Privacy Policy
Effective 19 August 2026. The data controller is Reputation DAO LLC (“Talent Protocol”), reachable at contact@talentprotocol.com.
The short version: scoring happens in your browser, we run no accounts, and the only personal data we store server-side is the opt-out register described below.
Scoring happens in your browser
When you check a score, the wallet addresses, ENS names, or GitHub handles you enter are processed by code running in your own browser. Your browser fetches the public data directly from public blockchain RPC endpoints, the GitHub API, and the EAS index (easscan.org) — those requests never pass through our servers, so we do not see or store what you look up. Those third parties see the requests your browser makes to them, under their own privacy policies.
Hosting logs
The app is served by Vercel, which produces standard, short-lived request logs (IP address, user agent, requested URL) for the pages and static files it serves — not for the scoring lookups above, which skip our infrastructure entirely. We run no analytics, no advertising, and no tracking cookies.
Optional GitHub sign-in
Signing in with GitHub is only needed to attest a score that carries your GitHub handle. The access token lives in your browser (per-tab session storage; a short-lived cookie exists only during the sign-in handshake) and is used to read your public GitHub profile and contribution metrics. We do not store it server-side, and signing out or closing the tab discards it.
What stays on your device
Your theme choice, wallet-connection state, and attestation signing session are kept in your browser's local storage and never sent to us. Connecting a wallet is handled by your own wallet software.
Attestations are public by design
If you attest a score, the attested data — your wallet addresses, score, GitHub handle if included, badges, and ownership signatures — is written to the Base blockchain. Onchain data is public, permanent, and outside anyone's ability to delete, including ours. Attesting is always your explicit choice, made in your wallet.
The one thing we store: data-transfer opt-outs
The opt-out flow at optout.talentprotocol.com exists so people can opt out of the one-time transfer of Talent Protocol builder records to IPTS. If you use it, we store the email address you submit, a hashed confirmation token, and timestamps in our database (hosted on Supabase), and we send you one confirmation email via SendGrid, our email processor. A confirmed opt-out is shared with IPTS so the corresponding record is removed. We keep opt-out records for as long as needed to honor them. The legal basis is our legitimate interest in honoring your objection to the transfer.
Your rights
You can ask us what we hold about you, ask for it to be corrected or deleted, or object to processing by writing to contact@talentprotocol.com. For the opt-out register that covers everything; for anything already onchain, deletion is technically impossible — we will explain what can and cannot be done in each case. If you are in a jurisdiction with a data-protection authority, you also have the right to complain to it.
Changes
We may update this policy; the effective date above changes when we do. See also the terms of service.