Privacy Policy

1. The short version

This site runs no analytics, no advertising networks, no tracking pixels and no third-party tracking cookies. It has no user accounts with e-mail addresses or passwords. The only personal-adjacent data it ever processes is the public stake address of a wallet you actively connect, a display name and location you may choose to set, what you write in the members area (including questions to Ouro, the AI guide), what you play in the Ticker Arena while signed in, and what hosting inevitably sees (your IP address in standard server operation).

2. What is processed, and when

Just browsing: nothing beyond standard hosting logs, with two exceptions named here rather than left out. The site is served by Vercel, which processes IP addresses to deliver pages, as every web host does. This site's own API routes also keep a short-lived, in-memory count of requests per IP address to slow down automated abuse; that count is never written to a database and disappears within a minute. Opening the Ticker Arena and connecting a wallet on the Portfolio page also send an anonymous count to this site, with no identifier attached (see “Usage counts” below).

The two exceptions: the Cardano Constitution page loads the official text straight from raw.githubusercontent.com in your browser, so GitHub sees your IP address and the fact that you opened that page; and the Wallet Portfolio page loads the ADA rate directly from CoinGecko in the same way. Some pages also keep an answer in your browser's own localStorage for a few minutes to a day — the pool figures, the constitution text, the list of BRIAN's governance votes. That stays on your device, is never sent anywhere, and clearing site data removes it. If you switch the music on, the site keeps that choice and the playing position in your browser's sessionStorage until you close the tab, so the theme continues when you open another page here.

Wallet Portfolio: when you connect a wallet, your public stake address is sent to this site's own server, which looks up the address's public balances via the Koios API and, for token prices, via the DexHunter API. The address is used for the lookup and is not stored by this site. If the wallet holds NFTs whose artwork lives on IPFS, the preview pictures are fetched by this site's own server and passed on to you: your browser talks only to this site, and the IPFS gateway never sees your IP address or which NFTs you hold.

Members sign-in: your public stake address, a one-time login challenge and a session record (a random session id, an expiry, and the time the session was last used) are stored in this site's database for the duration of the session (up to 30 days, so you stay signed in on this device without confirming a new wallet signature each visit). That “last used” time is overwritten on every request and is what the members chat counts to tell you how many members are there right now — a number and nothing else: it never names anyone, and which page you opened and what you did there is neither asked for nor kept. Only the day itself is kept, as described under “Usage counts” below. Signing in includes agreeing to this Privacy Policy and the Terms of Use: the message your wallet signs names the version you accept (the date under the title of both pages), and that version and the time you signed are stored with your member record. When either page changes in substance, the version changes, and parts of the site that the new version covers — today the Ticker Arena's Live card — ask you to sign in once more before you use them. While a session is active, the site re-checks your delegation to the pool about once a day against public on-chain data; if the access condition is no longer met, the session ends. For the Node Insights card in the members area, the site also reads your public stake history (the stake active with each pool in recent epochs) via the Koios API, to add up the ADA you had active with BRIAN in each of the last 100 epochs (epochs with at least 10,000 ADA count) and compare the sum with 1,000,000; only that result (the sum and how many epochs count) is kept, in the server's memory for up to six hours, and never stored. The session id is kept in a strictly functional cookie (brian_session — HttpOnly, Secure, SameSite=Strict). If you sign in with more than one wallet account on the same device, a second strictly functional cookie (brian_accounts, same flags) keeps the session ids of up to four of them, so that when you switch accounts in your wallet the members area switches with it without asking for a new signature. Each of these sessions still ends on its own date, and nothing about them leaves your device except to this site. Signing out deletes the session server-side; the “Sign out” button ends every session this device remembers. A separate, persistent record links to your stake address alone (when you first sign in) and stores nothing beyond that address, an optional display name, an optional location you may set yourself on the Profile page and whether your NFTs show in the arena (“Incognito” unless you choose “Public”) — all entirely voluntary. A display name starting with “$” names an ADA Handle: that one is checked against public on-chain data when you save it, so it can only be a handle your own wallet holds. This record is what keeps your account when a session ends, so you can sign back in with the same wallet and find it as you left it. You can clear both fields at any time with “Delete profile” on the Profile page; your access stays, and comments or chat messages you have already written stay too, under the name they were written with.

