Updated 17 October 2026. ZAPP stores public blockchain information and the wallet-scoped preferences you choose to save.
Contract addresses, NFT metadata, market snapshots, transfers and public wallet holdings are read from blockchain and provider APIs and cached in Supabase. Public wallet addresses are not private account settings.
Sign-in uses a one-time message and an HTTP-only session cookie that expires after 30 days. The database stores a hash of the session token. Watchlists and preferences require your verified session. Disconnect revokes the active session.
A selected image stays in your browser until your PONS token is created and confirmed. Before creation, ZAPP stores only an image URL reservation, file hash, type and size. After confirmation, artwork uploads to Supabase Storage and becomes publicly available at the URL recorded by your token. Images are limited to 5 MB. Browser drafts remain available for upload retry until completed or cleared through your browser's site-data settings.
Vercel Web Analytics measures website visits and page views. ZAPP removes query strings, fragments and wallet addresses from tracked page URLs and excludes admin and API pages. Wallet signatures, transaction requests and private account settings are not sent as custom analytics events.
Thirdweb and WalletConnect process wallet connectivity; OpenSea provides NFT data; Supabase stores projections; Vercel hosts the application. NFT media may load directly from the collection's media host. Requests are subject to those providers' policies.
No private keys or recovery phrases are collected. No advertising tracker is installed. Browser preferences can be cleared through your browser's site-data settings.