Privacy policy

This policy explains how the people who run bang! (“we”) handles personal data when you use the bang! website, its API and the signing service behind it. We are the controller of that data. It doesn’t cover the Solana network, your wallet app or other services linked from bang!, which have their own policies.

Everything you do on-chain is public and permanent: your wallet address, the tokens you create, every buy and sell, amounts and times. Anyone can read it, and neither we nor anyone else can change or delete it.

bang! reads this public data and shows it in a friendlier form: token pages, holder lists, trade feeds and a profile page for every wallet. A wallet address isn’t your name, but it can be linked to you, for example if you post it or use it with an exchange that knows who you are.

• Wallet and sign-in. Your wallet address and the message you sign to sign in. A session cookie (bang_session) keeps you signed in for up to 24 hours.
• Approval requests. For each buy, sell or launch you ask us to approve: the wallet, token, side, amount, time, the human-check result and score, and whether we approved it.
• Network and device data. Your IP address and, where our network provides it, the network it belongs to. Cloudflare Turnstile reads signals from your browser and device to tell people from bots; we receive only the result.
• Server logs. Each request to our servers is logged with its time, address, path and IP address.
• What you upload. A token’s image, name, ticker, description and links. These are public by design.
• Browser storage. Your last wallet choice and board view, saved in your browser only.

We don’t ask for your name, email or ID documents. We use no advertising or analytics cookies or trackers, don’t build advertising profiles and don’t sell or share personal data for advertising.

Where data protection laws such as the GDPR apply, we rely on these legal bases:

• To provide bang! (contract). Signing you in, approving trades and launches, and showing tokens, trades and profiles.
• To keep launches fair and bang! secure (legitimate interests). Stopping bots, enforcing limits, preventing fraud and abuse, defending against attacks and fixing problems. We keep this proportionate: approval records hold a salted hash of your IP address, not the address.
• To meet legal duties (legal obligation). Sanctions compliance, answering lawful requests, and keeping records the law requires.

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. Automated checks can refuse a single trade approval; you can try again or contact us.

We use only what bang! needs to work: the session cookie and the two browser storage entries above. Cloudflare Turnstile may set its own cookies or use similar techniques to run the human check; see Cloudflare’s privacy policy. Because none of this is used for analytics or advertising, there is nothing to opt into.

We share data only as needed with:

• Cloudflare, which runs the human check.
• Google Cloud, which hosts our servers and keeps the signing key.
• Solana RPC providers. Your browser and our servers read and send to the blockchain through them, so they see IP addresses and the accounts looked up.
• CoinGecko, which your browser asks for the SOL price if ours is unavailable.
• Irys and Arweave, where token images and metadata may be stored permanently and publicly.
• Authorities or others when the law requires it, or when needed to protect people from fraud or harm.
• A buyer or successor if bang! is sold or reorganised, under this policy.

Wallets, Meteora and Jupiter receive data from you directly when you use them, under their own policies.

Our servers are in the United States, and Cloudflare and RPC providers process data in many countries. When data moves out of the UK, the EU or another country with transfer rules, we rely on safeguards those rules recognise, such as the European Commission’s standard contractual clauses offered by our providers.

• On-chain data and permanently stored uploads: forever, outside our control.
• Sessions: up to 24 hours. Rate-limit counters: minutes.
• Server logs: until they rotate out, usually within days to a few weeks.
• Approval records: as long as we need them to investigate abuse and attacks and meet legal duties.
• Uploads on our own servers: while the token is listed on bang!.

We protect what we hold with access controls, encrypted connections and a signing key that can’t be exported from Google Cloud’s key management service. No system is completely secure, and you are responsible for the security of your wallet and devices. If a breach affects your data, we will tell you and the authorities where the law requires.

Depending on where you live, including the EU, the UK and California, you may have the right to:

• know what personal data we hold about you and get a copy;
• have it corrected or deleted;
• restrict or object to how we use it, including uses based on legitimate interests;
• receive it in a portable format;
• not be treated differently for using these rights;
• complain to your data protection authority.

To use them, contact us (below). So we know the request is yours, we may ask you to sign a message with the wallet in question. We answer within 30 days, or tell you if we need longer. We can delete what we hold off-chain, but not anything on the blockchain or permanent storage, and we may keep what we need for security or the law.

You can clear bang!’s cookies and browser storage at any time in your browser’s settings.

bang! is only for people aged 18 and over. We don’t knowingly collect data from anyone younger and delete it if we learn we have.

When we change this policy we update the date at the top. If a change affects how we use data we already hold, we will say so on the site before it applies. The terms of use cover the rest of the rules for using bang!.

Privacy questions and requests go to the bang! team through the contact details we publish on this site.