Privacy
This is an inventory, not a template. Everything listed here was read out of the code that does it, and anything the site does not do is left out rather than promised away.
Who holds this data
Cookies
Three cookies, all set by this site, all httpOnly, secure and same-site. No script in your browser can read any of them, and none of them is an advertising or cross-site identifier. There are no others.
robindaos_session
Keeps you signed in after you sign a wallet message. The cookie holds a random token; the database stores only its SHA-256 hash, never the token itself.
7 days. Signing again rotates it rather than extending it.
robindaos_x_oauth
Single-use state for one attempt to link an X account. It carries the OAuth state and code verifier for that attempt and nothing else.
10 minutes, and the expiry is inside the signed value, so a captured cookie expires on the server too.
robindaos_device
A random device id used, hashed, as an abuse-control bucket for rate limiting. It carries no identity and is never joined to a wallet, an email or an X account.
180 days. A missing or tampered cookie is simply reissued.
The one third-party script
Cloudflare Turnstile is the only script this site loads from another company. It loads from challenges.cloudflare.com on the pages that carry an anti-abuse challenge, and not on the rest of the site.
When it runs, Cloudflare receives what any web request gives it: your IP address, your browser user agent, and the signals its own challenge collects. When the server checks the resulting token, it sends Cloudflare the site secret, the token, and your IP address again as the remote IP. Cloudflare's handling of that is governed by Cloudflare, not by us.
Our own use of your IP address is narrow: it is passed to that check, and it is hashed with a server-side secret to make rate-limit keys. The raw address is not written to a database, not put in an analytics event, and not kept.
What is stored when you use an account feature
Linking an X account
We store your numeric X account id, your handle at the time of linking, the scopes you granted, and the access and refresh tokens X issues. The tokens are stored encrypted at rest and are never returned to the browser or written to a log.
They are kept so the server can re-check the link with X before an action that depends on it. Unlinking marks the row unlinked and keeps it as an audit trail rather than deleting it.
Using the launchpad with a wallet
Your public wallet address and the signature that authorised the action are stored for launch drafts, comments and launchpad profiles, plus whatever you typed into them, such as a token name, description or display name.
Trades themselves are not ours to keep or remove: they are transactions on Robinhood Chain, public by design, and no request to us can erase them.
Signing in with a wallet
Signing in stores your public wallet address, a hash of the session token, and when that session was issued and expires. The signature proves you hold the key; it never moves funds, and we never see a private key or a seed phrase.
Waitlist and manager applications
If you submit the waitlist or a manager application, we store what you send: the kind of application, the email address or social handle you chose to give, and your written pitch. Contact details are held apart from the rest of the data and are masked even when the page shows them back to you.
Every submission also appends an audit entry holding ids and the application kind, no contact details.
Analytics
Today there is no analytics network call. The site's analytics adapter writes to a local development sink, so product events do not leave the page. There is no session replay, no fingerprinting, and no cross-site identifier.
The redaction rule that protects those events is enforced in code, not by convention: any property that looks like a wallet address, an email address, a thesis, or an amount is dropped before an adapter sees it. If a real analytics service is ever connected, this page changes on the same day.
How long things are kept, and how to ask for deletion
Sessions expire after 7 days, an X link attempt after 10 minutes, and the device cookie after 180 days. Rows you created (applications, launchpad drafts, comments, profiles, an X link) are kept until you ask for them to be removed and the request is worked through.
To ask, message @robindaosfun on X. Being honest about what happens next: the request is recorded, erasure is run by a person rather than by a button, and anything already written to Robinhood Chain cannot be erased by anyone.
See also the draft terms and the risk page.
Built independently on Robinhood Chain. robindaos.fun is not affiliated with or endorsed by Robinhood Markets, Inc. or its affiliates.