Draft for legal review before launch — not final legal copy.
What we collect
- Your itch.io profile (user id, username, avatar) when you log in.
- The list of games associated with your itch.io account, cached so we can show them to you.
- Wallet public keys: your personal itchpad wallet's address (created at signup) and each launch's deposit wallet address.
- Withdrawal records: destination address, amount, and transaction signature for every withdrawal you make from your itchpad wallet.
- Audit records of wallet- and launch-related actions (wallet generated, funds detected, launch executed, creator fees claimed, withdrawal executed) including your user id and IP address, for security and dispute-resolution purposes.
- If someone launches a token for your game before you've logged in (see "Anonymous launches" below), we scrape and cache publicly-visible metadata from your itch.io game page (title, cover image, description) — the same information itch.io itself displays publicly. We don't collect anything from that page that isn't already public.
Anonymous launches
Anyone can trigger a token launch for a public itch.io game page without logging in — see `docs/legal/terms.md`. When this happens before the real developer has an itchpad account, we generate a temporary custodial wallet (an "orphan wallet") to hold that game's fee share until claimed. When the matching itch.io account logs in, that wallet's balance is swept into the developer's own itchpad wallet automatically, and the orphan wallet's key is retired. We log the IP address of whoever triggered an anonymous launch, for abuse-prevention purposes, separately from any developer's own account data.
What we generate but never expose to you as plaintext
- Your personal itchpad wallet's private key, generated automatically the first time you log in, and each launch's deposit wallet private key, generated when you create a launch. Both are created inside our signer service, immediately encrypted (envelope encryption with a root key held only in the signer service's own secret storage), and stored only in encrypted form. The plaintext key exists only transiently, in server memory, during a specific signing operation you initiated (launching, claiming creator fees, or a withdrawal you requested), and is explicitly wiped from memory afterward. We do not provide any way to export either private key. Your personal itchpad wallet is where trading-fee revenue accumulates; withdraw SOL from it to any external address any time — see "What we don't collect" for why we can't do this without you asking.
What we don't collect
- We never ask for or store your itch.io password.
- We never move funds out of your itchpad wallet without a withdrawal request you explicitly submit.
Retention
- Account and launch records are retained for as long as your account is active plus a reasonable period for audit/legal purposes. [TODO: define exact retention period.]
Third parties
- itch.io (authentication), pump.fun (on-chain program, not a data processor of personal data), GeckoTerminal (public market data, queried server-side, no personal data sent), our Solana RPC provider, and Cloudflare (hosting).
Contact
[TODO: contact email once decided.]