Privacy Policy

This policy explains how LPX ("LPX", "we", "us") handles personal data on lpx.sh, in the public API and badges, in the X bot (@LiquidPoolX) and in the Telegram bot (@LiquidPoolX_Bot).

LPX is a small independent project. It decides how the data described here is used.

You can reach us through the Telegram group t.me/LiquidPoolX (opens in a new tab) or the X account @LiquidPoolX (opens in a new tab).

Visiting the site. Like every website, the servers that deliver LPX receive your IP address and your browser details (the user agent) with each request. On top of that:

• Visit count. Once per browser per day, the site sends the path of the first page you opened. The server turns your IP address and user agent into a short hash, using a secret salt that changes every day. We store the date, that hash and the path. The IP address itself is not stored, and the hash from one day cannot be matched to the hash from another day.
• Page-view and speed statistics. On the live site we load Web Analytics and Speed Insights from Vercel, our hosting provider. They are served from our own domain and record page views and loading performance. Vercel processes that data for us.
• Live data. Pages that show live launches or live market numbers make your browser connect directly to PumpPortal and to DexScreener. Those services receive your IP address, as any site you connect to does.
• Token images. Token images are fetched and re-encoded by our server, so your browser does not contact the hosts chosen by token creators.

Scanning a token. A scan stores the token address and the result: scores, checks and public on-chain facts. A scan record does not say who asked for it. The token and wallet addresses being checked are sent to our data providers (section 5) to fetch the data.

Security and rate limiting. To stop abuse we count requests per IP address. For page loads and most API reads, the count is held only in the memory of the running server and is not written to our database. For fresh scans, ratings and sign-in routes, the count is stored in our database under a salted hash of the IP address, never the raw address. For the Telegram bot the count is stored under the Telegram user ID and chat ID. These counters are cleared on a rolling basis once they are more than about an hour old.

Signing in with X. Sign-in uses the official X login. We ask X for read-only access (users.read and tweet.read) and use it for one request: reading your own profile. We store:

• your X user ID, username, display name and the address of your profile picture;
• when your LPX profile was created and when you last signed in;
• a hash of your session token, with its creation and expiry time.

The X access token is used once and then discarded. It is not stored. We cannot post, like, follow or send messages for you, and we do not receive your X password or email address. Your profile details are refreshed each time you sign in. Your profile picture is fetched from X by our server and passed to your browser.

Linking a wallet to a profile. You prove you control a wallet by signing a short text message. We check the signature and store the wallet address, the profile it is linked to and the time. A profile can hold up to five wallets. The signature is not stored. If a wallet moves from one profile to another, a log line with a shortened wallet address and the internal profile numbers is written.

Signing in with a wallet. You can also sign in with a wallet alone, again by signing a text message. We store the wallet address and a hash of your session token with its expiry time. Where a feature depends on what a wallet holds, we also store the public token balance we last read for that wallet and when we read it. A balance is read from the public blockchain, at most about every ten minutes while you use such a feature.

Ratings and feedback. When you rate a scan we store the rating, any feedback you write (up to 1,000 characters), the token or wallet the scan was about, the score and tier you were shown, the date and time, and a salted hash of your IP address. The hash is used to accept one rating per scan per day from the same network. It uses a fixed salt, so ratings from the same IP address can be recognised as coming from the same network over time. We do not store the IP address itself. Do not put personal information in feedback.

The Telegram bot. Telegram sends the bot the messages it is allowed to see, with the chat ID, message ID and your Telegram user ID. The bot reads the text to find a token address or ticker. The message text is not stored. We store:

• the ID of each update from Telegram, so a message is handled only once;
• when a scan has to wait: the chat ID, message ID, your Telegram user ID and the token asked about, until the answer is sent;
• if you connect a wallet with /link: your Telegram user ID next to that wallet address, your watchlist (your Telegram user ID and the tokens you watch) and what the bot last told you about each, so it does not repeat itself;
• in a group where the new-member guard is switched on: the time each new member joined, stored under the chat ID and Telegram user ID. During a member's first hours the bot can delete risky posts and ban the poster. These actions are logged with the Telegram user ID.

