Privacy Policy.

• You sign in with a wallet signature or a linked OpenSea profile. We never ask for your seed phrase or private key, and signing in never sends a transaction.
• You can look around the Hub without an account. To have one, a verified wallet or OpenSea profile is the only thing you must give.
• Everything else, such as profile details, location, posts and messages, is your choice.
• Your wallet addresses are private by default. Your location is off by default and is never more precise than a country or region.
• We do not use advertising or analytics cookies, and we do not sell your data.
• You can download a copy of your data, correct it, and delete your account from your profile.

• Wallet addresses (needed for a wallet account). Each wallet you add is confirmed by a message you sign. We store the address, when it was verified and when it last signed. Others can only see your wallets if you switch that on. If you do not want to give a wallet, you can sign in with an OpenSea profile instead, or keep browsing without an account.
• OpenSea profile (optional, or needed for an OpenSea-only account). If you link one, we store its address and username. You confirm it by placing a one-time code in your OpenSea bio. Without it, the Hub works with your wallets alone.
• Your profile (optional). Every account gets a username made up for it, which you can change. If you add them: display name, bio, website, and X, Discord and Instagram handles. Your profile picture is either the default NPC head or an NFT we have confirmed you hold. If you leave these empty, your profile simply shows less.
• Your holdings (comes with your wallets). The NPC and PC tokens held by your verified wallets or linked OpenSea profile (name, token number and image), fetched from OpenSea. New accounts show them on their profile, with how many you hold, until you switch them off in Edit Profile. Older accounts keep the setting they had. When they are off, nobody but you can see them or their count.
• Approximate location (optional). Off by default. If you turn it on you pick a country, or a country and region; we never ask for anything more precise. You can change it at most once every 7 days. The World Map only shows exact totals per country and region, small ones included, never who is in them. Hiding your location removes you from the totals right away. If you never turn it on, you are simply not counted on the map.
• What you share in the community (optional). Posts and the images and image descriptions you add to them, reposts, @mentions, comments and replies, likes, follows, blocks, reports you file, creations you upload, and projects you submit or edit, with their covers. If you share none of this, you can still use the rest of the Hub.
• Messages (optional). The text of your direct messages, who they are between and when they were sent and read. Message text is encrypted before it is stored, and the keys are kept apart from the database. This is not end-to-end encryption: the Hub’s server decrypts messages to show them to you and the person you are talking to. The NPC team does not read conversations; if you report a message, a copy of that one message is kept with your report so the team can review it. You choose who can message you (everyone, people you follow, or nobody) in Edit Profile.
• Security records (needed for every account). A log of account events such as sign-ins, sign-outs, wallets added or removed, and username changes. Where we record the network address you connected from, we store a keyed one-way code made from it, never the address itself. We use the same kind of code for short-term limits on repeated sign-in attempts. These records cannot be switched off, because the Hub cannot keep accounts secure without them.
• Session records (needed for every account). Which sign-in method you used and when your session expires, so we can keep you signed in and let you sign out everywhere. Without them you cannot stay signed in.
• Record that you accepted the Terms (needed for every account). When you confirm you are 18 or older and accept the Terms and this policy, we record which account accepted, when, and which version of the Terms. Without it you cannot open an account.
• Reports (optional). If you report content, we keep what you reported, the reason and any details you add. On the report page you do not need an account; if you choose to leave a way to reach you (such as an email address), we keep it to tell you what we decided. If you are the person reported, we keep the report and the team’s decision, and send you the reasons and how to appeal.

• To sign you in, keep your account secure and stop abuse, including spam limits on posting, commenting and messaging.
• To show your profile and holdings to other collectors, within the privacy settings you choose.
• To build the World Map from collectors who chose to share a location.
• To run the community features: showing your posts, comments, creations and projects to others; counting likes and reposts; building your feed from the people you follow; telling people when you follow, mention, message, like or comment on them; and keeping people you block, or who block you, apart.
• To deliver your direct messages to the person you are writing to, and only them.
• To let the NPC team review what is reported, hide content that breaks the Terms of use, and keep a record of what was done.
• To give you a copy of your data and to answer you if you contact us.

We do not use your data for advertising and we do not sell it.

• Contract. Running your account and the features you use: signing in, your profile and holdings, posts, comments, messages, notifications, your data download, and the record that you accepted the Terms.
• Legitimate interests. Keeping the Hub and its members safe: security logs, the one-way codes made from network addresses for attempt limits, spam limits, handling reports and moderation, and keeping records of what the team did. Our interest is a safe Hub that is hard to abuse. You can object to this, as explained below.
• Consent. Your location on the World Map. It is off until you turn it on, and you can withdraw your consent at any time on the World page by choosing Hidden in the location settings. That removes you from the totals right away. Withdrawing does not affect what was shown before.
• Legal obligation. Answering lawful requests from authorities, acting on illegal content, and passing threats to life or child abuse material to the police or the relevant authority.