Blog comments: a comment you post under a blog post in the members area is stored with the display name from your profile, its text, the post it belongs to and the time it was written, and is readable by every other signed-in member. Your stake address is stored with it so the operator can moderate, and is never shown to anyone. Each comment is also e-mailed to the operator so they can follow and answer from their mailbox — name, text and the post title only, never your address. Only the operator can delete a comment. Write nothing there you would not want other members to read.

Members chat: a message you post is stored with the display name from your profile, its text and the time it was written, and is readable by every other signed-in member. Your stake address is stored with it so the operator can moderate, and is never shown to anyone. Each message is also e-mailed to the operator so they can follow the room from their mailbox — name and text only, never your address, and there is no address of yours to send. The operator's reply comes back into the room as its text alone: no mail address, no subject line, no headers. Only the operator can delete a message, and a deleted message is gone for good. Write nothing there you would not want other members to read. Opening a name in the room shows the other members the month that member joined and nothing else from their profile — the location you may have set stays visible to you alone.

Governance votes and discussion: when you vote on a governance action in the members area, your choice is stored with your stake address and with the amount of ADA delegated from that address at the time (looked up once via the Koios API, so votes can be shown weighted by stake as well as by head count). The results are public in aggregate — counts and stake totals per choice, never who voted how. A comment you write in the discussion under a vote is handled exactly like a blog comment: stored with your display name, text and time, visible to signed-in members, e-mailed to the operator, and deletable only by the operator. The votes are advisory: they inform how BRIAN votes on chain, nothing is submitted on your behalf.

Community news, meetups and polls: announcements in the members area are written by the operator and visible to signed-in members. When you answer a poll under an announcement (for example which date or place suits you), your answer is stored with your stake address so you can change it until the poll closes. Members, the operator included, see only how many members chose each answer, never who chose what. Any member with a display name may also announce a meetup: its title, place, time and text are stored with your display name at the time and your stake address, and are visible to every signed-in member. The address is never shown; it lets you delete your meetup and the operator moderate. Each new meetup is e-mailed to the operator — name, title, place, time and text, never your address. “I'm going” is stored with your stake address; others see only how many are going. If you set a location on your Profile page, the site compares it on its server with each meetup's place to show the meetups near you first; your location is not shown to anyone and not stored with any meetup. A meetup and its answers are removed 30 days after its date, or earlier when you or the operator delete it; deleting an announcement deletes its answers.

Ticker Arena: as a guest, the game runs entirely in your browser and nothing about you is sent or stored; only the anonymous day counts described under “Usage counts” go to this site. Guests play with the standard minions; NFT minions are for signed-in members. Signed in, three things are stored with your stake address: the side you save (name, team, gear, pact, look, arena, whether it is offered to other members, a revision number and the time it was saved — the look may name an NFT collection whose license allows its tokens to dress your minions — only the collection id is stored; the pictures are derived once per token from the tokens' public images and not taken from your wallet; signed in, your wallet's public asset list is read (via the Koios API) when you open the line-up and before each match, to find which tokens of such a collection you hold — your minions wear only tokens your wallet holds; the list is held in memory for at most ten minutes and not stored; a token's picture is sent only to the wallet that holds it, or to a member meeting it on your side; only if you set “Your NFTs in the arena” to “Public” in your profile (stored with your account, “Incognito” by default), the numbers of those tokens go with your side to members who play your saved side and into live matches, so their screens show your tokens too and others can tell which tokens you hold; incognito, they see the standard minions, and your tokens show only in matches against the computer); a snapshot of your wallet level (level, points, epochs delegated to BRIAN, wallet age in epochs, epochs with BRIAN rewards, whether your voting power is delegated to a DRep), computed at most once a day from public on-chain data via the Koios API — delegation history, rewards, DRep delegation, ADA balance, native assets and transaction count, of which only that result is kept — and from the number of member votes you have cast; and every match you start, including matches against the computer or your own side (both sides as they were at the start, the arena, the computer's skill, the seed the server chose, the outcome and duration, the epoch and time). At the end of such a match your browser sends your inputs (keys and clicks per game tick); the server replays the match with them to confirm the result and keeps only the outcome, a checksum of the final state, the number of ticks and a few figures about the input rhythm (count, per minute, how regular) — the inputs themselves are not stored. A side you offer is shown to every other signed-in member with your display name and level; the list identifies it by a random id, never by your stake address or anything derived from it. A member who plays your side also receives the level snapshot behind it, which their browser uses only to resolve the pact. The epoch ladder shows every signed-in member your display name, level, matches played, wins and points; a member whose side you played sees your display name, the outcome and the duration in their own match list. Taking your side off the list removes it from the opponent list at once; matches already played stay. “Delete profile” leaves arena data in place — side, snapshot and matches then appear as “A member”; ask the operator if you want them removed.

