Privacy Policy

1. What we collect

• Your wallet address, when you connect and sign in, and every wallet you link to your account.
• Signed login messages. Signing in or linking a wallet asks it to sign a message that names backbid.fun, your address, a one-time code and a time. We store the message and check the signature to prove you own the address. It isn't a transaction and can't move funds.
• If you sign in with Google (optional): your Google account ID, email address (and that Google verified it), name and the link to your profile photo. Google only tells us who you are; we never get access to your Google account, and we don't keep Google's access token or ask for a refresh token.
• Your account: the display name you choose, your notification settings, your watchlist and your in-app notifications.
• Sessions and request details. For each signed-in session we store a one-way hash of your IP address (not the address itself), your browser's user agent and when it was last used, so you can see and sign out your devices. Sign-in messages are stored with your IP address. Our hosting provider keeps standard request logs (IP address, time, URL) for the website and API.
• Token launches: the name, symbol, description, website and social links and the image you upload to launch a token, linked to your wallet address. We re-encode the image before storing it.
• What you create: OTC offers, buy requests, counteroffers and reports, linked to your wallet address.

2. Token launch data is public

Launch metadata is published at api.backbid.fun/v1/meta/<id>.json together with its image, and the token's on-chain record points to that address. Wallets, explorers and other sites read it from there. Because it is referenced on-chain, we treat it as permanent: we can't remove it without breaking the token's metadata everywhere. Don't put anything in it you wouldn't want public forever.

3. What we don't collect

No phone numbers, and no email address unless you choose to sign in with Google (we never email you; notifications stay on the site). We don't use advertising trackers or analytics scripts, and we never ask for your seed phrase or private key: your wallet signs every transaction, and BackBid never holds your keys.

4. The blockchain is public

Launches, curve and pool trades, vault trades, OTC listings and purchases, cancellations and every other on-chain action are public and permanent on Solana: anyone can see them, linked to your wallet address. We can't change or delete anything on-chain. Your account details (name, email, photo, watchlist, notifications, linked wallets) are shown only to you.

5. Cookies and browser storage

• bb_session cookie on api.backbid.fun: keeps you signed in. It's HttpOnly (scripts can't read it), sent only over HTTPS, and expires after 24 hours at most, or after 2 hours of inactivity, or when you sign out.
• bb_hint cookie on backbid.fun: the value 1 and nothing else. It tells the site that a sign-in might exist, so it asks our API who you are (visitors without it make no sign-in request). It's set and cleared together with bb_session and lasts 24 hours at most.
• Local storage (bb.wallet, bb.session): remembers which wallet app you used and that you're signed in, so the site can reconnect after a reload. It holds no keys and no personal data. Signing out clears it. bb.offers.view remembers whether you prefer offers as cards or a table.
• Session storage (bb.strip): remembers that you closed the site status notice, until you close the tab.

There are no third-party or advertising cookies. Signing in with Google happens on Google's own pages, under Google's cookies and privacy policy.

6. How we use it

Only to run BackBid: to sign you in, build your launch and trade transactions, publish the metadata of tokens you launch, show you your own offers, requests, watchlist, portfolio and notifications, prevent abuse (rate limits and blocking attackers), investigate reports of scams, and fix problems. We don't sell your data or use it for advertising.

7. Third parties

• Railway hosts the website, the API and its database, and keeps request logs.
• Google, only if you choose Continue with Google: you sign in on Google's pages and Google sends us the details listed above. Your profile photo is loaded by your browser from Google's servers (googleusercontent.com, without telling Google which page you're on), so Google sees your IP address when it loads.
• Solana RPC and indexing providers answer our API's blockchain queries and tell us about trades in BackBid tokens. Your wallet app also uses its own RPC provider when you sign; see your wallet's privacy policy.
• Raydium runs the programs that launches and pools use. Our API builds those transactions itself; Raydium sees only what is on-chain.
• Jupiter and DexScreener provide token data and prices. Our API calls them, so your browser doesn't.
• Token image hosts (IPFS gateways and others): logos of tokens not launched here are fetched by our API, so these hosts don't see your IP address.
• Links you click (Solscan, DexScreener, RugCheck, and any links a token creator adds) take you to their sites, under their privacy policies.

8. How long we keep it

• Sign-in messages and their IP address: deleted about an hour after the message expires (messages are valid for 5 minutes).
• Sessions, with the hashed IP address and user agent: deleted when they expire, after 2 hours of inactivity, or when you sign out (on that device or from your account page).
• Notifications: deleted after 90 days.
• Launch metadata and images: kept permanently, because tokens reference them on-chain.
• Your account (Google details, display name, settings, linked wallets, watchlist), your wallet address and what you create: kept while it's useful (for example the history of your offers), or until you ask us to delete it.
• Hosting request logs: kept for a limited period set by our hosting provider, then deleted.

9. Deletion requests

You can remove linked wallets and sign out devices yourself on your account page. You can also ask us to delete your account and the off-chain data linked to it or to your wallet (for example your Google details, watchlist, notifications, buy requests and sign-in history). While signed in with that account, use Report on any offer or token page, choose "Other" and say what you want deleted; being signed in proves the account is yours. We may keep what we need to stop fraud or meet legal duties. Launch metadata referenced on-chain and on-chain data can't be deleted.

10. Age

BackBid is only for people aged 18 or over, and we don't knowingly collect data from anyone younger.

11. Changes

If we change this policy, we update the "Last updated" date at the top of the page.

12. Contact

Privacy questions or deletion requests: while signed in, use Report on any offer or token page and choose "Other". BackBid will never DM you first.