Privacy Policy

This is what Hyperbukit LLC (“we”) collects when you use hyperbukit.com, why, who else touches it, and how to get it removed. We do not sell personal data and we run no advertising trackers.

1. What we store

• Email accounts: your email address and a salted hash of your password (never the password itself), whether the address has been verified, and a linked wallet address if you link one.
• Wallets: the public address of any wallet you connect. We never see or store a private key or seed phrase.
• Bucket lists: goal titles, done/not-done, and for completed goals any notes and picture links you add, with their private/public setting.
• Events you host: title, dates, location, capacity, details, video and chat links, and whether the event is public or link-only.
• Reservations: which email or wallet reserved which event, the party size, the spot number and the ticket code.
• Donations: the Stripe session id, amount, currency, and the email address Stripe reports. Card details never reach us.
• Deposits: the wallet address, amount and Solana transaction signature of each Bukit purchase.
• Technical logs: IP address, browser and error reports, kept by our hosting and error-monitoring providers for a limited time.
• In your browser: a session cookie (httpOnly, 30 days), and localStorage entries such as whether you have seen the tour and a cached copy of your own ticket code.

2. Why

To run the service: sign you in, show your list, issue and verify tickets, let hosts run their door, record deposits and donations, send you the emails you asked for (welcome, verification, password reset), and find and fix errors and abuse. Nothing else.

3. Who can see what

• Goal titles on a wallet list are visible to anyone who knows the wallet address, like everything on a public blockchain. Email-account lists are private.
• Notes and pictures are private unless you make an item public; public items appear in Suggested with your identity masked.
• A host sees the attendee list for their own event: masked email or wallet, party size, spot number.
• Anything you do on Solana — deposits, event bucket activity — is public on the blockchain by design and cannot be deleted by us.

4. Who processes it for us

• Vercel — hosting and request logs.
• Neon — the database.
• Resend — sends account emails (welcome, verification, password reset).
• Stripe — processes card and Apple Pay donations; Stripe’s privacy policy covers the payment itself.
• Sentry — error reports, with secrets and connection strings scrubbed before they leave our servers.
• Solana RPC providers (such as Helius) — read blockchain state; they see the addresses we look up.

These providers process data on our behalf and under their own security terms. We do not share your data with anyone else except when the law requires it.

5. How long, and how to delete it

We keep account data while the account exists, reservations until the event has passed and the host no longer needs the list, and deposit and donation records for as long as tax and accounting rules require. Email Outreach@hyperbukit.com from the address on the account (or with a signed message from the wallet) and we will delete your account, list and reservations. Blockchain records cannot be deleted.

6. Children

The site is not directed at children under 13 and we do not knowingly collect their data. Token features require you to be 18 or older.

7. Changes

If this policy changes, the date at the top changes with it, and significant changes will be called out on the site. Questions go to Outreach@hyperbukit.com.