Privacy

The waitlist

What

Your email address, and, only if you type them, your X handle and a line about what you would use GARU for.

Why

To decide who to invite and to tell you when you are in. Nothing else.

How long

If you are never approved, or are declined, the entry is deleted after 365 days. If you are approved, it stays as long as you have access, so we know who is allowed in.

Not stored

Your IP address. It is used in memory, as a one-way hash, to slow down abuse, and is not written to our database.

We do not sell this and we do not send marketing from it.

Accounts

You can sign in with email, Google or X. Email and Google sign-in are handled by Neon Auth, which stores your name, email address and a password hash if you use a password. X sign-in gives us your X user id, name and handle; we discard X’s access token right after reading them. We match your sign-in to your invitation by your verified email address or your X handle. While access is invite-only, creating an account also adds you to the waitlist (your verified email or X handle and your account id), so we can review it.

Holder scans and lists

When you scan an NFT contract we send the contract address to Alchemy to read public on-chain holders. Scan results are linked to your account and are deleted automatically when they expire (from 24 hours to 30 days, depending on your plan). Lists you export are saved to your account so you can download them again; on the free plan they are kept for 30 days. Wallet addresses are public blockchain data.

Collection reports

Collection reports, their public links and share cards describe a public contract: supply, holder counts and spread, mint history and a floor price read from marketplaces through Alchemy. They are built from public chain data, never show wallet addresses, and are not tied to who opened them.

The desktop app

GARU builds and exports collections on your own computer. Your projects, artwork, metadata, wallet addresses and exports stay on your device and are never uploaded. The app can send two things, and both are up to you.

Usage counts

Off until you say yes, and you can turn them off in Settings → Privacy. When on, the app sends a random install id, the app version, your operating system family and short events (app opened, project created, collection generated, export completed or failed) with size ranges, never exact numbers. Never project or file names, artwork, traits, wallets or your name or email. Turning it off deletes the install id. Counts already sent are anonymous, so we cannot pick out yours; they are deleted after 365 days.

Feedback

Only when you press Send: your message, the type you chose, your email only if you type one, the app version and operating system, and, if you leave “Include app details” on, your project size range and the last error with file names removed. We read it to fix bugs and use your email only to reply. It is deleted after 365 days, or sooner if you ask.

Not stored

Your IP address is not saved with usage counts or feedback.

Cookies and analytics

We only set cookies needed to keep you signed in (and a short-lived one during X sign-in). There are no advertising or tracking cookies. Your light or dark theme choice is saved in your own browser. Page analytics come from Vercel Web Analytics, which counts visits without cookies and without following you to other sites. In Web Tools we also count actions such as a scan finishing or a list being exported, never with wallet addresses, contracts, email or account ids.

Who else handles data

• Vercel hosts the site and receives requests, and runs anonymous page analytics (no advertising, no cross-site tracking).
• Neon hosts the database and accounts.
• Alchemy answers on-chain lookups and floor prices.
• Google and X only if you choose to sign in with them.

California and children

We do not sell or share your personal information for cross-context advertising, and we do not use it to profile you. California residents can ask what we hold, ask us to correct or delete it, and will not be treated differently for asking. Because we do no cross-site tracking, browser “Do Not Track” and Global Privacy Control signals do not change anything on GARU.

GARU is not meant for children under 13 and we do not knowingly collect their information. If you think a child has given us information, email us and we will delete it.

Your choices

To see, correct or delete what we hold about you, including a waitlist entry, your account or desktop feedback, email tomy@kitestudios.net. We will delete it. For feedback sent without an email, tell us roughly when you sent it and what it said. We do not sell your data. The rules for using GARU are in the Terms of Use.