We do not store your Telegram username, name or phone number.

The X bot. When you mention @LiquidPoolX in a public post, we store the post ID, your X user ID and username, the text of the post (up to 500 characters), the token it asked about, our reply and the time. If you ask the bot to watch a token, we also store the post ID, the token, your X user ID and when the watch ends. To find the token, the bot may also read the post you replied to. That text is not stored. We use the stored record to answer once, to respect limits and to keep a record of what the bot said. Bot replies are public on X and are also reposted in our Telegram group. The repost contains our reply, not your username.

Contacting us. If you message us on Telegram or X, those platforms hold the messages under their own policies.

Cookies. LPX sets one cookie. lpx_xoauth is created when you start sign-in with X. It holds the signed security values needed to complete the login, is readable only by our server, is sent only to the sign-in routes, lasts at most 10 minutes and is deleted when sign-in finishes.

Browser storage. The site keeps a few items in your browser. They stay on your device, except the session tokens, which your browser sends to us to prove you are signed in.

• lpx_user: your profile session token after sign-in with X. Valid for 30 days.
• lpx_session: your wallet session token. Valid for 30 days.
• lpx_user_me and lpx_user_avatar: a short-lived copy of your profile and picture, kept for the browser tab so pages load faster.
• lpx-hit: the date your visit was last counted, so it is counted once a day.
• lpx:rated:…: a marker that you already rated a scan.
• lpx:following: the list of tokens you chose to follow. It is not sent to us.

Trackers. There are no advertising trackers and no advertising cookies on LPX, and the site does not load scripts from third-party domains. The only analytics are the visit count and the Vercel statistics described in section 2.

You can clear cookies and site storage in your browser at any time. Doing so signs you out.

Wallet addresses, token creations, trades and transfers are public. Anyone can read them on a blockchain. LPX reads, analyses and displays this data. It is not collected from you, and it is collected whether or not you ever visit LPX.

From this data we build and publish records such as:

• creator records: tokens a wallet created, on-chain events such as the creator selling, wallets linked by funding, and names or social links the creator published in a launchpad profile or in token details;
• wallet records: which wallets bought launches early and how those launches ended, as counts;
• launch analysis: early buyers of a token and the wallets that funded them.

We also keep data for a feature that compares public X posts by an account with trades of wallets attributed to that account. It holds the X handle, user ID and display name, post IDs, links and short excerpts of public posts, and the attributed wallets with the stated basis for each. Nothing from this feature is published at this time.

LPX does not identify who owns a wallet. A wallet address on its own does not tell us who you are. If you link a wallet to your profile, that link is used for your account and is not shown on public pages.

Disputes and review. If you think a record about a wallet, creator or account is wrong, or you want us to review how it is shown, contact us with the page address and your evidence. The steps are in section 5 of the Terms of Use. We can correct or annotate what LPX displays.

We cannot delete on-chain data. The blockchain is not ours and cannot be edited. Removing something from LPX does not remove it from the chain or from other sites.

We use these providers to run LPX. Each receives only what its role needs.

• Vercel: hosting, scheduled jobs, Web Analytics and Speed Insights. Every request to the site passes through Vercel.
• Neon: the Postgres database where the data in this policy is stored.
• Helius: blockchain RPC. Receives the token and wallet addresses we look up.
• DexScreener: market data. Receives token addresses from our server, and direct requests from your browser on pages with live market numbers.
• PumpPortal: the stream of new tokens and migrations. Your browser connects to it directly on live pages.
• Pump.fun API: public creator profiles. Receives creator wallet addresses.
• Jupiter: token lookups. Receives token addresses.
• X: sign-in, reading mentions of the bot and posting its replies.
• Telegram: the Bot API that delivers messages to and from the bot.

Token images and token details are also fetched by our server from the public hosts and IPFS gateways named by each token. Those requests come from our server, not from your browser.

