Verilot is a free, pre-launch product: a waitlist, and a free read-only diagnostic at /check. There are no accounts, no passwords, and no payments. This page describes what we actually collect today — checked line by line against the code that runs this site — rather than a template we intend to grow into later.
What we collect
Waitlist signup: the email address you type into the waitlist form (it appears on the landing page and on the scan result screen). Stored with it: the campaign tags that were in the URL you arrived with, if there were any (utm_source, utm_medium, utm_campaign, utm_content), so we know which channel is working, and which of two copy variants the page showed you — one letter, "a" or "b". We do not store your referring page, your IP address, or any browser fingerprint with the signup. The form also carries a hidden anti-spam field that must stay empty; whatever a bot types there is discarded and never stored.
Free scan (/check): the wallet addresses you paste in, plus the optional "analyze up to" date. Addresses are public on-chain data — the same information anyone can look up on a block explorer — and we read them to run the diagnostic. Running a scan necessarily means sending those addresses to the public chain-data services listed further down; that is how any tool reads a public blockchain. We never ask for private keys, seed phrases, or wallet-connect signatures, and the scan cannot move funds. Your addresses are not written into any database of ours — see retention below for exactly where they do and do not live.
Your IP address, for abuse control only: the scan and the save-a-result endpoint are rate limited, so the server holds your IP address in its own working memory to count recent requests within a one-hour window. It is not written to a database, not attached to your email or your scan results, and it is gone when that server instance is recycled.
Saved results (only if you ask for one): a scan normally lives in your browser and nowhere else — reload the page and it is gone. If you press "Save & get a shareable link" on the result screen, we store that one result so the link keeps working: the dollar figures and counts, the transaction hashes behind each flag, and shortened wallet addresses (0x1234…abcd). We do not store your full wallet addresses, and a saved result carries no email, no account, and no IP address. The link is unguessable, is marked noindex so search engines never list it, and anyone who has it can read the result — including the transaction hashes, which are public on-chain records that can be looked up on a block explorer. Share it accordingly. Saved results delete themselves 90 days after they are created, and the person who created one can delete it immediately from the confirmation panel.
Analytics: we use a cookie-less, privacy-respecting analytics provider (Plausible) to measure page views and conversion events. Analytics itself does not use cookies or collect personal identifiers, and does not track you across other sites. Separately from analytics, we set one first-party cookie — described in the next section.
The one cookie we set
Our landing page includes a mechanism for running single-variable copy experiments: each visitor is assigned one of two copy variants, and to keep that assignment consistent between visits we set a single first-party cookie named basis_v. It stores one letter ("a" or "b"), expires after 30 days, contains no personal information, and is not used to track you — on this site or anywhere else. At the moment the two variants contain identical copy, so the assignment has no visible effect; the cookie is what we use when an experiment is actually running. We set no third-party or advertising cookies.
What we do not collect
No names, postal addresses, or phone numbers. No payment card data — there is nothing to pay for yet. No private keys, seed phrases, or wallet-connect signatures. No accounts or passwords, because the product has none. No advertising or retargeting pixels, and no third-party trackers. We have never sold or shared personal information with a data broker or an advertiser, and we do not intend to.
Who else touches your data
Verilot is one person plus a small set of outside services. These are all of them:
Vercel — hosting. Every request to this site passes through it, including your IP address and the page or endpoint you asked for.
Supabase — the database that holds waitlist emails and saved results. Row-level security is on with no public policies, so only this site's server can read or write those tables; there is no anonymous access path.
Plausible Analytics — page views and conversion events. Per its published documentation it sets no cookies and stores no IP addresses.
Blockscout (eth.blockscout.com) — the public Ethereum block explorer API we read transaction history from. It receives the wallet addresses you submit, because that is the request being made on your behalf.
Public Ethereum RPC endpoints (eth.drpc.org, 1rpc.io) — used to read historical balances for the tie-out check. They receive a wallet address and a block number.
