Privacy notice · draft
What PLOT stores about you
Everything the software keeps that could point at a person, and where it keeps it.
DraftThese privacy terms are a draft written by PLOT’s engineers and not yet reviewed or signed by counsel. They describe what the software does today and mark, in dashed boxes, every place a legal answer goes. Read them as a description of the product, not as advice and not as a statement about PLOT’s legal status anywhere. The dashed boxes and this notice come off when counsel signs.
1. Who is responsible
PLOT (soft open on enterplot.com) [counsel: controller’s legal name and address] [counsel: contact for privacy requests] [counsel: supervisory authority, if one must be named]
2. What is stored, and where
Your wallet address. The address you signed in with, and its link to the account PLOT made for you (wallets, wallet_links). It is the identifier PLOT holds for an account that has one, and an X-first account has no wallet until it attaches one. It is pseudonymous, persistent, and publicly linkable to on-chain history. PLOT never asks for a phone number, a date of birth or a password; none exist on PLOT. Two things can attach a name to your account, and both are yours to give or withhold: an X connection, and a contact address on a report.
Your X connection, if you use it. Your X user id, handle, display name, avatar URL and account creation date, linked to your PLOT account (x_identities). Sign-in and connection flows also keep short-lived authorization requests and one-time tickets. An X connection does not give PLOT your wallet keys or permission to sign transactions.
Your account. A handle PLOT generates (never derived from your address), a display name, a role, and, if an operator suspends the account, when and why (users).
Your sessions. The sign-in cookie’s hashed id, when it was created, expires and was revoked (sessions); and, under the geographic posture this host runs, the country detected for the connection you signed in from and the edge region that accepted it: a two-letter code, never your IP address, which PLOT does not record. On this host the country is recorded and trading or starting a PLOT is refused from KP, IR, SY, CU, RU, BY, US.
For country availability, PLOT processes the IP address supplied by its hosting network using a local country database. The lookup does not send your IP to an external location service or save it in PLOT's database. Each restricted action uses the current connection, rather than a previous sign-in or country declaration. The database includes GeoLite2 data created by MaxMind.
Your attestation. That you affirmed you are 18 or over and accepted the risk notice, the country you declared you live in, when, and which version of the words (version 2026-10-05.1), together with the country detected at that moment (attestations). Stored once per account per version; kept so the affirmation can be shown to have happened.
Sign-in challenges. Every sign-in attempt’s one-time message, your address, and when it was issued and used (auth_challenges). Marked used, not deleted.
What you publish. PLOT titles, objectives, proof, updates, images and objections. Public the moment they are posted, attributed to your account, and kept permanently: the ledger, the audit trail and a PLOT’s record are append-only, and a moderator can withdraw content from publication but not erase it.
Reports you file. Not public. What you wrote, what you named, and the contact address if you gave one, readable by moderators (content_reports). Filing needs no account and does not attach you to the PLOT you reported.
Your money history. On this host, every trade, holding, PAYOFF share and payout attributed to your wallet (trades, ledger_entries, payoff_settlements). On a chain host this is read from the public chain.
Aggregate page tallies. A count per page, never per person (page_view_counters). This counter uses no advertising cookie or analytics identifier. Fonts are served by PLOT’s own build.
Functional cookies. plot_session keeps you signed in. If you use X, PLOT also uses short-lived cookies to bind that sign-in to your browser and return you to the page you came from. Those X cookies expire after ten minutes or are cleared when the flow finishes.
Saved on this browser. localStorage keeps your theme, preferred wallet, unfinished Studio drafts, and transaction recovery records for launches, trades, claims, Plotter purchases and changes, person enrollment and NFT crossings. Recovery records can include wallet and contract addresses, token ids, transaction hashes, reviewed transaction details and a crossing’s reveal secret. The reveal secret is not your wallet’s private key. Completed crossings can stay saved so you can finish or recover their source-chain steps.
Saved in this tab. sessionStorage keeps unfinished challenge drafts, follow, trade and referral choices through sign-in, the latest sent transaction hash, and confirmations through a page reload. These records help you resume an action without sending it twice.
These browser records are not public posts. When you submit or resume an action, its relevant details are sent to PLOT, your wallet or the chain to carry it out. You can clear them using your browser’s site-data controls, but doing so can remove drafts and recovery information. Keep the recovery record for an unfinished crossing.
What the host logs at its edge (connection logs at the hosting or CDN provider) is not controlled by this code and is not described here. [counsel: name the providers and their retention]
3. Why, and on what basis
To run the product you asked to use (sign-in, trading, publishing), to keep the record a market needs, to act on reports, and, for the country and attestation, to operate the geographic posture and the eligibility affirmation described in the terms. [counsel: legal basis per item]
4. How long
Published records and financial history remain in the append-only record. Sessions expire and are marked revoked; content can be withdrawn from publication. Expired X authorization requests and one-time tickets are cleaned up by the sign-in flow. Browser drafts and recovery records remain until their flow clears them or you clear the site data; completed crossing archives are retained for recovery. Tab storage normally lasts for that browser tab, and individual continuations can expire sooner. Pseudonymising the account row while the append-only history stays is a proposal, not a feature that exists yet. [counsel: retention periods; whether pseudonymising the user row satisfies an erasure request]
5. Your rights
[counsel: the rights that apply, and how to exercise each] Until then: use /report to reach an operator, with the wallet address the request is about.
Two things here are decided by software alone. The geographic posture above can refuse restricted activities by the country of your current connection, and a report in the most serious category hides the content it names at once, pending a moderator. A person can reverse either, and /report reaches one.
6. Who else sees it
Everything you publish and every figure attributed to your wallet is public by design. PLOT does not send these records to advertisers. The hosting provider processes the site’s requests. Connecting X sends you through X’s authorization service. If you choose WalletConnect, its connection service and your selected wallet handle that connection. Wallet and chain requests use the relevant wallet and RPC providers. These services have their own privacy notices. [counsel: processors, transfers and provider retention]
7. Changes
Technical inventory updated 2026-09-28. This remains a draft. Terms: /terms.