-service unlink would let one person recycle a strong account across many wallets, which is the exact abuse the ranking exists to resist. Ask us and we will do it by hand.

9. Cookies and local storage

This site sets no advertising and no analytics cookies. It sets two cookies, both strictly necessary for signing in, and both HttpOnly and SameSite=Lax:

• unr_session — keeps you signed in. 30 days. Cleared on sign out.
• unr_oauth — protects the X and GitHub sign-in against forgery. 10 minutes.

Your browser also holds a localStorage flag recording which optional steps you skipped. Clearing your browser data removes it. Because these cookies are strictly necessary, no consent banner is shown for them.

10. Security

Sessions are signed tokens; cookies are HttpOnly, so page scripts cannot read them. The site is served over HTTPS with a strict transport policy and a content security policy that forbids third-party scripts. Rate limits sit in front of the sign-in endpoints. No system is perfectly secure, and a public leaderboard is public by construction — treat everything in section 4 as permanently visible.

11. Age

This site is not intended for anyone under 18, and we do not knowingly collect data from anyone under 18. If you believe a minor has an entry on the manifest, write to us and we will remove it.

12. Changes

When this policy changes, the date at the top changes with it, and material changes will be announced on the site and on @the_unrealized. We do not change what we collect retroactively without saying so.

13. Contact

theunrealizednft@gmail.com. Operated by the unrealized team.

See also the terms and how the art is made.