DefiLlama (coins.llama.fi) — daily USD price series. It receives token contract addresses and date ranges only, never your wallet addresses.
There is no email marketing platform, no CRM, and no ad network in this list because we use none. These providers operate internationally and may process data in the United States and elsewhere; we use them on their standard published terms and have not negotiated bespoke data-transfer agreements. If your firm needs specifics for a vendor review, email us and we will answer them directly.
How long we keep things
Waitlist email (with its campaign tags and copy variant): kept until the beta opens or you ask us to delete it, whichever comes first.
Wallet addresses from a scan: never written to our database. They live in the server's memory while the scan runs, and in a temporary snapshot file on that server instance's scratch disk so a repeat scan of the same address is fast. That scratch disk belongs to the instance, not to us: it is destroyed when the instance is recycled — typically minutes to hours later, and always when a new version of the site is deployed. It is never backed up and never exported. We are telling you the mechanism rather than quoting a number we cannot enforce.
A result you explicitly saved: 90 days from creation, then deleted automatically — expired links are removed from the database the moment anyone tries to open them. You can also delete it yourself at any time using the delete link shown when it was created.
Logs: Verilot's own code writes no log line containing your email, your wallet addresses, or your results; the only thing it logs on a hard failure is a truncated internal error message. Separately, our hosting provider automatically records short-lived request logs that can include your IP address and the path you requested. Those sit under the provider's own default retention for our plan (on the order of hours), we have not extended it, and we keep no copy of them anywhere.
To have your data deleted, email the address at the bottom of this page from the address you signed up with. We action deletion requests within a few business days and confirm when it is done. There is no account to log into and no fee.
Your rights — including US state privacy laws and the GDPR
The only personal information we hold is an email address you typed in yourself, with the campaign tags and copy variant recorded next to it. Everything else here is either public chain data or is not stored at all. That keeps this section short and honest.
Anyone, anywhere: ask us what we hold about you, ask us to correct it, or ask us to delete it. Email us and we will do it within a few business days.
California and other US state privacy laws: we do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are used in the CCPA/CPRA and comparable state laws. We do no profiling and no automated decision-making about you, and we collect no sensitive personal information. California residents can exercise access, correction, and deletion rights by emailing us, and we will not treat you differently for asking. We do not offer financial incentives for data.
EEA and UK (GDPR): the data controller is the operator described in the Legal Notice, reachable at the email below. Our legal bases are your consent for the waitlist email — withdraw it at any time by asking us to delete it, which does not affect processing already carried out — and legitimate interest for keeping the free scan available and free of abuse and for cookie-less aggregate analytics. You have the rights of access, rectification, erasure, restriction, objection, and portability, and you may lodge a complaint with your national supervisory authority.
Children: Verilot is not directed to children, and we do not knowingly collect information from anyone under 16. If a child's email reached our waitlist, tell us and we will delete it.
Security, and how to report a problem
What we do: we never ask for a key, a seed phrase, or a signature, so there is nothing in our database that can move your funds. The tables holding waitlist emails and saved results are locked to server-side access only. Scan results are signed server-side, so figures published on a shared result page cannot be forged. Scan and save endpoints are rate limited.
If you find a vulnerability, please email kzmttkc314@gmail.com with "SECURITY" in the subject line. The full reporting policy — what we ask of you, and what we commit to in return — is on the Legal Notice.
Who operates Verilot
Verilot is built and operated by one person: an individual proprietor (sole trader) established in Japan, trading as KIZUNA Creation, working in the open. There is no company, no team, and no investor behind it — where this site says "we," it is one person writing. See the Legal Notice for how operator disclosure is handled at this stage, and the Terms of Service for governing law and the limits of our liability.
Changes to this policy
When what we collect changes, this page changes with it and the date at the top moves. Material changes are posted here before they take effect. We do not have an email newsletter, so this page is the place to check.
Contact
Questions about this policy, or a data deletion request? Email kzmttkc314@gmail.com.