Privacy Policy

Privacy at a glance

NFT Zone is an independently operated NFT information website. This policy explains how the website handles information when you browse, sign in or use its account and community features. For privacy questions, contact [email protected].

You can browse the public calendar, collection pages and documentation without an account. Signing in creates account and session records. Using Watchlist, notes, reactions, Daily Check-in or community submissions creates additional records associated with your account.

Essential cookies support sign-in and protect account actions. NFT Zone also uses Umami Analytics to understand website usage and performance. External providers and websites handle information under their own privacy policies.

Information we collect

Provider information

NFT Zone processes OAuth responses to authenticate or link an identity. It stores the provider identifier and relevant account fields, rather than a complete copy of every provider response. Matching email addresses do not automatically merge accounts.

Your account number and username are identifiers, not secrets. Account email and private notes are not published as calendar information. Administrators can access account records needed for support, moderation and security.

Connection information

Your IP address is processed when your browser connects to the service. The application uses hashed IP-related values in security records, including sessions, authorization flows and check-ins. This reduces storage of raw addresses in those records; it does not make browsing anonymous. Hosting infrastructure, operational logs and external services may also process connection information, including IP addresses.

Wallet addresses

Wallet connection is in development. Account can display and copy an EVM, Solana or Zcash address if one is already associated with your profile, but there is no self-service connection flow. NFT Zone does not ask for private keys or seed phrases.

How we use information

• Recognize your account, maintain sessions and confirm connected identities.
• Provide saved drops, private notes, tracking statuses, reactions and Daily Check-in.
• Review submissions, publish approved project information and record moderation decisions.
• Protect accounts, enforce access controls and request limits, and investigate misuse.
• Diagnose problems and understand website usage and performance.
• Respond to support and privacy requests.

Include only information needed for the feature you are using. Do not put passwords, private keys, seed phrases or other secrets in notes, submissions or support messages.

Cookies and analytics

Session and CSRF cookies

A session cookie connects your browser to a session stored on the server. It is protected from access by page scripts. A separate CSRF cookie helps the site verify requests that change account data and guard against cross-site request forgery. Cookie settings also restrict cross-site use; production settings require secure connections.

Signing out revokes the current session and clears these cookies. Sessions also expire under the service's configured time limits. Blocking essential cookies prevents signed-in features from working.

Local preferences

The site can store interface preferences in your browser, such as your selected theme and calendar layout. You can clear these through your browser's site-data controls.

Umami Analytics

NFT Zone uses Umami for website usage and performance analytics on pages where the tracker is enabled. Analytics can include page addresses and query parameters, referring pages, browser and device information, language, approximate location and measurements of loading speed, responsiveness and layout stability.

Umami's standard website tracker works without analytics cookies. This is separate from NFT Zone's essential session and CSRF cookies. The site's tracker configuration does not explicitly attach account email, private notes or OAuth credentials to analytics events. Connection data is still processed to deliver requests; cookie-free analytics does not mean complete anonymity. See Umami's FAQ and metric definitions for details.

Browser privacy tools can block analytics requests. NFT Zone does not currently offer an analytics opt-out control within the site.

Connected accounts and third parties

Google and Discord provide sign-in and identity linking through OAuth. X / Twitter uses OAuth only to link an identity while you are signed in. Each provider processes authorization under its own privacy policy. You can manage or revoke authorization through the provider's account settings; doing so does not itself delete your NFT Zone account.

NFT Zone does not receive your provider password or retain provider access tokens as long-term account credentials. X linking temporarily stores a request-token secret during authorization. After a successful exchange, the application keeps the confirmed user identifier and username, not the access token or its secret.

NFT Zone uses third-party services for project information, images, fonts and icons. Loading external resources may send technical data, such as your IP address and browser information, to their providers.

Project, mint, checker and social links lead to third parties with their own data practices and risks. Their wallet requests and transactions are outside NFT Zone's control. Public blockchain records can remain visible independently of this website.

Data storage and security

Account and community information is stored in the service's database. Security measures include server-side sessions, protected token storage, access controls, CSRF checks and request limits. Administrative actions and technical problems can be recorded for investigation.

Monitoring is designed to remove secrets from captured diagnostics. When technical alerts are enabled, sanitized issue summaries can be sent to Telegram. These measures reduce risk, but no system can guarantee absolute security or uninterrupted availability.

Retention varies with the record's purpose and the service's operational settings. Expired security records have cleanup mechanisms. Signing out does not delete your account, submissions or other stored records. Backups and infrastructure logs may be kept separately.

A deletion request may require review of linked submissions, security records and technical limits. Removal from the active service does not necessarily remove every backup immediately or erase information held independently by third parties.

Data sharing

Approved project information is published through calendar listings, collection pages and public APIs. Reaction counts are public; aggregate Favorite counts are available through signed-in features. Your saved list, notes and personal statuses are provided through authenticated features, rather than published as calendar data.

Administrators can use account and submission information for support, moderation, security and administration. Hosting, email, analytics, authorization and other service providers process information needed to deliver their services.

Information may need to be disclosed in response to applicable legal requirements or to investigate abuse and protect the service. This policy does not cover information you provide directly to an external project or provider.

Your rights and choices

• Browse public pages without signing in, and choose whether to link additional identities.
• Review account information and use the available username edit control.
• Remove Favorites, clear notes or personal statuses, and remove a reaction by selecting it again.
• Export saved projects from Watchlist and manage browser cookies and local preferences.
• Sign out or manage authorization through your provider's account settings.

For access, correction or deletion requests, email [email protected]. You can also raise an objection or request a restriction where applicable. Rights depend on the law that applies to you; nothing in this policy removes mandatory rights, including the right to contact a relevant data protection authority where applicable.

There is no automatic Delete account or Disconnect identity control. We may need to verify that you control the account before acting on a request. Do not send passwords, private keys or session tokens. Requests are reviewed individually, taking account of applicable requirements and technical limits.

Contact and updates

Contact [email protected] about privacy or account data. Include your NFT Zone username or account number and a description of your request. Use email for sensitive matters rather than public community channels.

This policy may be updated as the service and its data practices change. The Last updated date identifies the latest revision.