Privacy Policy
This explains exactly what Pylon Pools collects, why we collect it, who else can see it, how long we keep it, and how to have it deleted. It is written to be specific rather than broad — if something is not listed here, we are not collecting it.
Contents
- Who is responsible
- What we collect and why
- What we do not collect
- What is public
- On-chain data is permanent
- Cookies, local storage and analytics
- Who else processes your data
- Deleting your account and your data
- How long we keep things
- Your other rights
- Children
- Security
- International transfers
- Changes
- Contact
1Who is responsible
Pylon Pools ("Pylon", "we", "us") operates pylonpools.com and app.pylonpools.com and decides what data is collected there. For any question about your data, or to exercise any right in this policy, write to [email protected]. A human reads that address.
This policy covers our websites and the Pylon Pools application. It does not cover your wallet software, the Solana network itself, or any third-party site we link to.
2What we collect and why
All of it comes from you, except the technical data at the bottom of the table, which your browser sends when you use the site.
| What | Why we have it | Required? |
|---|---|---|
| Email address | Identifies your entries, lets you recover access to them, and is how we reach you about results, grading corrections and payouts. Also used to enforce the one-person-per-identity entry cap. | Yes, for walletless entry |
| Display name | Shown publicly on leaderboards and pick boards so entrants can find themselves. Choose something you are happy to have published. | Yes |
| X, Instagram or Telegram handle | An alternative way to reach you about a prize, and a way to satisfy any follow requirement on a promotional contest. | No — optional |
| Solana wallet address (connected) | Identifies a wallet-native entry. Where a pool or free-entry claim asks you to sign a message, we also record that the wallet was verified. Signing proves ownership only; it gives us no ability to move anything. | Yes, for wallet entry |
| Solana payout address | Where a prize is sent. We confirm it with you through a second channel before sending anything. | Needed to be paid |
| Your picks | They are the entry. Picks become public game by game once each game kicks off. | Yes |
| Payment records | The transaction signature, amount and paying wallet address of your entry payment, so we can confirm the entry is funded and reconcile the prize pool. Read from the public blockchain. | Yes, for paid entry |
| Invite code or NFT-snapshot record | If you entered free, which code you used or which holder snapshot you qualified under — so a code cannot be redeemed twice and free-entry caps can be enforced. A holder snapshot is a list of wallet addresses read from the public blockchain; it contains no names or emails. | Only for free entries |
| IP address | Rate limiting, abuse prevention and detecting multi-accounting. We use it to stop one person flooding a pool with identities. It is recorded in our event log alongside the action it relates to. | Automatic |
| Browser user-agent | Recorded in the same event log, to distinguish automated traffic from real people. | Automatic |
| Anti-bot signals | We use Cloudflare Turnstile on the entry form. Your browser sends Turnstile a token and Cloudflare tells us pass or fail. We store nothing from Turnstile — only the yes/no outcome is used, and it is not retained. | Automatic |
We rely on this data to run a contest you have asked to enter, to meet our commitments to other entrants (a fair cap is worthless if it cannot be enforced), and to keep the service from being overrun. Where the law where you live requires consent for something, we ask for it rather than assume it.
3What we do not collect
- No identity documents. We do not run KYC and do not ask for a passport, driving licence or date of birth document. We may ask you to confirm you are 18 or over.
- No payment card or bank details. Entries are paid in USDC on Solana. There is no card processor and no bank account of yours in our systems.
- No private keys, ever. We never ask for a seed phrase or a private key, and anyone who does is not us.
- No precise location. We do not request GPS or device location. An IP address implies a rough region; we do not resolve it to anything finer.
- No advertising or cross-site trackers. No Google Analytics, no Meta pixel, no ad networks, no data brokers.
- We do not sell your data and we do not share it for anyone else's marketing.
4What is public
Some of what you give us is published, because a transparent pool has to be readable by the people in it. Public on the leaderboard and pick boards are your display name, your entry ID, your picks (revealed game by game after each game kicks off), and your status — alive, eliminated, and in which leg.
Your email address is never published. Your IP address is never published. Social handles are published only where the contest's own rules require a public follow, and we say so on that contest's page.
We also publish aggregate integrity statistics about a pool — for example how large the biggest cluster of related entries is. These are computed from irreversible hashes and contain no address, handle or email.
5On-chain data is permanent
Entry payments and prize payouts are transactions on the Solana blockchain. They are public, permanent, and outside anyone's control — including ours. A wallet address, an amount and a timestamp recorded on-chain cannot be edited, hidden or deleted by us, by you, or by any regulator.
If you pay from or receive to a wallet that is publicly linked to your name elsewhere, that link exists on-chain whatever this policy says. Consider using a wallet you are comfortable having associated with a public contest.
6Cookies, local storage and analytics
We set no cookies. There is no advertising cookie, no tracking cookie and no consent banner because there is nothing to consent to on that front.
The site does use your browser's own local storage, which stays on your device and is never sent to us as a profile:
- Local storage holds the identifier and access token for your own entries, so you can return to the site and still be recognised as their owner without a password.
- Session storage holds a draft pick sheet while you are filling it in, and is cleared when you submit.
Clearing your browser storage will log you out of your entries. If you do that, contact us and we will re-link them to you.
Analytics. Our pages are served through Cloudflare, which provides privacy-focused aggregate web analytics — page views and performance, counted without cookies and without building a profile of you across sites. We use it to know whether pages load and whether people find them. We do not operate any other analytics.
