Privacy Policy

1. Who we are

Slop operates the Service and is the controller of the personal data described in this policy, except where a third party listed below acts as an independent controller of data you give directly to it. You can reach us about privacy at legal@meatplex.com.

The Service is an independent parody project built on the Metaplex Genesis protocol; we are not affiliated with the Metaplex Foundation, and Metaplex is not a controller or processor of your data on our behalf. The Service is a non-custodial interface to public blockchains. We do not run a user database of our own. Most of what we handle is either held by a service provider on our behalf or is public by design on the Solana blockchain and the Arweave storage network.

2. What we collect

We collect only the following, and only in the ways described:

Identity and login data through Privy. When you sign in with email, Google or X, Privy receives and stores the identifier you use (your email address, your Google account identifier and profile email, or your X handle and account ID), the login method, timestamps and the address of the embedded Solana wallet it creates for you. When you connect an external wallet, Privy and we receive its public address. Privy makes the login identifier and wallet addresses available to the Service while you are signed in.
Wallet addresses and on-chain activity. Your public wallet address is used to build transactions, show balances and holdings, and read your trading history from the blockchain. All of this is public on Solana whether or not you use the Service. We also check each connected wallet address against sanctions lists, which may involve sending the address to a screening provider (see Section 5).
IP address and request data. Our servers and hosting provider see your IP address, user agent, request path and timestamp for each request. We use the IP address, and the country our hosting provider derives from it, to rate-limit abusive requests and to block access from jurisdictions where the Service is not offered. We do not build profiles from it.
Prompts you write for AI drafts. If you use the optional "Surprise me" feature, the free-text prompt you type is sent to our server and then to Anthropic to generate a draft name, ticker, description and logo. Do not put personal data in prompts.
Content you publish. Token names, tickers, descriptions and images you launch are uploaded to Arweave through Irys and recorded on the Solana blockchain. They are public and permanent (see Section 7).
Per-device preferences. Settings such as your chosen feed tab, quick-buy size, slippage, haptics, event cards, auto pull up and consent acknowledgements are stored in your browser's local storage. They stay on your device and are not sent to us.
Messages you send us. If you email us, we keep the email and our reply.

We do not run analytics, advertising pixels, session-replay or cross-site tracking on the Service today. If that changes we will update this policy first.

3. How we use it

to sign you in, show your wallet and let you build and sign transactions;
to show your holdings, balances and trading history from public chain data;
to generate AI drafts you ask for;
to publish tokens and images you choose to launch;
to run promotional features you opt into, such as distributing pool payouts to holder addresses;
to rate-limit, geo-restrict, detect abuse and keep the Service secure;
to respond to your messages, legal notices and abuse reports;
to comply with law, including sanctions rules; and
to debug and improve the Service using server logs.

4. Legal bases (EEA, UK and similar laws)

Where the GDPR or UK GDPR applies, we rely on:

Performance of a contract (Article 6(1)(b)) to sign you in, operate your wallet connection, build transactions and publish what you ask us to publish;
Legitimate interests (Article 6(1)(f)) in keeping the Service secure, preventing abuse, debugging and enforcing our Terms. We balance these against your rights, and you can object as described in Section 8;
Legal obligation (Article 6(1)(c)) for sanctions compliance, responding to lawful requests and keeping records we must keep; and
Consent (Article 6(1)(a)) where we ask for it, for example before sending your prompt to an AI provider. You can withdraw consent at any time by not using the feature.

We do not sell personal data and do not share it with advertisers. We share it only with the providers below, each of which processes data to deliver the part of the Service it is responsible for, and with authorities when the law requires it.

Privy, Inc. Authentication, embedded wallet custody and the card and exchange funding flow. Privy is an independent controller for the account and key data it holds, under its own privacy policy. The on-ramp partners Privy integrates receive the data they need for identity checks and payment processing under their own policies; we are not a party to those transactions.
Anthropic, PBC. Receives your prompt when you ask for an AI draft. We send the prompt text only, with no account identifiers. Anthropic's handling is governed by its commercial terms and privacy policy.
Vercel, Inc. Hosts the Service and its API routes, and keeps short-lived server logs containing IP addresses and request data.
Irys and the Arweave network. Receive the images and metadata you publish. Once uploaded they are replicated by network participants worldwide and cannot be withdrawn.
Metaplex Foundation. The metaplex.com and api.metaplex.com APIs receive wallet addresses, mint addresses and launch data when the Service reads feeds and token data, builds certain swaps, or registers a launch. Token images are served through a Cloudflare image resizer on assets.metaplex.com, which sees your IP address when your browser loads an image.
Jupiter. Receives your wallet address and order details when you trade a graduated token.
Solana RPC provider. Receives your wallet address and the transactions you sign, along with your IP address when your browser calls it directly.
Sanctions screening provider. Wallet addresses may be sent to Chainalysis, Inc. to check whether they appear on a sanctions list. Only the public address is sent.
Legal and safety. We may disclose data to comply with law, a court order or a lawful request, to enforce our Terms, to respond to a DMCA or abuse notice, or to protect the rights, property or safety of users, the public or us.
Business transfers. If we are involved in a merger, acquisition or asset sale, data may be transferred as part of it, subject to this policy.

