The Aliens

Privacy and Data Use

This notice covers the tools and content on thealiens.dev. The product sections below explain which information each tool uses.

Information used across the site

Depending on the feature you use, we process account details returned by a service you connect, information you submit, and technical data needed to provide the feature, secure the site, and prevent abuse. We do not use this information to build advertising profiles.

IP addresses are used for rate limiting and service security. The application stores them only in short-lived rate-limit counters. Counters older than the longest configured rate-limit window (currently 10 minutes) are deleted by opportunistic cleanup triggered by requests, attempted at most once per warm runtime per hour. If requests do not arrive or cleanup fails, expired records may remain longer. The site also uses login and security cookies when a feature needs them; these are not advertising cookies.

If you submit an interest form, we store the X handle and category you provide, your browser's user-agent, and a salted hash of your IP address to process the submission and help prevent duplicate or abusive requests.

We use Vercel Analytics and Speed Insights for site usage and performance. They may process page paths, device and browser details, approximate location, and performance measurements. Vercel says Analytics uses no third-party cookies and a short-lived request hash; Speed Insights is designed not to identify individual visitors or IP addresses. These services are not used for advertising. See Vercel's notices for details about Analytics and Speed Insights.

Features may connect to services such as Discord, X, Google, OpenSea, Vercel, or Neon. Those services process information under their own terms and privacy notices.

Alien Draw Tool

This section applies to Alien Draw Tool (ADT), not Alien Mint Scanner. ADT uses draw settings and participant information to create and verify draw results.

  • Draw records may include the creator's connected account details, draw settings, participant usernames and ticket counts, selected Bitcoin block information, and the final result.
  • Participant data comes from the organizer's submitted list or, for supported X draws, public X replies/reposts fetched at the organizer's request. The organizer chooses the participant data and must tell participants about the collection and intended sharing. ADT still handles this data under this notice and applicable law.
  • Participant names and ticket counts stay private on this site until the organizer chooses “Publish & copy link.” After publication, anyone with the draw link can view the list and verification details. Copies made by other people or external services may not be retrievable by us.
  • Draw records and participant snapshots are retained to preserve and verify the draw; there is no automatic deletion schedule for them at present. A request to remove or restrict data is assessed individually, including whether the public result can remain verifiable.
  • If you connect X, ADT stores your X account ID and username. Encrypted X authorization tokens may be stored when needed for X features.
  • If you connect Google, ADT stores the Google account ID, email address, and display name returned by Google.
  • If you sign in with a wallet, ADT processes the wallet address and a signed message to verify control. This is not a blockchain transaction.
  • ADT stores owner tokens, participant drafts, and cached participant lists in your browser's local storage. These entries expire after 7 days and are cleaned up when the tool is used again; you can also clear them in your browser settings.

Alien Mint Scanner

This section applies to the holder portal and its Discord alerts. It does not describe Alien Draw Tool.

  • When you sign in, we store your Discord user ID, username, display name (if provided), authorization scopes, and encrypted Discord sign-in tokens so the service can check your server access and maintain your sign-in.
  • We store linked wallet addresses and when ownership was verified. Wallet ownership is checked with a signed message, not a blockchain transaction.
  • Connecting MetaMask Mobile uses MetaMask Connect and its connection relay. MetaMask processes your wallet address, connection details, and messages you approve. The connection also configures PublicNode's public Ethereum Mainnet RPC, which can receive your IP address and read-only RPC requests routed to it. SDK analytics are disabled. Private Discord action tickets and browser action cookies are not sent to these providers.
  • If you authorize OpenSea, we store encrypted OpenSea session details and use them to check wallet eligibility. OpenSea controls what its authorization permits.
  • We store portal sessions, short-lived wallet-verification challenges, and alert records needed to deliver and prevent duplicate alerts. Alert history can retain a wallet address after that wallet is unlinked.
  • IP addresses are used for rate limiting and service security.

Retention of short-lived records

Expired sign-in sessions and used or expired wallet-verification challenges are deleted by opportunistic cleanup triggered by requests, attempted at most once per warm runtime per hour. This applies to both the website and AMS databases. Sessions without a provider expiry are removed after the 30-day sign-in cookie lifetime. If requests do not arrive or cleanup fails, deletion can be delayed.

Why we process information

We process information to provide the feature you request, keep accounts and the service secure, prevent abuse, and meet legal obligations where they apply. Depending on the feature and data, the legal basis is providing the requested service, our legitimate interest in securing and operating it, or a legal obligation. Where a feature relies on consent, you can withdraw it; this does not affect processing that already took place.

Your privacy rights

Depending on the applicable law and circumstances, you may ask for access to, correction of, deletion of, or restriction of your personal data, object to certain processing, or request a portable copy. You may also complain to your local data-protection authority; in Poland, this is the President of the Personal Data Protection Office (UODO). These rights are not absolute and may be subject to legal exceptions.

For privacy questions or requests about your personal data, contact support@thealiens.dev. We may ask for reasonable information to verify your request and locate the relevant account or data. Never send passwords, private keys, or seed phrases.

Cookies, storage, and retention

Authentication and security cookies help sign you in and protect account actions. You can block cookies in your browser, but sign-in features may then stop working.

Retention differs by record type. Draw results are kept for later verification. AMS alert history may remain after a wallet is unlinked. Expired sessions, used or expired wallet-verification challenges, and rate-limit counters older than the longest configured rate-limit window (currently 10 minutes) are deleted by the opportunistic request-triggered cleanup described above in both databases.

External services

Links to external services are provided for convenience. When you sign in to or authorize a third-party service, that service's own privacy policy also applies to its handling of your information.

Changes

This notice may be updated when the tools or their data practices change. The latest version is available at /privacy.

Powered by The Aliens