• OpenSea. We send OpenSea wallet addresses and OpenSea usernames to ask which NPC and PC tokens they hold, and read its public profile pages to confirm a link. Token images are loaded from OpenSea’s image servers.
• Wallet apps and connectors. Connecting a wallet uses RainbowKit, with MetaMask, Rainbow, Coinbase Wallet and WalletConnect (run by Reown) for mobile and QR-code wallets. Coinbase Wallet may open its own window from Coinbase. The wallet you choose, and these services, see the connection request and the message you are asked to sign.
• Alchemy. To check a sign-in signature, our server may send your wallet address and the signature to an Ethereum node run by Alchemy. Smart wallets need this on-chain check.
• Ethereum network. Your browser may read public blockchain data through a public Ethereum node. Wallet addresses are public on the blockchain by nature.
• Railway. The Hub and its database run on Railway, and the images you upload are stored in Railway Object Storage. Railway stores the data described above on our behalf.

Each of these services has its own privacy policy. We may also share data if the law requires it.

The Hub’s servers, database and image storage are run by Railway in the United States, and Alchemy and OpenSea are also based there. If you live elsewhere, such as in the European Union or the United Kingdom, your data is sent to the United States. To protect it, we rely on our providers’ data processing terms, which include the standard contractual clauses approved by the European Commission (with the UK addendum for UK data). You can ask us for a copy of these safeguards at @npconchain on X.

The Hub only uses cookies and browser storage that it needs to work. There are no advertising, analytics or tracking cookies, which is why we do not show a cookie banner.

• Session cookie keeps you signed in: up to 30 days after a wallet sign-in, 7 days after an OpenSea sign-in.
• Sign-in check cookies tie a sign-in or OpenSea code to your browser: 5 to 15 minutes.
• “Look around” cookie remembers that you chose to browse without signing in: 30 days.
• Site-access cookie is used only while the Hub is private for testing. It remembers that you entered the access password: 7 days.
• Wallet connection storage in your browser remembers which wallet you connected, so you do not have to reconnect on every visit.

• Your profile, wallets, holdings, settings and what you share in the community: until you remove them or delete your account.
• A post you delete is removed straight away. If it was hidden or reported when you deleted it, the NPC team keeps it for 30 days to finish the review, then it is removed for good.
• Security log: 90 days.
• Notifications (who followed you, messaged you, or liked or commented on your things): 90 days.
• Messages: until you or the other person deletes the conversation (a message is removed for good once both of you have deleted it) or either account is deleted. A reported message’s copy: until the report is handled, then 90 days.
• Expired sessions, one-time sign-in codes and attempt limits: about a day after they end.
• Reports you file from inside the Hub: until you delete your account.
• Reports sent without an account: as long as needed to handle the report and any legal claim about it. Any name and contact details you left are deleted 90 days after the report is closed, and you can ask us to delete them sooner.

You have the right to see the data we hold about you, and to ask us to correct or delete data that is wrong, incomplete or out of date.

• See your data. Use Download my data in your profile’s account settings for a file with everything your account has saved, or ask us at @npconchain on X.
• Correct it. Edit your profile, hide your holdings, show or hide your wallets, and change or turn off your location at any time on the World page. For anything you cannot change yourself, ask us at @npconchain on X.
• Remove a wallet or unlink your OpenSea profile from your profile, and delete your own posts, comments, creations and projects.
• Delete your account from your profile. You confirm with a fresh wallet signature and by typing your username (an OpenSea-only account confirms with a bio code). This removes your profile, wallets, links, holdings, settings, sessions, notifications, security log, everything you shared in the community, and your conversations, including your messages in other collectors’ inboxes.

Some records stay after an account is deleted, without your profile:

• a one-way fingerprint of the deleted account, so we can show the deletion happened: 90 days;
• the NPC team’s record of moderation actions it took;
• reports other collectors made about you or your content, and a copy of a message someone reported, until the report is handled.

Depending on where you live, the law gives you these rights over your data:

• Access: get a copy of the data we hold about you.
• Correction: have wrong or incomplete data corrected.
• Deletion: have your data deleted.
• Restriction: ask us to stop using your data for a while, for example while we check a complaint.
• Portability: get the data you gave us in a common file format, which Download my data provides.
• Objection: object to uses based on our legitimate interests. We then stop unless we have strong reasons, such as keeping members safe.
• Withdraw consent: turn your location off at any time, as explained above.

To make a request, write to @npconchain on X from a contact you can show is yours, or tell us your username. We reply within one month. If a request is complex we may need up to two more months, and we will tell you why within the first month.

If you are unhappy with how we handle your data, tell us first at @npconchain on X and we will try to put it right. You can also complain to the data protection authority where you live or work, or where you think the problem happened.

If your data is lost, stolen or exposed, we act at once to stop it. Where the law requires, we tell the data protection authority, and we tell you directly when there is a high risk to you, with what happened and what you can do.

The Hub is not meant for anyone under 18. If you believe a child has created an account, contact us and we will remove it.

If we change this policy we will update the date at the top of this page, and tell signed-in collectors about important changes in the Hub.

Questions or requests: @npconchain on X. See also our Terms of use and Accessibility statement.