Privacy
Last updated: October 2026 (draft)
Who handles your data
TalesOnChain runs PubliRare Creators and decides what the service keeps about you. This page lists what the service stores today, and nothing more.
Your account
Your account keeps your name, your email address, the language of the interface and of the service’s emails, the version of the terms you accepted, with its date, and the date you created it. It also counts wrong two-step verification codes in a row. After 10, it refuses these codes for 15 minutes, and a correct code resets the count.
During the beta, TalesOnChain keeps an access list: the addresses allowed to create an account, with the date each one was added.
Signing in and security
When you ask for a code, TalesOnChain keeps the address you entered and a hash of the code for 10 minutes, even if the address has no account. A hash is a fingerprint the code cannot be read back from. A change of email keeps the new address for the same 10 minutes. The two-step verification step of a sign-in also lasts 10 minutes, and a wallet signature request 5 minutes.
Each session keeps a hash of its cookie, your browser and system as your browser announces them, the country Vercel deduces from your IP address, your active house, the time it started, the time of your last activity and the last time you confirmed your identity. A session ends after 30 days, or after 7 days without activity.
Two-step verification keeps its secret encrypted and your recovery codes hashed.
To limit how many codes are sent and tried, TalesOnChain counts requests per email address, IP address or session. These counters keep only a hash of what they count, for one hour or one day.
Your house and its team
A house keeps its profile (name, type, country, and the description and website you add), its plan and its legal entity: legal name, country, registration number, VAT number and address, each one optional.
An invitation keeps the invited address, the role offered and its dates. It is valid for 7 days, and is erased 30 days after its expiry date.
Every member of a house sees each member’s name, email address and role, whether their two-step verification is on, and their last activity, as well as the addresses of pending invitations. Only the owner and the accountant see the legal entity.
Your wallet
A sales space keeps the address of the wallet linked to it, which is public by nature, with the date it was linked and the member who linked it.
Account and house events
TalesOnChain records what happens to your account and your house. Each event keeps its date and the account that acted. An event about a member, an invitation or a sales space also identifies it. When TalesOnChain acts, for example to reset two-step verification or close a house, the event names no account as its author.
For your account: a sign-in from a new device (its browser, system and country), a change of email, two-step verification turned on, off or reset, a new authenticator app, new recovery codes, and the deletion of the account.
For your house: an invitation sent, sent again or revoked; a member joining, leaving, removed or changing role; a change to the profile (the names of the changed fields), the legal entity or the plan; a sales space renamed; a wallet linked, with its address; a new owner; the house closed.
An invitation and a member joining keep the role. A change of role or plan keeps the old and the new one. A change of owner keeps the former and the new owner. When a member leaves because their account was deleted, the event says so.
An event never holds an email address, a code or an invitation link.
Who receives it
Brevo sends the service’s emails: it receives the address and the content of each one, such as the name of the house, a code or a link.
Some emails hold more. A sign-in from a new device gives its browser, system, country and time. A change of email gives the new address, also sent to the old one. An invitation gives the name of the member who sent it, the role offered and its expiry date. A change of owner gives the new owner’s name. An alert to the owner of a house gives the names of the members concerned, an invited address, a role, the plan, the name of a sales space or a shortened wallet address.
Vercel hosts the service: it runs its firewall and keeps request logs (IP address, page and browser). Axiom receives a copy of these logs.
MongoDB Atlas hosts the database.
MetaMask Embedded Wallets receives your account’s email address and your IP address when you create a wallet with it. When you link a wallet, your browser may also contact public blockchain access points, which then see your IP address.
In your browser
The service sets a session cookie, which lasts 30 days at most, a two-step verification cookie, which lasts 10 minutes, and a language cookie, which lasts until you close your browser. Your theme, Library or Collect, stays in your browser’s local storage.
When you link a wallet, your browser also keeps the state of the wallet connection and that of MetaMask in its local storage.
There is no audience measurement and no advertising tracker.
How long TalesOnChain keeps it
Your account stays until you delete it. A house, its legal entity and its wallets stay too, even once the house is closed: nothing erases a house yet.
Sessions last 30 days at most, codes 10 minutes (5 for a wallet signature request), counters one hour or one day. Invitations are erased 30 days after their expiry date, and an access list entry stays until TalesOnChain removes it.
Events have no retention period yet, even after an account is deleted: TalesOnChain will set one before the public launch.
Deleting your account
Deleting your account erases its sessions, its place in each house, its two-step verification and its pending codes, then the account itself.
Some data stays: your address on the access list, until TalesOnChain removes it; invitations sent to your address, until 30 days after their expiry date; the counters, for one hour or one day; the events of your account, its deletion included; and your identifier in other people’s records, such as the invitations you sent. A closed house you owned stays, without an owner.
Your rights
You can delete your account and change your email address from the Security page. If you own a house that is still open, write to TalesOnChain first, which transfers it or closes it.
For any other request, such as seeing your data or correcting your name, write to TalesOnChain: