FEDERATION // ACCOUNT PRIVACY
What sign-in records.
The account service is a private preview. Public account registration is not open.
This notice describes the private account preview and the initial service being prepared for public launch. It covers Federation accounts and the Command Deck. Last updated October 11, 2026. The service is operated personally by the Federation’s founder, who can be contacted at gfofofficial@gmail.com.
Your account
Supabase provides account authentication. Google sign-in shares your email and can share your name and profile picture with Supabase. Supabase retains the account identifier and linked sign-in identities; the Federation page displays your email. These records support sign-in, account recovery, and account administration.
We keep the active account record while the account remains open. Signing out ends this browser session; it does not delete the account. An account does not establish wallet ownership, financial eligibility, or permission to move tokens.
Cookies and device storage
Sign-in uses secure session cookies that page scripts cannot read. The sign-in-flow cookie lasts up to ten minutes, the access cookie up to one hour, and the browser refresh cookie up to one day. These browser limits do not by themselves end every session held by the identity provider.
Journey choices and opted-in Explorer Passport progress stay in this browser’s local storage. Sign-in does not synchronize them between devices. Wallet observations and their chart history last only for the current dashboard visit.
Public wallet observations
When you request a balance read, the Federation server sends the public address to the configured Solana RPC provider (Helius when enabled, otherwise Solana’s public RPC) and requests its SOL and token-account quantities. Reference-price requests can send token mint identifiers to Jupiter. The dashboard does not save the wallet address, balances, or visit history to your Federation account.
Optional Phantom address access is a separate permission you grant in Phantom. The dashboard requests no message or transaction signature. Manage trusted-app permissions inside Phantom; signing out of your Federation account does not revoke those permissions.
Service records and recovery
Netlify hosts the site and server functions; Supabase and Google provide sign-in services. Their operational and security records can include request times, IP addresses, browser information, and sign-in events under their own policies. The Federation application does not intentionally log authentication tokens, passwords, OAuth codes, or wallet request bodies.
Account information can remain in protected recovery backups after deletion from the active service. A minimal deletion record—account identifier, case reference, deletion date and outcome—is retained separately while a retained recovery copy could reintroduce that account. It is used to keep a deleted account out of a restored service.
A provider’s dashboard log-access window is not a promise that all underlying copies have been erased. We do not promise immediate deletion from every provider log or backup.
Supabase privacy policy · Google privacy policy · Netlify privacy policy
Account questions and deletion
Contact the Federation at gfofofficial@gmail.com to ask about your account information or request deletion. Never email a password, recovery link, session token, seed phrase, or private key.
We verify control of the account before deleting its active account record and linked identities. An email sender address alone is not proof. We will explain the outcome and any known backup or service-record limits. Clearing Journey progress is a separate device action; account deletion does not erase local browser storage or public blockchain records.