Ticker Arena, Live (preview): Live is opt-in: nothing here happens until you open the Live card. While it is open and the page is visible, your browser tells this site every few seconds that you are in the live lobby, and the time of the latest such sign is stored with your saved side, replacing the previous one. For the next 20 seconds other signed-in members can find you by the start of your display name, see your level and challenge you; otherwise the lobby shows only numbers — how many members are waiting and how many are in the lobby. When you join the queue, challenge someone, open a code or accept one, this site keeps a room in its database: a random six-letter code, both stake addresses (never shown to anyone), each player's display name, level, the level snapshot behind it, sigil and colour, whether each pressed Ready, every pick of the pick phase, and when each of you was last seen. Your opponent sees your display name and level from the moment you are paired, every pick as it is made, and once the picks are done both chosen sides with your level snapshot. If the live connection then fails, your opponent may play your saved side once as an ordinary match within the hour, even if you do not offer it. A room that has ended is deleted about a day later by the site's daily clean-up; the match row it created stays in both players' match lists. Turning down an opponent who was found for you is counted from those rooms: three times in ten minutes mean a 60-second wait — turning down a challenge does not count. To play, the two browsers connect directly to each other (WebRTC): your opponent's browser sees your IP address, and so does a public STUN server that helps the two browsers find each other (Cloudflare, stun.cloudflare.com, with Google, stun.l.google.com, as a fallback). The connection details your browser sends for this (they contain IP addresses) pass through this site's database and are deleted as soon as both browsers are connected or the room ends, normally within a minute. While a match runs, each browser reports about every 30 seconds a tick number and a checksum of its own inputs, and whether you are away or have left, so that a reload can be checked and a forfeit decided; this is kept with the room and deleted with it. A live result counts on the epoch ladder for both players only when both browsers report the same end state, or as a forfeit. Voice in live matches is off unless you switch it on with the Voice button. Your browser asks for the microphone only then, and only on the arena page. Sound goes out and comes in only while both of you have Voice on, and stops when the match ends. It travels directly between the two browsers over the same encrypted connection as the game, never through this site's server, and this site does not record it — so a report about something said is the reporter's word. Your opponent could still record it on their own device.

Usage counts: so that the operator can see whether the site is used, the server keeps a few numbers per day and nothing else: how often the Ticker Arena is opened and how many games are started in it (by guests too), how long an arena visit lasts and how many games it has, and how often a wallet is connected on the Portfolio page. Your browser sends these counts without any identifier — no cookie, no wallet address, no stake address — and the server adds them to the day's totals without keeping who sent them. For signed-in members the site also keeps, for 90 days, the days on which you visited this site while signed in (one date per day with your stake address), so the operator can see how many members come back after a day, a week or a month; older days are deleted daily. Only the operator sees these numbers, and only as totals.

