Privacy Policy

This is what Hyperbukit LLC (“we”) collects when you use hyperbukit.com, why, who else touches it, and how to get it removed. We do not sell personal data to anyone, and what you give us stays private unless you have chosen to make it public. We run no advertising trackers.

1. What we store

• Email accounts: your email address and a salted hash of your password (never the password itself), whether the address has been verified, and a linked wallet address if you link one.
• Wallets: the public address of any wallet you connect. We never see or store a private key or seed phrase.
• Profile: a handle, and whatever else you fill in — display name, bio, a town or city, an avatar. The town is also geocoded to coordinates so events can be sorted by distance from you; the coordinates are never shown to anyone.
• Phone number, if you add one to your profile: only you can see it. It is never shown on your public page, in people search, or to a host. We do not text or call it — it exists so you can be reached if something goes wrong at an event.
• Bucket lists: goal titles, done/not-done, and whatever you add to a goal — a description, steps, notes and pictures — each with its private/public setting.
• Photos: the image file itself, on Cloudflare R2, plus the goal or event it belongs to. Photos are resized in your browser before they are sent, which re-encodes them and drops the camera metadata, including GPS coordinates.
• Events you host: title, dates, location (and its coordinates), capacity, details, video and chat links, your event FAQ, photos, and whether the event is public or link-only. Also who you added as a co-host.
• Reservations: which email or wallet reserved which event, the party size, the spot number, the ticket code and, once you arrive, the time each seat was checked in.
• Card tickets: the amounts, the Stripe identifiers for the checkout, payment, saved card and any refund, the email the receipt went to, and any discount or referral code used. Card numbers never reach us.
• Host payouts: if you connect Stripe to be paid, your Stripe account id and whether Stripe has enabled charges and payouts for you. Your bank details, identity documents and tax information stay at Stripe; we never see them.
• Support payments (card / Apple Pay): the Stripe payment id, amount, currency, and the account email. Card details never reach us.
• Deposits: the wallet address, amount and Solana transaction signature of each Bukit purchase.
• Redemptions: what you redeemed, how many, the size or other choice you picked, the amount of Bukit burned and the Solana signature of the burn, and either the postal address you gave us or the event you chose to collect at. Your email address is stored with the order so we can send the receipt and tell you when it goes out.
• Rewards: a ledger row for each BUKIT reward earned (0.1 per action, or a referral credit’s value on a trip Hyperbukit hosts) — what earned it, when, and the wallet and transaction that paid it.
• Comments: what you wrote, when, and the wallet or email address you were signed in with — the address is stored as the key to who wrote it, never as a label. Readers see your @handle if you have a profile, and a shortened wallet or a masked email (m***@your.email) if you do not; your full address is never sent to anyone’s browser.
• Who follows whom.
• Who you have blocked, and what you have reported: each report’s reason, any note you added, a copy of the words you reported, and who sent it.
• Technical logs: IP address, browser and error reports, kept by our hosting and error-monitoring providers for a limited time.
• In your browser: a session cookie (httpOnly, 30 days for an email account, 7 days for a wallet), and localStorage, which holds your signed-in email address, your theme choice, whether you have seen each tour, any half-written event you have not posted yet, and a cached copy of your own ticket codes. A referral code you arrived with is kept for the tab only. We set no tracking or advertising cookies, so there is nothing for a Do Not Track signal to switch off.

2. Why

To run the service: sign you in, show your list, suggest events near you, issue and verify tickets, take payment and pay hosts, let hosts and their co-hosts run the door, record deposits and rewards, send out what you redeem, send you the emails the site owes you, and find and fix errors and abuse. Nothing else — no advertising, no profiling, and nothing sold to anyone.

