Privacy policy
Last updated 2026-09-10. Draft pending legal review.
What we collect
- Your wallet address and sign-in signatures.
- When you connect X or TikTok: your account id, handle, follower count, post count, account creation date, and the access tokens needed to read your own posts and their metrics.
- Post ids, the markers they matched, and metric snapshots for posts in campaigns you joined.
- Standard server logs (IP address, user agent, timestamps).
What we do not collect
Passwords, private keys, your full timeline, or post content beyond what is needed to review a campaign post.
How we use it
To run campaigns, compute settlements, detect fraud, pay creators, and publish campaign receipts. Receipts include wallet addresses and post ids; they do not include tokens or private data.
Storage and security
Access tokens are encrypted at rest with a key held outside the database. Tokens are deleted when you disconnect an account.
Your choices
Disconnect a social account at any time. Request deletion of your social identity by contacting privacy@shill.family; we delete within 30 days. Settlement records are retained for audit.
Third parties
X and TikTok (data you authorize), Cloudflare (hosting), Supabase (database), Helius (Solana data). We do not sell personal data.