Reports and blocks: signed-in members can report a live or arena match they played, a chat message, a comment, a meetup or a member they met in the Ticker World (the report names that member's world id; this site looks up the wallet behind it). A report stores the reporting and the reported stake address, what was reported (its kind and internal reference), the reason picked and an optional note of up to 500 characters, and the time; the reported member is never told who reported them. When three different members report the same wallet within 14 days, that wallet is blocked automatically: its sessions end and it cannot sign in again until the operator lifts the block. The operator reviews every report and every automatic block. A blocked stake address stays stored with the time, who blocked it (automatically or the operator) and why, for as long as the block lasts; reports are kept with the decision taken on them. When a wallet signs in and at least one wallet is blocked, the site compares the wallet's public transaction list (via the Koios API) with those of the blocked wallets. If they appear in the same transactions, the operator sees a note naming the blocked wallet and how many transactions they share, and decides; nothing is blocked automatically by this. Only that result and the time of the check are stored, never the transactions themselves.

FAQ assistant: the question text you type is forwarded to Google Gemini to generate an answer, without any account or wallet information attached. Do not include personal data in questions.

Ouro, the AI guide of the Ticker World: when you ask Ouro a question in the members area, the question, the place in the world where you stand, your role (member, leader or operator) and Ouro's last two answers are sent to Anthropic PBC, which answers it with a Claude model. Your wallet address and your profile name are not sent. This site stores none of the questions or answers. It keeps only a count of your questions for the current day, to enforce the daily limit, and deletes it after two days, plus anonymous monthly totals of questions and costs. Do not enter personal data, seed phrases or passwords.

The Ticker World: the members area shows a shared world in which members walk as figures. To show who is where, your browser connects to a realtime service of this site that runs on Cloudflare Workers (Cloudflare, Inc.). It receives a short-lived entry ticket with a random world id (never your stake address), your display name, your role (member, leader or operator) and your avatar, and while you are in the world your position, what you say in the world chat, your gestures, whether your voice is on and whether your hand is raised. Others in the same place see your figure with these signs. The service keeps no database: the last 50 messages said in a place stay in that place's memory until the last member has left; everything else is gone when you leave. Muting or following a member is a setting only in your own browser; nobody learns of it.

Voice in the Ticker World is off until you switch it on. With “Voice” on you hear members near you who switched it on too; your browser asks for the microphone only when you switch on “Mic”. The sound travels encrypted and directly between the browsers (WebRTC), never through this site's servers, and this site does not record it. The closer someone stands, the louder you hear them; in a talk in the townhall only the speakers are heard. To connect, two browsers exchange connection details that contain IP addresses; the realtime service passes them on only between two members who may hear each other and does not store them. A browser you are connected to sees your IP address, and so does a public STUN server that helps the two browsers find each other (Cloudflare, stun.cloudflare.com, with Google, stun.l.google.com, as a fallback). Someone you talk to could still record it on their own device. Voice is open only to members who accepted this version of the Privacy Policy and Terms of Use.

Screen in the townhall: a leader or BRIAN can put a YouTube video or live stream on the screen above the stage in the Ticker World. Nothing is loaded from YouTube until you press “Watch the stream”. Only then does your browser load the player from YouTube's privacy-enhanced address www.youtube-nocookie.com; YouTube (Google) then receives your IP address and the usual browser information, and may store cookies or similar data once the video plays. A link to X on the screen opens X in a new tab, under X's own privacy policy.

Swap interface (Portfolio page): the swap widget is an embedded frame operated by DexHunter. Within that frame, DexHunter's own privacy policy applies — this site does not receive what you do inside it.

3. What is deliberately never collected

No private keys, no seed phrases, no transaction signatures for the Portfolio feature, no e-mail addresses, no behavioural profiles. The Members sign-in uses a data signature (CIP-8) solely to prove control of a stake address — it cannot move funds. The only name ever stored is one you choose to set yourself; it is never used for access, and it is checked against anything only in one case, an ADA Handle starting with “$”, which must belong to your own wallet. The name is shown to other signed-in members and to the operator only where you choose to write or play: next to a chat message, a blog comment or a governance comment, and in the Ticker Arena next to a side you offer, on the epoch ladder and in the match list of a member who played your side, and — only while your Live card is open — in the live lobby's name search, in a challenge you send, and to the member you are paired with. Your stake address is never shown there.

