Privacy
Playing the game on its own stores nothing about you outside your browser, apart from the anonymous error and usage reports described below. The weekly league stores your wallet address and your runs. There are no ads, no third-party analytics and no tracking cookies.
Who is responsible
The WELON team runs the site and decides what is done with your data. Contact: warioelonsol@gmail.com.
What we collect
Playing without the league
Your browser keeps two small items in its local storage: w1t.best, your best score on this device with the initials you typed, and w1t.ach, the secrets you have found. They stay on your device and are never sent to us. The pages set no cookies, use no session storage and load no analytics, ad or tracking code. The fonts, scripts and pictures come from this site itself.
Like any website, the host that serves the pages sees the address and details of each request. See Netlify below.
Error and usage reports
To find and fix bugs, each page of welon.lol sends short reports to our own server: errors and files that failed to load, how fast the page loaded and how smoothly the game ran, which page you opened and which site sent you, and when a run starts and ends with its score. A report carries a random number that is new each time a page loads, your screen size and your browser's user-agent string. Our server adds the country that Cloudflare derives from your connection. It does not store your IP address; it keeps a one-way hash of it, with a key that changes every day, only to limit abuse. No cookie or browser storage is used, nothing is shared with third parties, and reports are deleted after 30 days.
The league
When you sign in and play in the league, the server stores:
- Your wallet address, with the first and last time we saw it.
- Your sign-in. A one-time number and the details of the sign-in request (the site, the time and your address), which expire after 5 minutes, and a session: a random token held in your browser, of which only a scrambled copy (a hash) is stored, with your wallet address, the start and last-seen times and how you signed in.
- Hold checks. Your $WELON balance, the price used, the dollar value, the result and the time.
- Your runs. The seed, the start and finish times, your claimed score, the score our replay produced, the recorded button presses of the run, the result of the check, the reason if it was rejected, and the points it earned, with the feats the replay saw.
- Your standing. Weekly points, and for each closed week your rank, points, best score, the value of your hold at the close, your share and the amount due, and any flags set for review.
- Where your wallet's money first came from. For wallets in the top 100 at a weekly close, the server looks up on the public blockchain which address first funded the wallet, and when, and stores that. We use it only to spot groups of wallets that look like one player.
- Payout records. The transaction and time, once a person has sent a payout.
Your IP address is not saved in the league database. It is used in four ways:
- To limit how fast one address can ask for sign-ins and runs. These counters are held in a cache and expire on their own, within about an hour.
- It is passed to Cloudflare Turnstile, the bot check at sign-in.
- Cloudflare works out your country from it. We read only that country code, to apply the country block.
- The web server in front of the league (Caddy) writes an access log that, in its standard form, includes the visitor's address and the page asked for. Our own application logs record the request type, the route, the status and the time taken, and replace any IP field with a placeholder.
The public weekly board
The board shows each ranked wallet as its first four and last four characters, for example 7xKX…9fQz, with its weekly points and its best score. A run still being checked is listed under Verifying in the same shortened form, with its claimed score. We show no names. Anyone can also load the board of a past week. Wallets are public on the blockchain, so someone who knows an address can find it on the board, and someone who sees a shortened address can often work out the rest.
Cookies
The site itself sets none. After you sign in to the league, the league server sets one cookie, __Host-melon_session, to keep you signed in. It is HttpOnly, Secure and SameSite=Lax, it lasts at most 7 days and it stops working after 24 hours without use. Signing out deletes it. Cloudflare, which sits in front of the league server, may set its own security cookies. There are no advertising or tracking cookies.
Who else receives data
- Netlify hosts this website and sees the usual details of every visit, such as the IP address and the page asked for.
- Cloudflare is the proxy in front of the league server and runs Turnstile, the bot check at sign-in, which loads a script from Cloudflare's servers. It sees the league traffic, including IP addresses.
- Hetzner hosts the website (Ashburn, Virginia, USA) and the league server and its database (Falkenstein, Germany).
- Solana RPC provider: Helius. It receives your wallet address and the token's address to read balances and funding history.
- Jupiter gives us the token price. We send it only the token's address, which is not personal data.
- Sentry is not used. The league server's error reports stay in its own logs.
- Links you choose to click, such as opening the game in Phantom or sharing your score on X, take you to those services, which have their own policies.
Some of these providers process data outside the EU, including in the USA. Where they do, we rely on the data protection terms those providers offer for international transfers.
The blockchain is public and permanent
Your wallet, its balance and its transfers, including any payout we send you, are recorded on a public blockchain. We do not control it and cannot erase or change what is on it.
How long we keep it
| Data | Kept |
|---|---|
| Sign-in numbers | 5 minutes, then deleted |
| Sessions | 7 days at most, 24 hours idle |
| Rate-limit counters (IP address) | About an hour at most |
| Hold check records | 8 days |
| Hold checks made at a weekly close | 180 days |
| Price samples (not personal) | 8 days |
| Runs, points, closed weeks, wallet records, flags and payout records | Up to 24 months after the week they belong to; payout records as long as accounting rules require. |
| Web server access log | Rotated out by size, and not kept longer than needed to investigate abuse. |
| Error and usage reports | 30 days |
| Web server access log for welon.lol | 30 days, with no visitor IP address |
Where the law requires us to keep a record, for example of a payout, we keep it as long as it requires.
Why we use it
We use this data to run the league (checking you hold enough, verifying runs, ranking and paying), to keep it fair and the service secure (rate limits, flags, bot checks, the country block), and to meet legal duties. Our legal bases under the GDPR are the contract with you when you join the league (Art. 6(1)(b): checking your hold, verifying runs, ranking and paying), our legitimate interest in a fair and secure service (Art. 6(1)(f): rate limits, flags, bot checks, error and usage reports and the country block), and legal obligations where they apply (Art. 6(1)(c)).
Your rights
The server is in the EU, so we follow the GDPR. You can ask us to:
- tell you what we hold about your wallet, and give you a copy;
- correct it;
- delete the off-chain league data tied to your wallet, which means your sign-ins, runs, points and standing. This ends your place in the league, and we may keep what the law requires;
- limit or object to how we use it.
To ask, write to warioelonsol@gmail.com with your wallet address. We may ask you to sign a short message with that wallet to show it is yours. We aim to answer within one month. You can also complain to your local data protection authority.
Children
The league is for people who are 18 or older. We do not knowingly collect data from anyone younger.
Changes
If this notice changes, the date at the top changes too. See also the Terms and the League rules.