6. International transfers

Our providers operate mainly in the United States, and blockchain and Arweave data is replicated globally. If you are in the EEA, the UK or another region with data-transfer rules, your data will be transferred outside that region. Where a provider processes data on our behalf we rely on its standard contractual clauses or an equivalent lawful mechanism. Data you publish to a public blockchain or Arweave is made public by you and is not covered by a transfer mechanism.

7. How long we keep it

Blockchain and Arweave data (wallet addresses, transactions, token metadata, images) is public and permanent. Neither we nor anyone else can delete it.
Server logs on our hosting provider are kept for a short period, typically days to a few weeks, for security and debugging, then deleted automatically.
Rate-limit and geo-block counters are held in memory and discarded within minutes.
AI prompts are not stored by us after the request completes. Anthropic's retention is governed by its policy.
Privy account data is retained by Privy according to its policy for as long as your account exists.
Emails and legal notices are kept as long as needed to handle the matter and for any legally required period after.
Local storage preferences stay in your browser until you clear them.

8. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to receive a copy in a portable format, to restrict or object to our processing, and to withdraw consent. Under the GDPR and UK GDPR you also have the right to lodge a complaint with your data protection authority. Under the California Consumer Privacy Act (as amended by the CPRA) and similar US state laws you have the right to know what we collect, to delete it, to correct it, and to opt out of sale or sharing. We do not sell or share personal data for cross-context behavioural advertising and do not use it for automated decisions with legal or similarly significant effects, so there is nothing to opt out of.

To exercise a right, email legal@meatplex.com from the address you sign in with, or include the wallet address concerned. We may ask for enough information to confirm the request is genuinely yours. We will respond within the time the applicable law requires. We will not discriminate against you for exercising a right.

Some data is outside what we can change or delete. Anything on the Solana blockchain or Arweave is public and permanent. Account data held by Privy must be requested from Privy, or deleted by deleting your Privy-backed account through the Service or Privy's support. If we cannot fulfil a request for these reasons we will tell you why.

9. Cookies and local storage

The Service does not use advertising or analytics cookies and does not allow third-party tracking. It stores the following on your device:

Privy session cookies and tokens. Privy sets cookies and stores tokens in your browser to keep you signed in and to secure your embedded wallet. These are strictly necessary for the Service to work and cannot be turned off while you are signed in. When you use the promotional "free launch" service, your browser sends your Privy session token to our server, which verifies it against Privy's public keys and holds the resulting account identifier in memory for a few minutes to rate-limit the promotion; it is not stored.
Local storage preferences. As described in Section 2, the Service stores per-device settings and acknowledgements in your browser's local storage. They are not transmitted to us.

You can clear cookies and local storage at any time through your browser. Doing so signs you out and resets your preferences.

10. Children

The Service is not intended for, and may not be used by, anyone under 18. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has used the Service, contact us at legal@meatplex.com and we will take appropriate action, subject to the limits described in Section 7.

11. Security

We use encrypted connections (HTTPS) for all traffic, keep secrets on the server rather than in the browser, rate-limit sensitive routes, and rely on providers with independent security programmes for authentication and hosting. Private keys for embedded wallets are held by Privy and never reach our servers. No system is perfectly secure. You are responsible for the security of your devices, your login methods and any keys you export.

12. Changes to this policy

We may update this policy from time to time. When we do, we will change the effective date at the top of this page, and for material changes we will notify you through the Service before they take effect. Your continued use after the effective date means you accept the updated policy.

13. Contact

Questions, requests and complaints about privacy can be sent to Slop at legal@meatplex.com. For reports about content, see the Report content / DMCA page.