Privacy Policy

About this policy

This policy explains what Toll (“we”, “us”) collects when you use t0ll.xyz, the Telegram bot @t0ll_bot and the Toll Launchpad, why, and what you can do about it. It goes with our Terms of Use. We collect as little as we can: no accounts, no names, no email addresses, no third-party analytics, no ad trackers and no tracking cookies (one random cookie only counts how many people come back).

Information we collect

When you only browse

You can use the token check, the Dev Wall, Explore, the terminal and the docs without connecting a wallet. Our host receives the usual request data (your IP address, browser and the page asked for), and our server uses your IP address for about a minute, in memory, to rate-limit requests.

We count page views anonymously, without cookies: the page (on the launchpad, which steps were reached), the site that sent you (its name only), phone or desktop, and a code made from your IP address and browser mixed with a random value that changes every day and is never stored, so it cannot be traced back to you. Your IP address itself is not stored.

A random cookie and a hashed id count how many people come back; no wallet, Telegram id or IP is stored for it. When you sign in, the cookie’s hashed id is linked to your wallet’s hashed id, so one person counts once. The cookie is only set after you press “ok” on the bar at the bottom of the page; to change your mind, clear this site’s cookies and the bar asks again. The AI-app setup on /agents/mcp gives each page view its own random id at the end of the server address (?c=); it counts that install the same way, hashed, and the address works the same without it.

Free checks

Everyone gets 10 free coin checks a day (UTC); holders of 1M $TOLL check without a limit. To count them, our server keeps, per person and per day, the list of coins counted that day: only checks that needed a fresh read of the chain count. The person is your signed-in wallet; else, for the Telegram bot and @tollchk, your Telegram or X id (or the wallet you linked to it); else the browser extension’s random install id; else a code made from your IP address with a secret key, different every day. These lists are deleted after 3 days and only our server can read them.

The browser extension sends t0ll.xyz, and only t0ll.xyz, its random install id with each check, and, if you connected it on t0ll.xyz/extension/connect while signed in, a signed pass naming that wallet for 30 days, so a holding wallet gets its tier there too.

When you connect a wallet

The page reads your wallet’s public address in your browser. It reaches our server only when you use a feature that needs it: signing in, testing or launching a coin (the address, the coin details and the transaction to test), checking a launch credit, reading your fee vaults, proving an account, linking Telegram, following callers or saving a simulated agent.

When you sign in

Signing in is one signed message. We keep the address and the time with the one-time code it signed, for one day, so the same signature cannot be used twice, and then delete it. Your session is a signed cookie in your browser that lasts up to 7 days and works on t0ll.xyz and its subdomains (such as x402.t0ll.xyz); we keep no session record on our server.

What we store for signed-in wallets

• The callers you follow, with your wallet address.
• Simulated agents you save in the strategy lab, with your wallet address. Saving one puts it on a public board, where your address and its results are visible to everyone.

If you link Telegram

Linking is optional. We store your Telegram id and username, the chat the bot writes to, the wallet you linked, your $TOLL balance when last checked, and the alerts you switched on.

If you prove an account for a fee vault

You sign in with that account through Privy (X, Farcaster, GitHub, Discord or Twitch) or with the Telegram Login Widget. Our server checks the sign-in once (account id and handle) to sign a short-lived binding, and does not store it. The binding transaction your wallet then sends writes the account’s key and your wallet to the chain, where it is public.

If you launch a coin

The coin’s name, symbol, image, description and links are sent to our server for the test and go on chain with your launch. An image you upload is stored on IPFS through Pinata. Both are public and permanent.

What we never collect

Private keys, seed phrases, passwords, names, email addresses, phone numbers or identity documents. The site never asks for them.

Sources

• You and your wallet, through the features above.
• Public blockchain data from Robinhood Chain: launches, pools, trades, wallets and balances.
• Account providers you choose to sign in with (Privy, Telegram), only for the proof itself.
• Public posts: the Callers pages keep copies of messages from public Telegram channels and public handles and profile pictures.

How we use it

• To run the Service: sign you in, test and launch coins, read your vaults and credits, send the alerts you asked for.
• To unlock holder features, by reading your $TOLL balance from the chain each time.
• To keep the Service working and secure: rate limits, abuse prevention, the launch-farm limit, debugging.
• To meet legal obligations, including sanctions and restricted jurisdictions.

We do not sell your data, use it for advertising, or build profiles of you beyond what the chain already shows.

Blockchain information

Everything on Robinhood Chain is public and permanent: your address, its balances, every transaction and every coin detail. Anyone can read it on a block explorer, and neither we nor anyone else can change or delete it. The Service reads and shows this public data, including wallets and their records. Connecting a wallet to an address can reveal your activity to anyone who knows that address is yours.