These providers handle data under their own terms and privacy policies. Apart from them, we share personal data only if the law requires it or to protect the service and its users from abuse.

• We do not sell personal data.
• We do not show ads and do not use advertising trackers.
• We do not ask for or store seed phrases, private keys or passwords.
• We do not ask for your name, email address or phone number to use the service.
• We do not write raw IP addresses to our database.
• We do not store your X access token, and we cannot act on X for you.
• We do not ask you to sign transactions to sign in.
• We do not publish which wallets you linked to your LPX profile.

• Rate-limit counters in the database: cleared on a rolling basis once more than about an hour old. In-memory counters are short-lived and are lost when the server instance stops.
• Sign-in cookie: at most 10 minutes.
• Session tokens: valid for 30 days. Expired wallet sessions are deleted by a regular cleanup job. Expired profile sessions are deleted the next time you sign in. Signing out of your profile deletes that session on our server straight away. Signing out of a wallet-only session removes the token from your browser, and the stored hash expires within 30 days.
• Telegram link codes: valid for 10 minutes, then deleted.
• Telegram update IDs: deleted after about 3 days.
• Telegram scan queue entries: deleted when the answer is sent or the attempt is given up.
• Wallet links: until you unlink the wallet. Unlinking also ends that wallet's sessions.
• Telegram watchlist entries: until you remove them with /unwatch.
• Superseded scans of a token: deleted after 24 hours. The first and the latest scan of each token are kept.

The following have no automatic deletion date at this time and are kept until we remove them or you ask us to: your profile record (X user ID, username, display name, picture address), the last balance read for a wallet that signed in, the link between a Telegram user ID and a wallet, join times stored by the group guard, the daily visit count rows, ratings and feedback, and the X bot record of mentions and replies.

Records built from public blockchain data, such as scan results, creator events, wallet counts and outcome history, are kept as the long-term record the scoring is checked against.

We take reasonable steps to protect data. Examples: session tokens and link codes are stored only as hashes, IP addresses are hashed before they are stored, the site is served over HTTPS, and a strict content security policy limits what pages can load.

No system is perfectly secure, and we cannot promise that data will never be accessed, lost or misused. Session tokens are kept in your browser storage, so anyone with access to your browser profile could use them until they expire. Sign out on shared devices.

You can do these things yourself:

• Use the scanner without signing in.
• Sign out on your profile page. This deletes the profile session on our server.
• Unlink a wallet on your profile page.
• Remove tokens from your Telegram watchlist with /unwatch.
• Clear cookies and site storage in your browser.
• Remove the LPX app from the connected apps in your X settings.

You can ask us to do these things:

• tell you what account data we hold about you (access);
• correct account data that is wrong;
• delete your profile and the data tied to it, including linked wallets, sessions and a Telegram link. There is no delete button yet, so this is done on request;
• delete a rating or feedback you wrote, or the stored record of your mentions of the X bot;
• stop a particular use of your data, or review a public record you object to.

We will answer every request and act on it where we can. If we cannot, we will say why.

To make a request, contact us through the Telegram group t.me/LiquidPoolX (opens in a new tab) or the X account @LiquidPoolX (opens in a new tab). We may need to confirm that the account or wallet is yours, for example by asking you to sign in or sign a message. We will never ask for a seed phrase or private key to do this.

People in the European Economic Area, the United Kingdom, California and some other places may have additional rights under their local law. You can use the same contact channels to exercise them.

LPX is available worldwide. Our providers may process and store data in the United States and in other countries. Those countries may have data protection rules that differ from the rules where you live.

LPX is not for anyone under 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has signed in, contact us and we will remove the account data.

We may update this policy when the service or the way it handles data changes. The date at the top shows the latest version. Please check it from time to time.

Questions and requests about privacy: the Telegram group t.me/LiquidPoolX (opens in a new tab) or the X account @LiquidPoolX (opens in a new tab). Please do not post personal details in the public group. Say there that you have a privacy request, and then message an admin yourself. Admins never send the first direct message.