3. Who can see what

• Goal titles on a wallet list are visible to anyone who knows the wallet address, like everything on a public blockchain. Email-account lists are private.
• A goal’s description, steps, notes and pictures are private unless you make the item public; public items appear in Suggested with your identity masked, and each picture keeps its own switch.
• Your profile page — handle, display name, bio, town, avatar, follower counts, your public goals and the events you host — is visible to anyone with the link. It never shows your email, wallet, phone or coordinates. People search is on by default and you can switch it off on the Account page; that takes you out of search, but the page stays reachable by its link.
• You get a profile the first time you use the site in a way that needs one — including reserving a seat at an event. If you would rather not be findable, switch search off.
• A host, and any co-host they add, can download the attendee list for their own event. It is NOT masked: it carries the email address or wallet of everyone who reserved, their party size, and their arrival times. Scanning a ticket at the door shows a masked address instead. Co-hosts are told nothing about each other.
• Photos on an event are public with the event, including on a link-only one. They have no separate private setting; the host or a co-host can delete them.
• A photo you have marked private is left out of what the site serves, but the file itself sits at an unguessable public address, so anyone you give that address to can open it.
• Comments are as visible as the thing they hang off: on a public event or a public goal anyone can read them, and on a link-only event only the host, their co-hosts and seat holders can. Making a goal private hides its comments from everyone, you included — they are not deleted, and they come back if you make it public again.
• A named handful of Hyperbukit staff can moderate profiles. They see the profile fields — handle, display name, bio, avatar — together with the email address or wallet behind the profile, and they can take it out of people search or clear the avatar or the bio. They also read what people report, with the identity of whoever sent it and whoever it is about, and can remove a reported comment. That access exists for moderation and is used for nothing else.
• A block is never shown to the person you blocked, and a report never tells the person it is about who sent it.
• A shipping address you give the Redemption Center is visible to that same handful of staff, on the admin screen where orders are packed, together with your wallet, your email and what you ordered. It is never shown to hosts or to other users, never appears on your profile, and is used for nothing but sending that parcel. We post it ourselves, so no courier account or outside fulfilment service is given your address.
• Anything you do on Solana — deposits, event bucket activity — is public on the blockchain by design and cannot be deleted by us.

4. Who processes it for us

• Vercel — hosting and request logs.
• Neon — the database.
• Cloudflare — stores the photos you upload and serves them from our media hostname.
• Resend — sends our email: welcome, verification and password reset, your tickets and their QR codes, co-host invitations, notices about an event you booked (it filled, it was canceled, your card needs confirming, your seat was released), and your redemption receipts.
• Stripe — processes card and Apple Pay payments, both tickets and support payments, and pays hosts through Stripe Connect; Stripe’s privacy policy covers the payment itself.
• Anthropic — suggests steps for a goal. It is sent the goal title only, with nothing that identifies you, and only when you ask for suggestions.
• OpenStreetMap (Nominatim) — turns a town, the place you give a goal (private ones too, for your own map) or an event address into coordinates. It sees the place name, not who asked.
• Sentry — error reports, with secrets and connection strings scrubbed before they leave our servers.
• Solana RPC providers (such as Helius) — read blockchain state; they see the addresses we look up.

These providers process data on our behalf and under their own security terms. We do not share your data with anyone else except when the law requires it. They store it in the United States; if you use the site from elsewhere, your data is transferred there.

We protect what we hold with encryption in transit, hashed passwords and access limited to the few staff who need it. No system is perfectly secure; if a breach affects your data, we will tell you.

5. How long, and how to delete it

We keep what is listed above for as long as the account exists, and we keep payment and deposit records for as long as tax and accounting rules require us to. Reservations and tickets are kept after an event as the record of what happened, and a redemption — the shipping address included — is kept as the record of an order we fulfilled and of a burn that cannot be undone. We have not set an automatic deletion schedule, and we would rather say so than state a period we do not actually enforce; when we set one, this section will say what it is and the date at the top will change.

You can delete your account yourself, at any time: Account → Sign-in → Delete account, on the site and in the iPhone app. You confirm it with your password, or by signing with your wallet. It happens at once and cannot be undone. What goes: your sign-in, your profile (its photo, phone number and follows), your bucket list with its photos and the comments on it, your free reservations for events that have not happened yet, and BUKIT you earned that has not been paid out, along with the reports you sent and the people you blocked. Comments you left on other people’s events and goals stay, with your name taken off. If a wallet is linked to the account, its list and profile go too. What is kept, for the reasons above: paid tickets and their receipts, reservations for events that have already happened, events you hosted, payment, deposit and redemption records, and BUKIT already paid out — no longer under your email address, so whoever signs up with it later sees none of them. Tickets you were mailed still work at the door. While you still host an event that is open, or one still to come, close it or call it off first — its guests need a host to answer to — and a card reservation that would be charged if its event fills has to be refunded, or the event over, first.

You can also delete parts of it at any time: a goal, a photo, your phone number, a co-host, who you follow. You can ask, at Outreach@hyperbukit.com, for a copy of what we hold about you, and we will send it within 30 days; wherever you live, you can ask us to see, correct or delete your data. Deleting your account does not remove a copy of an attendee list a host already downloaded — ask the host for that. Two things we cannot remove: anything recorded on the Solana blockchain, which is public and permanent by design, and payment records Stripe keeps under its own obligations.

6. Children

The site is not directed at children under 13 and we do not knowingly collect their data. Token features require you to be 18 or older. A parent who believes we hold a child’s data can email Outreach@hyperbukit.com and we will delete it.

7. Changes

If this policy changes, the date at the top changes with it. A significant change takes effect 14 days after that date and is called out on the site. Questions go to Outreach@hyperbukit.com.