Disclosure

We share information only:

• with the services listed below, as far as each needs it to do its part;
• when the law requires it, or to protect the Service, its users or others from fraud or harm;
• with anyone who takes over running the Service, under this policy.

Third-party services

Each runs under its own privacy policy.

Your browser talks to these

• Railway hosts the site, our chain reader and our database (Postgres). Like any host it sees request data such as IP addresses in its logs.
• Reown (WalletConnect) makes the wallet-connection kit. It loads on every page and connects the wallet you choose. We switched off its analytics; it may still send its own usage requests (to pulse.walletconnect.org) from your browser.
• Robinhood Chain RPC providers (the Robinhood Chain RPC and publicnode) answer the chain reads and transactions your wallet and our server make, and so see the addresses involved.
• Privy is used only to prove a social account for a fee vault. It loads only when you press a prove button, sees the account you sign in with, and makes no wallet. We log out of Privy as soon as the proof is read.
• X, Farcaster, GitHub, Discord and Twitch handle the sign-in when you prove one of those accounts through Privy.
• Telegram runs the bot @t0ll_bot, delivers its messages, and runs the Login Widget used to prove a Telegram account.
• DexScreener draws the price chart on a token check, as an embedded page that can set its own cookies.
• Google Fonts serves the typefaces, and so sees the request for them.

Our server talks to these

• Pinata stores images you upload on IPFS. They are public and permanent.
• Pons runs the launch contracts. Our server reads coin images through its public IPFS gateway.
• HyperSync (Envio), Blockscout, DexScreener, CoinGecko, GeckoTerminal, Dune and public IPFS gateways supply chain history, prices and statistics. When you check a coin or a wallet, the address may be part of the request.

Browser storage

Your browser keeps a few things of its own, in localStorage. They never leave it unless a feature above sends them:

• Whether the sidebar is open.
• Your consent: which wallet accepted which version of these terms and this policy, and when.
• The terminal’s alert switch and the wallets on your watchlist.
• Fee vaults and launches made from this browser, and a pending launch fee or holder step, so they can be finished later.
• While you prove an account, which vault it is for (in sessionStorage, for 15 minutes).
• Your checks: the last 20 Robinhood Chain coins you checked on this device, each with its address, ticker, the verdict word you got and when. Kept only after you say yes to remembering your checks (or ok on the cookie bar), so the home page can show what changed since. To show the verdict we hold now, the home page sends us the coin addresses only, never the rest. Clear it with the clear button in “Your checks” on the home page, or by clearing your site data.

The wallet kit keeps its own connection state there too. Cookies: one for the sign-in session (up to 7 days), one for the sign-in code (10 minutes), both strictly necessary, and one random visitor id (30 days) that only counts how many people come back; we set no others. Clear your site data to remove all of it.

Retention

• Sign-in records: one day. Session cookie: up to 7 days.
• Telegram link, followed callers and saved agents: until you unlink, delete them, or ask us to.
• Rate-limit data: about a minute, in memory.
• Free-check counts (the coins counted per person per day): 3 days.
• Returning-visit counts (one hashed id per person per day, and the hashed cookie-to-wallet link made at sign-in): 180 days.
• "Since your last check" (the last verdict word you got for a coin, under a hashed id, never your IP): 30 days.
• Server logs: as long as our host keeps them; we keep no copies of our own.
• Browser storage: until you clear it.
• The chain and IPFS: forever. Nobody can delete them.

Security

We never hold keys or funds, keep what we store to a minimum, sign sessions with a server secret, serve the site over HTTPS only, and limit who can reach the database. No system is perfectly secure; if we learn of a breach that affects you, we will say so on our official channels.

International processing

Our host and the services above run servers in several countries, which may not be yours, and data protection laws there may differ. By using the Service you understand your information is processed there.

Your rights

You can ask to see, correct or delete what we store about your wallet or your Telegram link (everything off chain). Contact us through the channels below; to prove a wallet is yours, we may ask you to write from the bot linked to it or to sign a message with it. Depending on where you are, you may have further rights under local law. We cannot change or delete anything on the chain or on IPFS.

Children

The Service is for people 18 and older. We do not knowingly collect information from anyone younger. If you think we have, contact us and we will delete it.

Changes

We may update this policy. When we do, the version and date above change, and every connected wallet is asked to review and accept the new version before it can sign in, launch, claim or bind.

Contact

We have no contact email. Reach us through our official channels only:

• On X: @Tollxyz_. Send a direct message.
• On Telegram: our bot, @t0ll_bot.