Privacy

Short version: no accounts, no locations kept, IP addresses only as hashes for 7 days. If you choose to link X, we keep your X user ID and @handle.

Satoshi Passport and leaderboard

• Your passport cards are saved in your browser (localStorage).
• When you check in, your browser sends your location, a random device ID (created in your browser, not linked to your name) and the statue to our leaderboard server. The server only uses the location to check that you are within 150 m. Coordinates are not stored. We keep the statue, the time and a rough distance band such as “under 50 m”.
• If you add a nickname, it is shown publicly on the leaderboard and in the recent check-ins feed.
• The first time you use the leaderboard, cards already in your passport are added to it.
• Proof of Walk ranks are worked out from your GPS-verified cards. If you mine the Genesis Block (3 of the original 10), your nickname (or “Anonymous #…”) and the date are listed on the Full Node page.
• Your passport lives on this device. There's no password and no recovery code, and we don't ask for or keep a Lightning address for your passport. To move your passport to a new phone, link your X (below), then on the new phone tap “Lost your phone?” and sign in with the same X account. Your cards, rank and nickname move to the new device, and the old device no longer has them. When your passport moves, we keep a hashed ID of the old device and the time of the move for 30 days, so that device can tell you your passport moved. Anyone who can sign in to your X account can move your passport this way, so keep your X account secure. If you haven't linked X, your passport can't be restored after you clear your browser data or lose your phone. Restores are counted per network and per X account (as salted hashes, kept 1 day).
• Each Proof of Walk card (one per GPS-verified check-in) carries a random verify code (it isn’t linked to your device ID) and a QR code. Anyone who scans or types it sees only the statue, the date and the rank (plus your @handle with a blue ✓ Verified, only if you linked X): no nickname, no exact time, no location and no other cards. Shared and printed cards show your check-in date, time and verify code, because they’re on the card. Cards are drawn on your device’s screen; print files (including your @handle, if linked) are made in your browser and aren’t sent to anyone. Verify lookups are counted per network (as a salted hash, kept 1 day).
• Link your X (optional). Linking is optional, and you can undo it at any time by unlinking. If you tap “Link your X”, you sign in on X’s own page. Signing in happens on X, and X’s own privacy policy applies there. X then tells us your X user ID and @handle. We store only those two and the date you linked them, with your passport. We ask X only for permission to read your profile (“users.read” and “tweet.read”, which X requires for reading your handle). We never post, like, follow or send messages for you, and we don’t keep your X login: the one-time access key X gives us is used once to read your handle, then we ask X to cancel it, and it is never saved.
• An unfinished X sign-in expires after 10 minutes and is deleted within 20 minutes.
• Once linked, your @handle is shown publicly with a blue ✓ “Verified” on your cards (including saved, shared and printed card images), your card pages, the verify page for your cards, the leaderboards and the Full Node page. “Verified” means you signed in with that X account; it is not X’s own verification badge. One X account can be linked to one passport at a time; signing in with it on another device moves your whole passport there. If your handle changes on X, tap “Refresh handle”.
• To unlink, tap Unlink X on your passport, or email us (below). Unlinking deletes your X user ID, handle and link date from our server, along with any unfinished sign-in. Your cards stay; the handle and ✓ are removed from them and from your card pages, the verify page and the leaderboards. Card images you already saved, shared or printed can’t be changed, and apps or sites where you shared a card link may show their own saved preview for a while. Backups are covered under Deleting your data. You can also remove our access in X: Settings › Security and account access › Apps and sessions › Connected apps.
• Nicknames can’t start with “@” any more. An older “@” nickname is shown as “unverified” and is removed if the owner of that X account links it; the note telling you so is deleted after 30 days.
• IP addresses are only used for rate limiting. They are stored as a salted, per-day hash and deleted after 7 days.
• The server runs on Cloudflare Workers with a Cloudflare D1 database.

Analytics

We use GoatCounter for privacy-friendly page counts without cookies. A successful check-in also sends an anonymous “Check-in <statue>” event, without any location.

Satoshi Fountain giveaway and tips

• The giveaway runs at selected statues (Budapest, Lugano, El Zonte, Vienna, Buenos Aires). It only uses data when you take part.
• A GPS check-in at one of these statues creates a single-use code that is valid for 21 minutes. We store a hash of the code, your hashed device ID, the statue and the time, and delete it after 1 day.
• If you claim the giveaway, the Lightning address you enter is used once, to send that payout, and is not stored: not in our database, not in our logs, and not in a shortened or masked form. To send the payout, it goes to the wallet service behind your address and to our Lightning payment provider (see below). We keep the statue, the amount, the payout status, the time and a salted hash of the address, so each address can be used only once per statue, as our Terms and Official Rules say. The hash isn't your address and is never shown; we use it only to check for repeat claims, and we delete these hashes when the giveaway ends. Lightning addresses stored from earlier claims were deleted on 2026-11-02.
• No address is ever shown publicly. The statue’s recent activity list shows “a visitor”.
• Your IP address is used for daily limits as a salted, per-day hash and deleted after 7 days.
• Tips are sent from your own wallet straight to our Bitcoin tip address (the same one as on the map’s home page). We don’t store anything about tips.
• To send a payout, our server asks the wallet service behind your Lightning address for an invoice, and our Lightning payment provider pays it.

See the terms.

Deleting your data

Email support@satoshistatues.com with your leaderboard nickname (or the statue and rough time of your check-in) and we will delete your cards, nickname and your linked X account. Clearing your browser data removes your local passport and device ID.

Our database host keeps rolling backups for up to 30 days. Data you delete, including an unlinked X account, can remain in a backup until it rolls off, and we don’t restore deleted data to the site.

Last updated 2026-11-02.