7Who else processes your data
We keep the list of third parties deliberately short. Each one only gets what it needs to do its job.
| Who | What they do | What they see |
|---|---|---|
| Cloudflare | DNS, edge proxy and TLS for our domains; the Turnstile anti-bot check on the entry form; aggregate web analytics. | Your IP address and request metadata for every page you load, as any network provider would. For Turnstile, an anti-bot token. |
| Railway | Hosts the application and the storage volume the data described in section 2 is written to. | Everything stored, as our hosting provider. |
| Solana RPC providers (including public endpoints and Helius) | Read the blockchain on our behalf — confirming entry payments, reading the prize vault's balance for the funding proof, and taking NFT holder snapshots where a promotion is based on one. | The wallet addresses we look up. They do not receive your email, display name or picks. |
| Sports data feeds | Supply schedules, kickoff times and final scores. The feed a pool uses is named on that pool's page. | Nothing about you. We fetch public sports data; we send them no user data. |
| Email delivery | Sends results, grading notices and payout correspondence to the address on your entry. | Your email address and the contents of what we send you. |
We may also disclose data where we are legally required to, or where it is necessary to investigate abuse or fraud against a pool. If we are ever compelled to hand over user data we will tell the affected users unless we are prohibited from doing so.
8Deleting your account and your data
How to delete everything we hold about you.
Email [email protected] from the email address on your account, with the subject line "Delete my account". If you entered with a wallet rather than an email, sign a message from that wallet saying you want the account deleted and send us the signature, or contact us and we will tell you how.
We will confirm receipt within 5 business days and complete the deletion within 30 days. You do not have to give a reason, and asking costs you nothing.
What gets deleted
- Your email address, display name and any social handles.
- Your stored payout wallet address.
- Your entries and picks, or, where a pool's public record must remain intact, your entries are irreversibly detached from you and reduced to an anonymous entry ID with no identifier attached.
- Your IP address and user-agent in our event logs, insofar as they are linked to you.
- Your records in our rolling server snapshots, which are overwritten in the normal backup cycle within 48 hours of deletion.
- Your records in our offline backup copies (section 9), which we remove within the same 30 days.
What cannot be deleted, and why
- Anything on the Solana blockchain. Entry payments and payouts are public, permanent records on a network nobody controls. We cannot remove them and neither can anyone else. See section 5.
- The public result of a concluded pool. A pool's leaderboard is the proof that it was run honestly, and other entrants rely on it. Where deletion is requested we remove the personal identifiers and leave the anonymised result standing.
- A minimal abuse record where an account was disqualified for multi-accounting — enough to enforce the disqualification, and no more. We keep this for 12 months and then delete it.
Deleting your account ends your participation in any live pool. If you have a prize outstanding we will tell you before deleting anything, because we cannot pay a prize to an account we have erased.
9How long we keep things
- Entries, picks and results — kept for the life of the pool and afterwards as the public archive of that pool, which stays online. Personal identifiers within it are removed on request (section 8).
- Email address and contact details — kept while your account exists, and deleted on request.
- Event logs containing IP address and user-agent — retained for 24 months for abuse investigation, then deleted.
- Payment and payout records — retained for 7 years in case we need them for accounting or tax. The underlying blockchain records are permanent regardless.
- Server snapshots — the system takes rolling snapshots covering roughly the last 48 hours. Deleted data can persist in a snapshot until it rolls off, no longer than that.
- Offline backups — we also take periodic backup copies of each pool, including entrants' contact details and picks, and keep them on storage the operator controls, so a pool can be reconstructed if our hosting fails. They are kept for the same periods as the records they copy, and a deletion request removes you from them too.
- Turnstile results — not retained at all.
10Your other rights
Whatever jurisdiction you are in, we will honour these:
- Access — ask us for a copy of what we hold about you, and we will send it in a readable format.
- Correction — tell us something is wrong and we will fix it. A payout address is worth checking.
- Deletion — section 8.
- Portability — ask for your data as a machine-readable file.
- Objection — tell us to stop using your data for something, and we will unless we need it to run a pool you are in.
- Withdraw consent — for anything you consented to, at any time, without affecting what was lawful before.
- Complain — to us first, and to your local data protection authority if we do not resolve it.
We do not charge for any of this and we do not treat you differently for asking. Requests go to [email protected] and are answered within 30 days.
11Children
Pylon Pools is for adults. The service is not directed at anyone under 18 and we do not knowingly collect data from children. If we learn that an entry belongs to someone under 18 we will void the entry, refund any entry fee, and delete the data. If you believe a child has given us data, email [email protected] and we will act on it.
12Security
Traffic to the site is encrypted in transit. SOL Survivor entry access tokens are stored as irreversible hashes, not in a form we can read back. Administrative functions require a password; committing survivor results additionally requires a second factor, and grading requires a dry run that must match before anything is committed. Bulk reads of contact data are logged. Access to stored data is limited to the people who run the pools.
No system is perfectly secure and we will not pretend otherwise. If a breach affects your personal data, we will tell affected users and the relevant authority without undue delay, and we will say what happened rather than issue a statement about how seriously we take security.
If you find a vulnerability, please report it to [email protected] before disclosing it publicly. We will not pursue anyone who reports a genuine issue in good faith.
13International transfers
Our hosting and network providers operate globally, so data may be stored or processed in a country other than yours. Where we transfer personal data internationally we rely on our providers' standard contractual protections. If you want to know where a specific piece of your data sits, ask us.
14Changes
If we change this policy, the "last updated" date changes. If a change materially affects how we use data we already hold about you, we will tell you by email before it takes effect, not after.
15Contact
Every request in this policy goes to the same place: [email protected]. Use email rather than social media for privacy and deletion requests so there is a record on both sides.
© 2026 Pylon Pools · We do not sell your data · No advertising trackers · No cookies
Terms of Service · [email protected]