By using XPOT, you agree to the collection and use of information in accordance with this Policy.

1. Information we collect

a) Information from your X account

When you log in with X, we may receive:

• Your X user ID and handle (@username)
• Display name and profile image
• Basic profile information provided by X’s API
• Any other data that X’s API returns under the permissions you grant (such as read-level access)

We do not receive your X password.

b) On-chain and wallet information

When you connect a wallet or when we analyse a draw, we may process:

• Public wallet addresses
• Token balances relevant to a draw
• On-chain transactions made to or from those addresses

This data is public on the blockchain, but we process and display it in XPOT (for example, to show eligibility, entries or winners).

c) Usage and technical data

We may automatically collect:

• Log data (IP address, browser type, device information, pages visited)
• Timestamps and basic interaction events
• Cookies or similar technologies to remember your session and preferences

We use this to keep the Service secure and improve the experience.

2. How we use your information

We use the information we collect to:

• Authenticate you via X and maintain your session
• Determine eligibility and ticket entries for XPOT prize draws
• Display draw results and provide transparency (for example, linking winning tickets to X handles or wallet addresses)
• Monitor the Service for abuse, bots or suspicious activity
• Improve, maintain and debug the Service
• Communicate with you about updates, issues or important changes

We may also use aggregated, anonymised data for analytics and reporting that cannot reasonably identify you.

3. Legal bases

Where required by law, we process your personal data based on:

• Your consent (for example, when you connect your X account)
• Our legitimate interest in operating and improving XPOT, ensuring transparency of draws and preventing abuse
• Compliance with legal obligations, where applicable

4. Cookies and similar technologies

XPOT may use cookies and local storage to keep you logged in, remember preferences and collect basic usage analytics.

You can usually control cookies through your browser settings, but disabling them may affect how the Service works.

5. Sharing of information

We may share information:

• With service providers who help us operate XPOT (hosting, analytics and infrastructure), under appropriate confidentiality obligations
• When required by law, regulation or legal process
• To investigate or respond to suspected fraud, security issues or abuse
• In connection with a merger, acquisition or other business transfer, in which case we will seek to ensure similar protections for your data

We do not sell your personal data to third parties. Because blockchain data is public by design, some information (wallet addresses, transactions, token balances) is inherently visible to anyone on the network.

6. Data retention

We retain personal data only as long as necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law.

Blockchain data itself is not controlled or deletable by XPOT.

7. Your rights

Depending on your jurisdiction, you may have certain rights over your personal data, such as:

• Access to the information we hold about you
• Correction of inaccurate information
• Deletion of certain data
• Restriction or objection to some processing
• Portability of data in a structured, machine-readable format

To exercise these rights, contact us using the details below. We may need to verify your identity before responding.

8. Security

We use reasonable technical and organisational measures to protect the information we process. However, no system is completely secure and we cannot guarantee absolute security.

You are responsible for keeping your wallet credentials and any private keys safe. XPOT will never ask you for your private key or seed phrase.

9. Children

XPOT is not intended for use by children under 18. We do not knowingly collect personal data from children under 18. If you believe a child has used XPOT, please contact us so we can delete any relevant information.

10. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top. Your continued use of XPOT after changes take effect means you accept the revised Policy.

11. Contact

If you have questions or requests relating to this Privacy Policy, you can contact us at privacy@xpot.bet.