LAST UPDATED · SEPTEMBER 23, 2026

PRIVACY POLICY

This Privacy Policy explains how the ZKBEARS project team (“ZKBEARS,” “we,” “us,” or “our”) handles information when you use zkbears.xyz and the ZKBEARS whitelist. For privacy questions or requests, contact @zk_bears on X.

1. Information we collect

• X authorization information: a pseudonymous identifier derived from the temporary X access token. The current service does not store the access token, refresh token, X password, private messages, posts, follower list, email address, or current X handle.
• Whitelist information: task-completion status, the Zcash Unified Address returned by Noir Wallet, submission time, the accepted legal-text version and acceptance time, and related update timestamps.
• Session information: a randomly generated session identifier stored in a secure HttpOnly cookie and a hashed version stored in our database.
• Temporary authorization information: OAuth state and PKCE verification values used to protect the X authorization process.
• Browser storage: short task-return markers in localStorage so the website can complete a task after you return from an external X page.
• Technical information: hosting and security providers may process IP address, browser, device, request, and diagnostic information in their infrastructure logs.

2. How we use information

We use information to authenticate sessions, operate the whitelist in the required order, display saved progress, prevent the same wallet address from being submitted more than once, protect the service against misuse, troubleshoot errors, respond to requests, and comply with applicable obligations. We do not sell personal information, use it for targeted advertising, or store X access tokens after authorization.

3. Legal bases

Where data-protection law requires a legal basis, we process information as necessary to provide the whitelist service you request and perform our agreement with you; for our legitimate interests in securing, maintaining, and preventing abuse of the service; and where necessary to comply with legal obligations. Where consent is legally required for a separate activity, we will request it separately.

4. Services and recipients

• X: provides the authorization screen and processes your X account under X’s own policies.
• Noir Wallet: provides the browser wallet connection. The extension returns the selected Unified Address to the website.
• Cloudflare: provides the API, security, and D1 database used for whitelist records.
• GitHub Pages: hosts the public static website.
• Google Fonts: supplies the website font and may receive technical request information when the font is loaded.

We may also disclose information where required by law, necessary to protect legal rights or security, or as part of a project reorganization subject to appropriate protections. Providers may process information in countries other than yours under their contractual and legal transfer mechanisms.

5. Cookies and localStorage

The whitelist session cookie is strictly necessary to keep you signed in. It is marked Secure, HttpOnly, SameSite=Strict, and expires after 30 days. Task-return localStorage markers contain no wallet address or X token and are removed when the relevant task completes; you can also remove them using your browser controls. We do not currently use advertising or analytics cookies.

6. Retention

• OAuth state records expire after 15 minutes and are removed after use or during routine cleanup.
• Whitelist sessions expire after 30 days and expired sessions are removed during routine authentication cleanup.
• Whitelist entries and wallet addresses are retained while needed to administer the whitelist and collection release. Unless a longer period is required for security, disputes, or legal compliance, we intend to delete or anonymize them no later than 12 months after the whitelist is cancelled or the related public release is completed.
• Infrastructure logs are retained according to the relevant hosting provider’s operational and security policies.

7. Security

We use HTTPS, restricted cross-origin access, secure session cookies, hashed session identifiers, server-side secrets, and access controls. No online service can guarantee absolute security. Protect your device and wallet, and never send anyone your seed phrase or private keys.

8. Your choices and rights

You can disconnect the current browser session, clear cookies and localStorage, or stop using the service. Depending on applicable law, you may have rights to request access, correction, deletion, restriction, portability, or objection, and to complain to a competent data-protection authority. Send a request to @zk_bears on X and include enough information for us to locate the relevant entry without sending a private key or seed phrase. We may need to verify that you control the relevant wallet or session.

9. Children

The website and whitelist are not intended for anyone under 18. We do not knowingly collect information from children.

10. Changes

We may update this Privacy Policy when the service or applicable requirements change. The “Last updated” date identifies the current version. Material changes will be presented on the website before they apply to new whitelist submissions.

11. Contact

For privacy inquiries or data requests, contact @zk_bears on X.