The sister site clinic-tools.net: the operator also runs clinic-tools.net, where the same delegation to BRIAN unlocks a read-only blog about medical technology. It is a separate site with its own sign-in, its own database and its own delegation check — neither site can create a session for the other, and following the link from the Members area signs you into nothing. Two things do cross, and only these: when you sign in on either site, that site asks the other whether it holds a newer display name and location for your stake address, and adopts it if so. Your public stake address is sent to make that lookup; nothing else about you is shared, and no message, post or wallet balance ever crosses. The exchange is protected by a secret shared between the two sites; if it is switched off, both sites simply keep their own values.

4. Third-party services

Data leaves this site only to the services named above and only for the purpose described: Koios (on-chain lookups), CoinGecko (ADA fiat rates — called directly by your browser), Google Gemini (FAQ answers), DexHunter (token prices via this site's server; the swap frame directly in your browser), the public IPFS gateways gateway.pinata.cloud, 4everland.io, w3s.link, nftstorage.link, ipfs.io and dweb.link (NFT pictures — requested by this site's server, not by your browser), Resend (carries chat messages and comments to the operator's mailbox and their replies back), GitHub (the Constitution page's official text, requested directly by your browser), Anthropic (the model that writes the blog posts and answers questions to Ouro, called by this site's server), the STUN servers of Cloudflare and Google (only in a live arena match or with voice in the Ticker World, as described above), Cloudflare Workers (the Ticker World's realtime service, as described above), YouTube / Google (the stream on the townhall screen — loaded by your browser only when you press play), the sister site clinic-tools.net (display name and location, as described above), and the hosting provider Vercel with its database provider Neon. Each operates under its own privacy policy. The blog posts are written by an AI model from public sources only — that process never reads any member data. The Keystone link under “How to Delegate” is an affiliate link: if you follow it, Keystone and its affiliate partner learn that you came from BRIAN; this site itself learns nothing about the click.

5. Your choices and rights

Everything beyond plain browsing is opt-in by action: nothing wallet-related happens until you connect or sign in, and signing out ends and deletes the session. Depending on where you live, data-protection law may give you rights of access, correction and deletion. Signing out deletes the session; “Delete profile” on the Profile page clears your display name and location and sets your NFTs back to “Incognito”. Comments, chat messages and votes you have written stay, under the name they were written with, and so do your arena side, level snapshot and matches, live ones included — ask the operator via the X (Twitter) link in the footer if you want them removed. The arena's live lobby is opt-in as well: you are findable only while its card is open.

6. Changes

This policy may be updated at any time; the current version is always the one published on this page.

Appendix: how the Wallet Portfolio works, step by step

The real code behind the Wallet Portfolio, in the order it runs. This project's repository is private, so instead of a source link, the actual code behind every step is reproduced and explained here - read it yourself rather than take our word for it. Each excerpt is copied unmodified from this site's own source files.

const api = await window.cardano[walletKey].enable();

const networkId = await api.getNetworkId();
if (networkId !== 1) {
  setStatus("This wallet is on a test network. Switch it to Cardano mainnet and try again.", true);
  return;
}

const rewardAddresses = await api.getRewardAddresses();

function rewardAddressHexToBech32(hex) {
  const bytes = hexToBytes(hex);
  if (bytes.length !== 29) throw new Error("Unexpected reward address length");
  if (bytes[0] !== 0xe1) throw new Error("Not a mainnet stake address");
  return bech32Encode("stake", bytes);
}

fetch(PORTFOLIO_PROXY_URL, {
  method: "POST",
  signal,
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ stake_address: stakeAddress }),
})

const KOIOS_ACCOUNT_INFO_URL = "https://api.koios.rest/api/v1/account_info";
const KOIOS_ACCOUNT_ASSETS_URL = "https://api.koios.rest/api/v1/account_assets";
const KOIOS_ASSET_INFO_URL = "https://api.koios.rest/api/v1/asset_info";

See also the Terms of Use.