Legal

Privacy Policy

We built firsttx to celebrate your on-chain history — not to harvest your data.

Last updated: March 2025

TL;DR — We store your wallet address, your story text, and optionally your X handle + avatar if you connect your account. We don't sell your data. We don't run ads. We don't track you across the web. That's the whole picture.

Who we are

firsttx is operated by @mojeebeth (Mojeeb Titilayo) under blindspotlab, a solo-founder product studio based in Nigeria.

References to "we", "us", or "our" in this policy refer to blindspotlab. For questions, reach out on X at @mojeebeth.

Data we collect

We collect only what the platform needs to function. Here is exactly what we collect and why:

Always collected

→Wallet address — to fetch your first transaction and associate your story on the leaderboard.
→First transaction data — hash, block number, timestamp, chain, value. This is public blockchain data.
→Story text — the personal story you write about your first transaction (max 280 characters).

Only if you connect X

→X handle (e.g. @yourhandle) — displayed on your leaderboard entry and story card.
→X profile image URL — used as your avatar on the leaderboard.
→X account ID — used to prevent duplicate registrations.

Automatically collected

→IP address — used for rate limiting only. Not stored beyond the current request.
→Browser/device type — standard server logs for debugging. Not used for profiling.

Data we do NOT collect

⚠

We never collect your private keys, seed phrase, email address, phone number, government ID, payment information, or X direct messages.

→No tracking cookies or advertising pixels.
→No behavioral profiles or interest graphs.
→No sale, rental, or trading of your data to any third party.
→No ads on firsttx — ever.

How we use your data

Every piece of data has a specific, stated purpose:

→Wallet address → fetch first transaction, associate story, display on leaderboard.
→Transaction data → display on story card and leaderboard entry.
→Story text → display on card, leaderboard, and shareable story page.
→X handle & avatar → display on leaderboard and story page (if connected).
→X account ID → prevent duplicate accounts.
→IP address → rate limit enforcement only. Discarded immediately after.

Third-party services

firsttx uses the following third-party services. Each handles data according to their own privacy policy:

→Alchemy — blockchain RPC provider. Your wallet address is sent to Alchemy to fetch transaction history. Policy: alchemy.com/privacy-policy
→Supabase — database (PostgreSQL). Your story and profile are stored here. Policy: supabase.com/privacy
→Vercel — hosting and serverless functions. Requests pass through Vercel infrastructure. Policy: vercel.com/legal/privacy-policy
→RainbowKit — wallet connection UI. Wallet interactions are local; no data is sent to RainbowKit servers.
→X (Twitter) — OAuth 2.0 authentication. If you connect X, their OAuth flow is used. Policy: twitter.com/privacy

We do not share your data with any service beyond those listed above, and only to the extent necessary for the platform to function.

What is publicly visible

The following information is visible to anyone on firsttx:

→Your wallet address in shortened form (e.g. 0x71C7...976F) on the leaderboard.
→Your X handle and avatar (if connected) on the leaderboard.
→Your story text on the leaderboard and your story page (/story/[slug]).
→Your first transaction date and chain on the leaderboard.
→Your generated story card image via /api/og/[slug].

Your full wallet address and full transaction hash are stored in our database but displayed only in shortened form on public pages.

Data storage & security

Your data is stored in Supabase (PostgreSQL) on infrastructure hosted in the United States. We use Supabase Row Level Security (RLS) and a server-side service role key — never exposed client-side — to control access.

→All connections are TLS-encrypted in transit.
→We never store private keys, seed phrases, or wallet signatures.
→Supabase handles database-level encryption at rest.
→Service role credentials are stored as Vercel environment secrets, not in code.

While we take reasonable precautions, no internet transmission is 100% secure. We cannot guarantee absolute security of data transmitted to or stored on our platform.

Data retention

We retain your data for as long as your story remains on the platform. If you request deletion, we will remove your story, wallet address, and X profile data from our database within 14 days of your request.

Transaction data on public blockchains is immutable — it cannot be deleted. Only your association with it on firsttx can be removed.

Your rights

Depending on your location, you may have rights including:

→Access — request a copy of data we hold about you.
→Erasure — request deletion of your data from the platform.
→Rectification — request correction of inaccurate data.
→Portability — request your data in a portable format.
→Objection — object to processing of your personal data.

To exercise any of these rights, contact us at @mojeebeth on X. We will respond within 14 days.

Children's privacy

firsttx is not directed at or intended for use by anyone under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently done so, contact us immediately and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we update the "Last updated" date on this page. Significant changes will be announced at @mojeebeth. Continued use of firsttx after changes constitutes acceptance.

Contact

Questions, data requests, or privacy concerns: @mojeebeth on X · blindspotlab.xyz