Privacy Policy

The short version

• You can read everything without an account. Signing in is only needed to write or vote on a project review.
• We do not sell personal data, show adverts, or share data for advertising.
• We use Google Analytics to understand which pages are read. It sets cookies.
• Our server keeps standard access logs, including IP addresses, for 14 days.
• Sign in with X is read-only. We cannot post, follow or send messages on your behalf.

When you read the site

Server logs. Like almost every website, our web server records each request: your IP address, the date and time, the page requested, the referring page and your browser's user-agent string. We use these logs to keep the site running and to investigate abuse. They are deleted after 14 days.

Analytics. We use Google Analytics 4, loaded through Google Tag Manager, to count visits and see which pages are read. Google Analytics sets first-party cookies (named _ga and _ga_…) and receives information about your visit, such as the pages you view, your browser and device, and your approximate location. Google processes this under its own privacy policy; see also how Google uses information from sites that use its services. You can opt out with Google's browser add-on, or by blocking cookies or scripts.

Fonts and market data. Your browser downloads web fonts from Google Fonts and requests some cryptocurrency prices directly from CoinGecko, so both services receive your IP address as part of those requests. Other price and network data is fetched by our own server, so your IP address is not passed to those providers.

Offline cache. The site uses a service worker that stores pages and article data on your device so they load faster and work offline. This stays in your browser and can be cleared in your browser settings.

Sign in with X (optional)

Signing in with X is only needed to write or vote on a project review. We request read-only access (tweet.read and users.read) and do not request offline access, so we cannot post, follow or send messages as you, and we do not keep ongoing access to your X account.

At sign-in, X sends us your public profile. We store:

• your X account ID, username, display name and profile image link;
• your follower, following and post counts, the date your X account was created, and whether it is verified;
• when you first and last signed in, and moderation flags such as warnings or a ban.

X also sends your profile description, which we do not store. We do not receive your X password, email address or direct messages. Your session is kept in a signed cookie for 30 days. You can remove X1 Report's access at any time in X under Settings and privacy → Security and account access → Apps and sessions → Connected apps.

Reviews, votes and project submissions

Reviews. When you submit a review we store the project, your rating, title and review text, the name shown with it, an optional contact handle you give us, your X follower count at that moment, the review's moderation status and dates, and a pseudonymised hash of your IP address. An editor reads every review before publication.

Published reviews are public and show your rating, title, text, X username, display name and profile image, with a link to your X profile. Your contact handle, IP hash and follower count are not published.

Votes. Voting on whether a review is helpful requires signing in with X. We store each vote with your review account, which allows one vote per review, and votes help decide how much weight each review carries in a project's score. Individual votes are not published.

Project submissions. When you submit a project we store its name, website, category and description, your contact handle, your role, any notes, and a pseudonymised hash of your IP address. Details of the project itself may be published if we add it to our directory. Your contact handle, role, notes and IP hash are not published.

About the IP hash. We store a shortened hash of your IP address instead of the address itself, to limit spam and repeat submissions. It is pseudonymised rather than anonymous: someone with access to our data could, with effort, work back to the original address, so we treat it as personal data. Short-term counters used for rate limiting are held only in memory, for up to 24 hours.

Linking a wallet (optional)

If you link a wallet to your review account, we store its public address, when it was verified, a record of the on-chain verification, and a summary of that address's public activity with the projects we cover. We use this to give more weight to reviews from people who have actually used a project. A shortened form of the address is shown to you while you are signed in; it is not shown on published reviews. Wallet addresses and their on-chain activity are public on the blockchain by nature.

Podcast episodes and YouTube

Some articles have a podcast episode. Audio and video files are served from this site. When an episode is also published on YouTube, the article page and our media page may embed it using YouTube's privacy-enhanced mode (youtube-nocookie.com). The embedded player is third-party content served by YouTube. YouTube may set cookies and collect information once you play the video, under the Google Privacy Policy.

YouTube API Services and Google user data

X1 Report uses YouTube API Services. Our publishing system uses the YouTube Data API to upload X1 Report's own episodes to the X1 Report YouTube channel, and to set each video's thumbnail from a frame of that video. It uses a single permission — to upload videos — authorised by the X1 Report account that owns the channel.

• Visitors never sign in with Google on this site. We do not access, collect or store any visitor's Google account data or YouTube data.
• The only Google user data involved is the channel owner's authorisation token, stored on our server with restricted access and used solely to upload episodes and set their thumbnails.
• It is never sold, never shared with third parties and never used for advertising, or for any purpose other than publishing X1 Report episodes.

X1 Report's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Our use of YouTube API Services is subject to the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy at http://www.google.com/policies/privacy.

Revoking access. In addition to our normal procedure for deleting stored data (see Your choices and rights), access granted to X1 Report can be revoked at any time via the Google security settings page at https://security.google.com/settings/security/permissions.

Cookies

The X1 Report cookies are set only if you use Sign in with X. We do not use advertising cookies.

Who we share data with

We do not sell personal data. Data reaches others only in these ways:

• Google — Analytics, Fonts and YouTube, as described above.
• X — when you choose to sign in with X.
• CoinGecko — price requests made by your browser.
• Our hosting provider — which runs the server and stores its data on our behalf.
• The public — anything published as part of a review.
• Legal requirements — where we are required to by law.

How long we keep it

• Server logs: 14 days.
• Rate-limiting counters: up to 24 hours, in memory only.
• Review accounts, reviews, votes and project submissions: until a moderator removes them or you ask us to delete them.
• Analytics: under Google Analytics' data-retention settings, as described by Google.

Your choices and rights

• Read without signing in — reading the site involves only server logs and analytics.
• Block analytics — with Google's opt-out add-on, or by blocking cookies or scripts in your browser.
• See, correct or delete your data — contact us and we will act on the request.
• Disconnect X — revoke access in your X settings at any time.

Depending on where you live, you may have further rights under local data-protection law, such as the right to object to processing or to complain to a data-protection authority.

Children

X1 Report is not directed at children and we do not knowingly collect personal data from them.

Changes to this policy

If this policy changes, we will update this page and the effective date at the top.

Contact

For privacy questions or data requests, use our contact page.