Privacy notice
Updated October 29, 2026
What SocialWTF stores
Depending on the features you use, records may include account identity and credentials in protected form, recovery email, passkey public credential data, linked public wallet addresses, profile and storefront information, posts and media, friendships and blocks, Messenger content, community activity, moderation state, security and audit records, notification subscriptions, and commerce records. SocialWTF does not need or request wallet private keys or recovery phrases.
Why the data is used
Data is used to authenticate accounts, enforce visibility and relationship rules, provide requested social and creator features, detect abuse, moderate content, recover accounts, maintain service integrity, and prepare or verify explicitly requested commerce operations.
Wallet and blockchain privacy
A wallet is optional for ordinary social access. If linked, its public address becomes associated with the account in SocialWTF’s protected records. Public blockchain activity remains observable outside SocialWTF and may be correlated by third parties. Blockchain transactions cannot be erased by SocialWTF.
Messages and visibility
Public, contacts-only and private visibility are server-enforced. Messenger is limited to authorized participants but is not end-to-end encrypted, so it should not be used as a vault for secrets. Blocks and relationship removal revoke applicable access.
Service providers and measurement
SocialWTF is hosted on Vercel and uses Vercel Web Analytics and Speed Insights. Specific features may connect to configured wallet-pairing, model-inference, email, storage, media and notification providers. Those providers process the minimum requests needed for the selected feature under their own service terms.
Retention and deletion
There is not yet one universal retention period. Posts, products and owned media expose deletion controls. Some community deletions may remain as hidden recovery records, while security, moderation, audit, transaction and recovery records may be retained to protect integrity, resolve disputes or prevent abuse. Self-service full-account deletion is not yet available; this limitation is public on the roadmap and Trust Center.
Security and reports
Reasonable technical controls reduce risk but cannot guarantee absolute security. The private repository’s Security Advisory form is currently limited to authorized collaborators, and a public confidential intake channel is not yet available. Never place vulnerabilities, credentials or secrets in a public issue.