What we keep
From X, when you sign in: your account id, username, display name and profile picture link. No access token is stored and we never post, follow or act on X for you. From you: a hash of your recovery phrase, an optional sealed two-factor secret, saved withdrawal addresses, and the record of your deposits, sends and withdrawals.
From the game: your energy, streak, ZOLK balance, the chests you opened and what they held, the social tasks you claimed, the invite codes issued to you, and any whitelist card you hold.
Public X data we look up
Through a third-party service (twitterapi.io) we read public information about your X account: its age and follower count when you join, to keep out throwaway accounts, and whether you followed an account or reposted or replied to a post when you claim a social task. We send that service only your public X username and the account or post in question.
The whitelist
If you hold a whitelist card, your X username, your ZOLK handle, your card number and your Zcash receiving address are used to prepare the mint. A card's public page shows its number, tribe and holder's X username.
What we write to the Zcash chain
ZOLK keeps a public, permanent registry on the Zcash chain: for each whitelist card its number, the time it was found and an owner tag, which is a hash of your X account id, never your username or the id itself; and each day a Merkle root of every member's ZOLK, with the leaves (owner tag and balance) published on this site. Your owner tag is shown on your profile. Nothing else about you goes on the chain, and nothing on the chain can be deleted.
Sessions and security
Sign-in sessions are stored as hashes with the IP address and browser they were opened from, so you can see and revoke devices. Failed attempts are rate-limited. Privileged and game actions are written to an audit log.
What we do not do
We do not sell or share your data for advertising. We do not use third-party analytics or tracking.
Retention
Sessions expire after 30 days and rate-limit counters after two days. Wallet records are kept for as long as the account exists, as the record of your balance; game records for as long as the whitelist and mint need them.