Privacy Policy

• From X, when you sign in: your handle, display name, avatar, follower count and X user id. That is the whole profile we read.
• What you give us: a payout wallet address, an optional email for notifications, and the campaigns and entries you create.
• Posts you report: the link, the text of the post, and its public metrics. We read the post through X rather than taking your word for it.

We do not ask for your email to sign in, we cannot see your direct messages, and we hold a short-lived read token that expires. Sign-in does not request the permission that would keep us connected to your account.

Only campaigns that pay on clicks use a tracked link; one paying on views or likes never issues one. Where there is a link, it has to be measurable or the money cannot be worked out honestly. When a visitor opens one we record the campaign and creator it belongs to, the country, the referring site, the browser user agent, whether the visit landed and how long it stayed, and a bot score.

We do not store the visitor’s IP address. It is used in memory to build a one-way hash of the address and user agent that changes every day, which lets us spot the same visitor twice within 24 hours and nothing beyond that. The hash cannot be turned back into an address.

We count how many people open a campaign page, once per viewer per day, using the same daily one-way hash and nothing else. It tells a founder whether anyone is reading their campaign. There is no per-person record.

One cookie keeps you signed in. Two short-lived cookies protect the X sign-in handshake and are deleted as soon as it finishes. There are no advertising cookies and no third-party trackers on this site.

• X authenticates you and serves the posts and profiles we read.
• Stripe processes card and stablecoin payments. Card details go to Stripe and never reach us.
• Mailgun sends notification email, and only if you gave us an address.
• An IP intelligence provider may be asked whether a clicking address belongs to a hosting provider or VPN. We send the address and keep only the answer.
• Your browser loads avatars from unavatar.io and country flags from flagcdn.com, so those services see the request.

Founders see, for each creator in their campaign, the handle, the traffic driven, the posts reported and the countries that traffic came from. They never see a visitor’s identity, because we do not have it. We do not sell data and we do not run ads.

• Post as you, or read your direct messages.
• Sell or rent anything we hold.
• Store raw IP addresses, or build a profile of anyone who clicks a link.
• Share your wallet address with a founder.

Click records are kept for the campaign and its settlement, then for two years, because a payout can be questioned long after it lands. Campaign and payout records are kept as long as the law requires us to keep financial records. Delete your account and we remove your profile, entries and campaigns; settled payout records survive, because we have to be able to show what we paid and why.

You can edit your wallet, notification email and payout details in settings, and delete your account there. You can revoke our X access from your X settings at any time, which signs you out of ViralRoyale. Ask us for a copy of what we hold and we will send it.

Traffic is encrypted in transit. Tokens and payout details are restricted to the systems that need them. Payments are handled by Stripe, so we never hold a card number. No system is perfect, and if something is breached that affects you, we will tell you rather than wait to be asked.

ViralRoyale is for people over 18. We do not knowingly hold data on anyone younger, and we delete it if we find it.

Changes are published here with a new date. For anything about your data, message @viral_royale on X.