Prototype draft, last updated October 17, 2026. To be reviewed by a lawyer before any public launch.

In short

• No email, no password, no real name: your account is your wallet.
• Your IP address is never stored. Only a country code (like “FR”) is kept, for the leaderboards by country.
• No ads, no trackers, no analytics.
• Transactions on the blockchain are public and permanent.

What ZAPR stores

• Account: your wallet's public address, username, bio, profile picture link, country code, sign-up date and privacy settings. If you link more wallets (Google, another wallet), their addresses too: they are never shown to other people on ZAPR.
• Activity: your posts, comments, follows, reports (seen only by the ZAPR team), and the record of every zap (amount, split, date, transaction signature, anonymous or not).
• Country: worked out at each visit from your IP address, either by a header added by our host (Vercel) or on our own server with a local database (IP Geolocation by DB-IP), without asking any outside service. The address is only used for this lookup and is never stored or logged: only the 2-letter code is kept, on your account and your posts.

What stays in your browser

• zapr_session: keeps you signed in for 30 days. It is signed and can't be read by scripts.
• zapr_nonce: a one-time code used while you sign in, gone after 5 minutes.
• A few local settings: whether you are signed in, and whether you have seen the welcome message.

What is public by nature

• Solana transactions (your zaps) are public forever: anyone can see the sending wallet, the receiving wallets and the amount. “Anonymous zaps” only hide your username on ZAPR.
• Photos, videos and profile pictures are turned off for now: nothing is uploaded, posts are text only.

Who processes the data

• Vercel (hosting), Neon (database).
• Privy, only if you sign in with Google or Apple: it creates and secures your Solana wallet, and receives the email of your Google / Apple account. You can export that wallet's key from Settings.
• A Solana RPC provider (reads balances and sends transactions; it sees your wallet address).
• If you send feedback: the form service or e-mail provider the ZAPR team uses receives what you write (and the page details you choose to keep). ZAPR itself adds no IP address and nothing about your wallet.

How long

• Expired posts and their comments are deleted about 10 minutes after they expire.
• Zap records are kept: they are the record of money that moved, and they feed the creators' totals.
• Your account is kept until you ask for its deletion.

Your rights

You can change your username, bio, picture and privacy settings in Settings, and delete your comments and your posts that have no zap yet. To get a copy of your data or delete your account, write to the ZAPR team: [PLACEHOLDER: contact e-mail, to be added before the public launch].

How it works · Terms · Privacy · Risks